Analysis Overview
SHA256
c337cf6f6b24ba9afef8525511011f9b38af9a6a5d43edf59cceece58c9b47f5
Threat Level: No (potentially) malicious behavior was detected
The file 91f429aa6675f6313e9ff98e2298c944_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-03 13:29
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-03 13:29
Reported
2024-06-03 13:31
Platform
win7-20240220-en
Max time kernel
143s
Max time network
148s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423583219" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2047081cbab5da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006360ef70f7f7a8479cb66e3c2e9b010c000000000200000000001066000000010000200000006f33e23d1e33addecae87f5270cbf5247d0ca5eeae1df340e9e5d71e349bf0e1000000000e8000000002000020000000cbabf0294a71660aaca83980a6ea04d444ae628c8c1d1b57ab4f5f81ab1327a2900000005829895a385bbe71a6accbc456facd5a00fc2cdb65e87467a8c3ae41877c6e59a3f6b14b5b812e3f7e43344dd07476a4dd9d548ea98c428f5fd526b0dfa6f5df1e747df166291b2bd5a84d55a8a0b2ff7eb6b687a9cc7ba4e5f4351700538d0ccd4f0860cb362ea3ee5e8ec3314680abd73fc2704a442bd3dd15abc8ee18f783f4b6a449cf35a4650b77b8a4034d68d640000000f84488a5f684c9436e7d01dce60156fee9f64d8926f9e6b6896bdcb4e59d90b656dd62c15dd618a578172cac1798408874ec676843ff7e08d061df9194f8a433 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{434409F1-21AD-11EF-AD12-DE87C8C490F0} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006360ef70f7f7a8479cb66e3c2e9b010c00000000020000000000106600000001000020000000958544b789e6c6b2744c3d31e2d3d277c57721c0ffba458073a280d918fffbd3000000000e800000000200002000000068bd0f71faac60e84c2158126e85b0172e9e2c1c5110bab290365bb0a2cb4e3720000000aecc2495a6295e44798c2908910df444be329698c0d8e406722f5a12968b4a1640000000c6bc7ac3e60c2c2f52ebaea0f1faadc1d8d8ed0f406beb5c9a4b7c0d7b4ff881103ad08f171214e3e54521612d742eee83244a562dc86aa3e324e19dab522a82 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2192 wrote to memory of 2960 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2192 wrote to memory of 2960 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2192 wrote to memory of 2960 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2192 wrote to memory of 2960 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91f429aa6675f6313e9ff98e2298c944_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | neoban.su | udp |
| US | 8.8.8.8:53 | topiz.ru | udp |
| US | 8.8.8.8:53 | erotop.us | udp |
| US | 8.8.8.8:53 | erotop.su | udp |
| US | 8.8.8.8:53 | c.waplog.net | udp |
| US | 8.8.8.8:53 | justop.ru | udp |
| US | 8.8.8.8:53 | catop.ru | udp |
| US | 8.8.8.8:53 | counter.yadro.ru | udp |
| RU | 88.212.201.198:80 | counter.yadro.ru | tcp |
| RU | 88.212.201.198:80 | counter.yadro.ru | tcp |
| US | 172.67.142.26:80 | justop.ru | tcp |
| US | 172.67.142.26:80 | justop.ru | tcp |
| US | 64.91.249.20:80 | c.waplog.net | tcp |
| NL | 62.204.42.119:80 | topiz.ru | tcp |
| NL | 62.204.42.119:80 | topiz.ru | tcp |
| US | 64.91.249.20:80 | c.waplog.net | tcp |
| NL | 194.146.127.107:80 | catop.ru | tcp |
| NL | 194.146.127.107:80 | catop.ru | tcp |
| RU | 5.101.152.139:80 | neoban.su | tcp |
| RU | 5.101.152.139:80 | neoban.su | tcp |
| US | 172.67.142.26:443 | justop.ru | tcp |
| RU | 88.212.201.198:443 | counter.yadro.ru | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| NL | 23.63.101.152:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | ww1.waplog.net | udp |
| DE | 64.190.63.136:80 | ww1.waplog.net | tcp |
| DE | 64.190.63.136:80 | ww1.waplog.net | tcp |
| US | 8.8.8.8:53 | x2.c.lencr.org | udp |
| BE | 23.55.97.11:80 | x2.c.lencr.org | tcp |
| US | 8.8.8.8:53 | erotop.us | udp |
| US | 8.8.8.8:53 | erotop.su | udp |
| US | 8.8.8.8:53 | erotop.su | udp |
| US | 8.8.8.8:53 | gistat.ru | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab19BA.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar1A1F.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fd45d2b9b91a002365798cb4cd09358d |
| SHA1 | 6fe608a37284a41e03ed692856819df350c833c1 |
| SHA256 | 6f7f312305a8765d764e0891a85b839ce148b35d2d540dce03e9a3bc9e473a14 |
| SHA512 | 9638046911b430e7e7717862e7f81641d953fee7d5586fdb5f69b5b7f707456be866a4393c3eb55212740fefe75c56da8e7951e3b9363f9f2ad96a5b195c1407 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9a9eff8f6aaaa7eda3ef1775308626b1 |
| SHA1 | 37369a4556f2aa2ba4a8362f377480b87d2e656e |
| SHA256 | 0f89ad2159262a3ed31f87aba0f5c1dc43554da12fcf16e8dcfb6337a3a7c1b8 |
| SHA512 | 86659630ae40859d3e7ba3c8309d5e96fd60f94ad98605205e1a17a80b3b0f4c30c5195c3315e4af6df860e374c18b078cfdcfb8368a5dc172d0fbdb57dd9863 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b34ffa40cf3f4f068374a51cb4938ca3 |
| SHA1 | d37a3614fea5ffe2e47d2a603e54c705c544e12e |
| SHA256 | fdb578395be96887adf7ce4fdc9a7ce0c2fbf77512b826f47f9d3e468c4837bb |
| SHA512 | 5b99efb0e42ab602358d44c0c107872d9387f36f51c9c1522bdecbc62112a44cc42f871ca4e5a619b161c9ce4a272dd05e71a9b6aaefadb6e9632fab7268643a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 783615917b675607f489ed6820939784 |
| SHA1 | 2608241871df2f89b8400a5f1a54188ce9b85fff |
| SHA256 | 269fa1d18ab8041fcb3cea6cb91d78469afa2b21e22895003a257b0b91b1ff35 |
| SHA512 | 5b737abbe20c7ca5dfb82169ea38d6f7ea4ec31a80822855d14d4b36b089f46a2805ddac948957bc17e37db043ac156de92621183cfdd7cc2fcc37c6f8b7b62d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 63eaddf1ac8493e5f441376c3f1d18c4 |
| SHA1 | 90e20f820b8a6d8d363078e67a7f1793f44f83a3 |
| SHA256 | 7426b21140e4d3a94a915fc5610f8d91c1e8a18fdc0a3e895a2a6bdc1d407df0 |
| SHA512 | 982d49bd1ef04dd908cd5a7dbeba0dcdca38c280be781ed160f71e2680805b2c559c628564085dac73e071acd5603de4bddd9d240fd19d6ee34eeca9a4548616 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8aad09eb500b0656083c9afdcee4ac99 |
| SHA1 | 075b483e969a3be41523b32383159c13b2239b56 |
| SHA256 | a7ac2bab18e6eccc02aa782eadab12d102746e52817e46187437451a601f32a9 |
| SHA512 | 083960450e2782ec61fcd343e893b20f593f8f35f247c21843200a99a6940b1e1940085ed8b32c402232494175ea746a412f6abfb9b13634b320e4d48d7b5a04 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a83c92041d9c850f57e0e102a2355dde |
| SHA1 | 6215e1a3592eed92d7563bbabafcd1f33e0bab3e |
| SHA256 | 77b0add0c412cd6147744626ddce02e748b410e1be53e93928de4f589ce00d02 |
| SHA512 | 6ca70227837fb7c3db1995ff075e7b3210a9cf5b143f0100ca322e447f5b8f6f5fa29b31c82a6ce801b9f3aa04f44d930ac5954f48b0d8f247ca0341911e5852 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9cb3e74565ffdf9c3f40875b099f4efb |
| SHA1 | 75a6569f52583da1b10ab6f9486af7773f337571 |
| SHA256 | 3999a360bb2dcf387e06e855df6de87b7cc0f995419872f2326f5b3964a1f53b |
| SHA512 | 8587d1092d6b307c12d9a43cbe69f0a67c98f14aa608a0f8c9247dea4104d2ac7d3d04c91fb38489f449933e2035556d99f44850c07e0513ee4ff921a6517f04 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 778a35f2542bd0d578cc15712082feaa |
| SHA1 | 88797afab856362dff092ec1bc790fc64656bf1a |
| SHA256 | 6fa354f2e9d8c26ab38bd5c9044104221f750a407ac243bd3b284d6283331926 |
| SHA512 | e4547e024967b0ad7a6d09dd14e01536be60a5d366a9955757692b4899c976188b407309a0ed8e788ccde4e11025bac14f1692fbe99bbe03564e384a212bc44e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7fbb9de81b11804e232fd8ba7bf14a27 |
| SHA1 | 8d39bc8bd2368110392eccddfc0ac36073504016 |
| SHA256 | 42114fa1bd677ba291bdd0290f06c6c1129fddbe08912ee3fd11c0214647a7de |
| SHA512 | 28b332bf367161e208b5c1df5b1963a615b139f3fb68b9660c710fd0974bbd3afea1f98ea11c8cfe634d6d6ae3ad479a436504c259b4d7772e42681fe26670fe |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e201a27ce8d0704f2dc9a14b505b0600 |
| SHA1 | b81ca98b572a1adf001aa1b296c26e0b7763fd45 |
| SHA256 | 990c6c1999b55b0c50adc1454572e466b5b60f82f706c5e9ac204de27684888e |
| SHA512 | 7a1f2880971a943ffe6c5b7a1a5ab2a5774da8e8b76b9e5a18bf3060011840d08439e57e75996ca9d2a0c6dd1430ef9fe1ab66c91a5d8f8825e8145245dcf306 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | e319120b2422009c4cec491d8a3f959e |
| SHA1 | 36b8370452b6920173594fb9241891ee2ea205a2 |
| SHA256 | 26683d60ddd68d1638f1dd39140249e58210b10e712cbbb937dd5e53eaef260c |
| SHA512 | 4f295d57a03c01c4f431aaad91777fd26995abaebc7da609517dc1b7c56cfa94349a5e9aac318f12082c8d6fac8d320b9137b16a04d8083ffbf0ec8bd7ff2661 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cdc654686f027b9b8415706a4e7a6919 |
| SHA1 | 94ebdc177df39b31955014d2d03b2438781c37b7 |
| SHA256 | 3f61f6f6ce7fd218b97138610bc69273b69916284545b35fee0fc9558a41255b |
| SHA512 | d78b4667a5a51720f044cd8a84219148be505637994952cfdd6349d1ad21ff1d7d0bcd899eea3b84ee031a0d18f9b517aa8531bab7acef6be18952fdc8583e17 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b34a1cb0b597d3fbfbb06eea7328fab3 |
| SHA1 | faf0b4fa8870b68d7207c8934a33dcc1ac45a892 |
| SHA256 | 9ab7f3b36a4a90a42be0cd7d636cc28a746e7c30c8c80b6ad1e391c858cb2ea7 |
| SHA512 | 2984b8976965750d0db14faaca77da222a82e8ae32a1b111b22274c84da630c0b4eb8f8920dbaa4a239ac42efdf6a93d9518801000de18199e7ff1f97de53ca2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 77e34f95a284481fb9da128f8fb8f96d |
| SHA1 | 1720be3a7399be3a95f013e6eb928977f4ba94f5 |
| SHA256 | 3ba228f62fab4501c38d695d56832aeb58cf2c45901af8861ca9ea68c9e53e74 |
| SHA512 | 9607b9af98c3d17c22408d54b0dd7ce5934041c0cb1a2a5aed7ed5eaeed91636b13fe1c087a6ff151bee6711f32781196722e0fb305258da95a55b4036f35bbc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 02337a1708fa8e55f4b778638e2658a2 |
| SHA1 | ec2e4c3113cfb121356af6af49ed393275398c50 |
| SHA256 | 0468c93095b83ddca765ac2778fabbeaff22af3470e7661eb3638c4e3938dfe6 |
| SHA512 | 5df1cb43d4eab6d2a2b7f0bb5948e1736f40f55e9ea2ae2d58bab01ea238b6d76d588e44c2dafbc58c1257fb28501ec44aec5818b70dcde64266f3890582c0ed |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 84c5dc740b5e73b7f514c7a7bb5ee80b |
| SHA1 | 0db665c98548288f6de99739c3d5097cb79964c2 |
| SHA256 | 86ed8cf774e17c3be769f41e93e894f7bbd540f486de81b85f29b334c145a7c5 |
| SHA512 | e9c43bc593bc1473b27512f03b719a7632a69f60efdef18855ded9f05913c165f476924f2c17a52306955a07375f7c0987d0c093458c95505f03d0932a258b3e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e064951e5417004d84b60091bc104b83 |
| SHA1 | f7bd5bbcbefb9b694a92d809ffbeaf938c406a66 |
| SHA256 | c556508f0fbf57cf9dfc1443dcfe6a9fd460ad2775f95ebe4448393c587ffc33 |
| SHA512 | 45e6c55dc7bfed30d6e837b027b565e76c5b475f0967b73444a43ba69f0336321007f62f8b4be36415cacd536a4cf162e35eb8b98fa6c3f5e8977122817b3203 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c5827c4b0aa54a43daf1ee764c5f76c2 |
| SHA1 | 343e57149214712d2d09cb22671dd37576910b7b |
| SHA256 | 137fd72ed05185d78a5a1f114c0db69aa691e27580a2a455a9f7639a32a05090 |
| SHA512 | e15d5fdd2e57715409e0b597bde4bd0179aec8149baf017c6d13a2900c355198b8c29267ee6d984b3058488caab268eff2768e09fed5c56b15b674f16f6b4b5e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fd2b0ca753388e625712b92bdb64f6bb |
| SHA1 | 791f26f62fd64e7d4f7b1afd4b501e247e7e9ef4 |
| SHA256 | 67ad94ea9ab3d3c0b23335bd6c306d61b9a1c4215a4158892463eaf7fedcdaf8 |
| SHA512 | 72ae908e1fb1d2aa7a3c359cb3c1caa2f3e77017977223fc63420c5f814a5c09f43d988292850b677b4c66db7a5634658ac2e2aa6a852f08ab6fa7fe7dd8a5dc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 43e8cfd4779845e0b1a35b0d129b4969 |
| SHA1 | 798319ad7b852082e280b9db06a24117d78167a2 |
| SHA256 | 1570d632474bc0ba1510d76523bbadf1d61cbb83449f9249c8de30a5ae33dc63 |
| SHA512 | b4706e0731f1d2b340a691b542b4c10fd7d8bcb6b868273183869638543f9e3badcff8c40655f44a788296fb71ada161c1cd6651a8ffebd6562afd0a97bff2df |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-03 13:29
Reported
2024-06-03 13:31
Platform
win10v2004-20240426-en
Max time kernel
145s
Max time network
139s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91f429aa6675f6313e9ff98e2298c944_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84b6d46f8,0x7ff84b6d4708,0x7ff84b6d4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6571475694050371293,4237428393684769910,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3964 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cetoftit.ru | udp |
| US | 8.8.8.8:53 | counter.yadro.ru | udp |
| US | 8.8.8.8:53 | c.waplog.net | udp |
| US | 8.8.8.8:53 | topiz.ru | udp |
| US | 8.8.8.8:53 | neoban.su | udp |
| US | 8.8.8.8:53 | erotop.us | udp |
| US | 8.8.8.8:53 | justop.ru | udp |
| US | 8.8.8.8:53 | erotop.su | udp |
| US | 8.8.8.8:53 | catop.ru | udp |
| RU | 88.212.201.198:80 | counter.yadro.ru | tcp |
| NL | 62.204.42.119:80 | topiz.ru | tcp |
| NL | 62.204.42.119:80 | topiz.ru | tcp |
| NL | 194.146.127.107:80 | catop.ru | tcp |
| US | 172.67.142.26:80 | justop.ru | tcp |
| US | 64.91.249.20:80 | c.waplog.net | tcp |
| FI | 95.216.10.178:445 | cetoftit.ru | tcp |
| US | 8.8.8.8:53 | gistat.ru | udp |
| RU | 5.101.152.139:80 | neoban.su | tcp |
| US | 172.67.142.26:443 | justop.ru | tcp |
| RU | 88.212.201.198:443 | counter.yadro.ru | tcp |
| RU | 5.101.152.139:80 | neoban.su | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| NL | 23.63.101.152:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | ww1.waplog.net | udp |
| DE | 64.190.63.136:80 | ww1.waplog.net | tcp |
| US | 8.8.8.8:53 | 152.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.42.204.62.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.127.146.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.142.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.249.91.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.201.212.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 139.152.101.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.101.63.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 136.63.190.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cetoftit.ru | udp |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| US | 104.17.25.14:445 | cdnjs.cloudflare.com | tcp |
| US | 104.17.24.14:445 | cdnjs.cloudflare.com | tcp |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| US | 104.17.24.14:139 | cdnjs.cloudflare.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | erotop.su | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ea98e583ad99df195d29aa066204ab56 |
| SHA1 | f89398664af0179641aa0138b337097b617cb2db |
| SHA256 | a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6 |
| SHA512 | e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f |
\??\pipe\LOCAL\crashpad_3524_QQVZVCTASVLWKSCU
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4f7152bc5a1a715ef481e37d1c791959 |
| SHA1 | c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7 |
| SHA256 | 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc |
| SHA512 | 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | bbb0d0dd7c3c424e50a325542a747556 |
| SHA1 | b4e7221f625b4b5be467e0f3b9265803a2ac8d4d |
| SHA256 | 749adab1f8e2cf7485c1d777d1c476b9fa8bc6fa77e68a0e74b9643e1b6f594f |
| SHA512 | 5c50ac926beb7d5ff63fc43b13f69caaa600061ee362ede6214f80ef08f40f6bc06659edde4bffad82bfebd71edf98b21e80e488be791aa9713b94f5c0f21611 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 944a806b21a2ffaf96783eb3f061f3ff |
| SHA1 | 9f9cf7c6760114fbe93af4734082c14a02550b9b |
| SHA256 | 053d741a33b28683ffe4827d89f05ab645ad7e1f2e5dfb328b066f683e7bb9b6 |
| SHA512 | f5f6f5c38ccae3e1a3e54d11705cfc2067cd19e75ba7654e3bcb26668428c36ad6df1c945616c47deab73c5f2c8ead30f1bc217c4eb346f15d1e758d074db940 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 9a68eb3c70b2ac503b6793f632cc728e |
| SHA1 | b3a514baaeb1046e73aada51b3650a3fa4dbd80f |
| SHA256 | e6fa63a8b7d2aa33774260bacad1670d3e60992cfdce9f0ed3e7c7313ef1f569 |
| SHA512 | b72fe3d418e89e6dd9573df6f43cca1ebf944b9e59cc0f7d21be315e4c690245a345a91e0e6f96e07322c99ab0d3acb34238b0a2aaa1ac3a84ab66faf52fe357 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 27775b0365dbc178c2f47235e867e845 |
| SHA1 | 80c9169ae04a54c958b59071e1f24e8746308cd0 |
| SHA256 | a5c28957e3c6d980121a6c9a3a9e11076c5a631ce3a6201227d211107227b814 |
| SHA512 | f625bfa548f259c3a67036b0a7dd5947daeba58c2e5a4519f1005e31894b0e88bfd09909856378a3b67fbc45e49b3189edb76752d946c4bfd10ad8cdc48e9b4c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 81b60bbc45ab417f4fe212afffe4317d |
| SHA1 | 317af60e30a27f28bc39a71dd4fd3d27db43a1d9 |
| SHA256 | 0ae4c09061a98fedc1683992ffdb5718fa3089aa74d773748121f677f4744643 |
| SHA512 | 44c2306b958eb732ccc1b34480428f8404d633774f9e37a26691ce67f2d8c53f002c911152577ad804c2a5de5786a7e4df0a48cd7af5521e46760a10a30cfd12 |