Analysis Overview
SHA256
effdd1c1c57245f1fe49e94f2f17647bed46667a22748f8536779a8d493ba6ee
Threat Level: No (potentially) malicious behavior was detected
The file a1d46ca5d1dd3a4128aaf74091f63f91_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-12 18:49
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-12 18:49
Reported
2024-06-12 18:52
Platform
win7-20231129-en
Max time kernel
138s
Max time network
149s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000042e7f597aec3db4d8bd11df56d91b90100000000020000000000106600000001000020000000464e2cff6dbee76f9621132005f3077bdf3d7e3dd8b9a7e3375d0b9be065191a000000000e800000000200002000000085f31d3f0b73af1988a9c681a4c5a0f40f43bade7801776f6916f5695d2578d620000000f22b14602d1510aa7b61cb70fa512d5bd10fbe4eb5dfbe111e9712e3d4e784ed40000000421ed2062ebb6fda9b341c80147564687aa67160142382db63b8c512b7906c0049a51f08b894b53d2323aadb9c4c03f00fa3c2a69cb0d2f0501d44820cbb36e2 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000042e7f597aec3db4d8bd11df56d91b9010000000002000000000010660000000100002000000064d089688659bc09ac0f8a185a36115ab007795fa63bbe37b716bad0d9e51e82000000000e8000000002000020000000e3df09b150c4e5470669d018f4c3c4a1186cc1bbef3c5ed4e7ba21b625c9f9b09000000076b614d1729453cad9735d91f8bf0f61d16b4054f7aa7220ce8ffa55f10b24f33da3da92def564b8130f58cc4110a9405a5da114dd77be3b1eb04077ffa09200a7863befea2da81ca6689a0bd23457c0514291231234add51d1bce6af4c64f8ba55077a01700a7078c351dfeea9d87d5fdc3589a895a2e6d27e9f88a6fc750a6081c6894ab29b1528ad162eaec21298b400000001156d51be8ef3d88be482dd070309a241dca73d50a5a6cbfa7ad4bf278c0528ac097ee88464a787efc61c33bd37635b85ea15f44eb51d045857a41db24f10816 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FDEE871-28EC-11EF-A140-5ABF6C2465D5} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e76ca4f9bcda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424380064" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2212 wrote to memory of 1696 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2212 wrote to memory of 1696 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2212 wrote to memory of 1696 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2212 wrote to memory of 1696 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1d46ca5d1dd3a4128aaf74091f63f91_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | css.digestcolect.com | udp |
| US | 8.8.8.8:53 | www.mcsoffroad.it | udp |
| US | 8.8.8.8:53 | getmyconfigplease.com | udp |
| US | 8.8.8.8:53 | dest.collectfasttracks.com | udp |
| US | 8.8.8.8:53 | adjust.admarketlocation.com | udp |
| US | 8.8.8.8:53 | forwardmytraffic.com | udp |
| US | 8.8.8.8:53 | saskmade.net | udp |
| US | 8.8.8.8:53 | hotopponents.site | udp |
| US | 8.8.8.8:53 | sdb.dancewithme.biz | udp |
| US | 8.8.8.8:53 | traffictrade.life | udp |
| US | 8.8.8.8:53 | dl.gotosecond2.com | udp |
| DE | 142.132.202.70:443 | forwardmytraffic.com | tcp |
| DE | 142.132.202.70:443 | forwardmytraffic.com | tcp |
| US | 75.2.60.5:443 | traffictrade.life | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 75.2.60.5:443 | traffictrade.life | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 172.98.192.37:443 | adjust.admarketlocation.com | tcp |
| US | 172.67.151.247:443 | saskmade.net | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 172.98.192.37:443 | adjust.admarketlocation.com | tcp |
| US | 172.67.151.247:443 | saskmade.net | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 15.197.192.55:443 | dest.collectfasttracks.com | tcp |
| US | 15.197.192.55:443 | dest.collectfasttracks.com | tcp |
| DE | 142.132.202.70:443 | forwardmytraffic.com | tcp |
| DE | 142.132.202.70:443 | forwardmytraffic.com | tcp |
| US | 15.197.192.55:443 | dest.collectfasttracks.com | tcp |
| US | 15.197.192.55:443 | dest.collectfasttracks.com | tcp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| DE | 142.132.202.70:443 | forwardmytraffic.com | tcp |
| DE | 142.132.202.70:443 | forwardmytraffic.com | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| DE | 142.132.202.70:443 | forwardmytraffic.com | tcp |
| DE | 142.132.202.70:443 | forwardmytraffic.com | tcp |
| US | 15.197.192.55:443 | dest.collectfasttracks.com | tcp |
| US | 15.197.192.55:443 | dest.collectfasttracks.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 15.197.192.55:443 | dest.collectfasttracks.com | tcp |
| US | 15.197.192.55:443 | dest.collectfasttracks.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 204.11.56.48:443 | dl.gotosecond2.com | tcp |
| US | 8.8.8.8:53 | cdn.examhome.net | udp |
| US | 103.224.212.214:443 | cdn.examhome.net | tcp |
| US | 103.224.212.214:443 | cdn.examhome.net | tcp |
| NL | 23.62.61.75:80 | www.bing.com | tcp |
| NL | 23.62.61.75:80 | www.bing.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab1CC4.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar1D94.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MK8RSJO\stats[1].htm
| MD5 | 023a6b42adde31d4c6bdd07b0419eb44 |
| SHA1 | 273ed1141a88a5c3d5e6df223850bb587a571bb6 |
| SHA256 | 61dacf8b561d397f5884b675aee037bb1446338a7a7e70eac6d24c16bca6d18f |
| SHA512 | 65a1d8a56cb227922bf99cef4af502d058b9bc4a90190ecec0c4fd0dbf19e7f8d639714f7ddc9d685de2de19d78b6eac50f58e4f50c3dd26ab247e0cc8dec84e |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZADZOIQN\scripts[1].js
| MD5 | 9843a52c0d0aa74fc3932786da1c08e4 |
| SHA1 | 53eb1eb4d6ea1ddb99b7c70cf2cc1c9d6840fe8a |
| SHA256 | e5e9461e9b011f638acf9005de291211e659038c03678ee90d768eb7a2c798cc |
| SHA512 | b85852b366e3b4f33aea529bdfdb1fb208beb8499508617539de900160a7229d06c0a3182a546afa79211f7b5b3d3e221ff92bfb5b7b1a82047b3a3f8679696c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 29cea9cb5f27eee96a6ed72562e1fe15 |
| SHA1 | f98d38bcb4d1879ab76223e6f35b65c35b4f2751 |
| SHA256 | 318e8d0015356e18618502175e19b35d23f7b7e802b555ab91faa94dae829201 |
| SHA512 | 42022fe9e8bb19ae5166b71a92ebfe441b7a7740a3b9d91a568ad6fb4371a4d35a85a0dc2c5afffbbdf87d2d9ca7ced96396a4ecfdbb414242fcc3ed4bae82a5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 7662153a423af468270d96bf78f9c770 |
| SHA1 | b2a7749d79d20df36937e9971f57f1195435fd17 |
| SHA256 | 332a79b655d69733940efb9b3324d3e0d1e8e68a2ca4478acc354b390c311084 |
| SHA512 | c2f048986eac0f1a64a29fb25f051fd76fef093a583df16cc4b58a49d062e88a2270859301708669a66bf70cc0c733c126b34b5cd5a4e189967a9e57e1a297b0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 12d6ca916c26baccd54acb8bf70708d8 |
| SHA1 | d338c59f7626b165fed2707bd61e536ed94c87f6 |
| SHA256 | 1cc42d516f1603bfd59acd9f578c0395d1133e3ef659623f2e6556da89a4516c |
| SHA512 | f0e395374aba62715cef6c7c67837c70b1ec62a65510064dc707d332676e533d7c2d2018a6a8ea184416dba175ee623d790a6ade4e25602c24647a66a3523d96 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b7770a885e38cfd2a65fa2431f5be9eb |
| SHA1 | ba281ec58de539ad92c4049a6ee9437b4a9a2b50 |
| SHA256 | 507267d4386886f82f34e4a2b0be6df1eb19238e2218345c09e218d9d7c16357 |
| SHA512 | 38fc15ec9d15f92dcbd85abe954342748a5fd70239306460649f651c0f356642cf98a0aa6090d0bc64363aeb30d6dd40a2f1ebc5cb71b33ef74a6900e8f31015 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ad23af5256af2d6dc06a5db5e9a4b35f |
| SHA1 | 6c0b6ffcbc6eec1722e92e5b2929def945865146 |
| SHA256 | 5bcf906bb3e58b6411c4917fef0531c3a443c0540be5fdb113d0e16177bebc72 |
| SHA512 | 5df4b43056122e529a85b2c06eb8d80da2550ccce03d7aa22338499e9b8ad5f0614e1063f304052c5563ef22704976f99a3fb27dd5e6e644729807760f38abaa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | b565a2068ff2037ca52b2e8573669af9 |
| SHA1 | 1290f5796fd58cbf0f8931b96bfcd9d65b038552 |
| SHA256 | 0643a9b7ac3b15dc479ff67c8f58c598acf9dd49a0dabbfbbec31b7e7413fded |
| SHA512 | 32366a486e63f63b8d0eab0c0431f9d3943de8010f31e37a5fa28599954dfd7525a69321fac4446854a2033bd01bc878b072e1698434b5b728e0cbc04fdc86be |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f29e3f5979e72d3625686faf098f2bad |
| SHA1 | f4d8b7d73d4e42cebd98eb371afb41198f3e6118 |
| SHA256 | 31793091c788a07b7934bc924ced5b40f9cf6f9cf495f18452e4d8c6700ee8a7 |
| SHA512 | ce40238332e0a3f3b54f1fe5de6ed0264f7dcf26eaba917fc09346f1b4bf0464723e1a1a088d051dbf9e9ce8d2591d8a50dfa97f9eae9bfdee4405fea883ef86 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9cadf4919e82f6760c25c229449d95e5 |
| SHA1 | 67713f5706c4c760f2bd68b183e4742269cf669d |
| SHA256 | aeee389d7e586c20940bd673242dd27410f0e587774bc11d7accafda92c33fa3 |
| SHA512 | 2c874edfa07f0417c02054a69ff88382eb7ccb3642ab9bc190526aceb4082aa552f1841ea707cd51e5ca664a6544ab0fd703c53b793ddec4c968b7d62dd52092 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5beeb3f349402c875df619be143eeee0 |
| SHA1 | 22b2e656544c9e38e10333d2ce04b4e2dd3df5f1 |
| SHA256 | 73f5390cbd978dec734de62520310106c2c7fb42c75d15e032bc2803eaf53e1e |
| SHA512 | cbeeec2d5283d06a117391700c091c1671fa891d020bd4813d04f83ec09c755e156355289d16737f8dfb116d67ceba0852e8ee6eb395d0d982bbb41a0d2626d8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 45a045b027879aa32dd49f73edf94229 |
| SHA1 | 863bf50845ede8399a35724f2363f4e5974d0c67 |
| SHA256 | 0aec19a46732182c46a207023a5fe58bbd8a04fe0608c68d236ed3493be7046c |
| SHA512 | 071d30331c6d3b1fd737b881e40cce343377d2018d78d05ee9f7df374b072340a78ebae4267e25a82ba869ec32253a3b0abe69ccde86def0302d7bf709ef73b8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9ff3e7ca00d4e5d95ae423f9354ebd23 |
| SHA1 | 03a06042f4ef708eae36242642948a0631d6d5db |
| SHA256 | b79be50a03cc7a466bc4027755ada1f4f64e3e27ffa1a0badd3ac8fffd351422 |
| SHA512 | 4fa8c7b2a634ed81463e19cffae3659d239fa2ebf173cf05dc9a684730c4466ba0897347f6792aff336f2a0d4bde44ad28fe8673e5e1ea1615316f41e61c335c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a1eb1a3a215130767b710d6df3eccb5c |
| SHA1 | d1df0953c7fd0933f05c55b3acdc7ab3726d8d3d |
| SHA256 | 42fc0db4c79aa2330de41c597293ffe55719dc896efd8abe86ec0ef2ac0a2372 |
| SHA512 | f744ab17af15d56b833c8bc1a62f93b4d02b5f66ad357e48f69bd46146650b3feb6a6181e519ea1e648e35ac4fa0da35c570c68d92b4eeb05ec9b8a65a70448b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a62dcb94195d57b589365160b959aec9 |
| SHA1 | 83c315c3673f0147b7e6ac42679310476de34f9e |
| SHA256 | cac0c1ea19fd95447e43270b9fc029d1bb4e8ef5b9c65315482726b5e02bc632 |
| SHA512 | f6c4360f4893e43188bcaa64569c941e9a3a96d10e203729ab65a709bdb19949f85a89146492afe6ac791edb4c1be91015b944a8aa9ba8ce8ad1cf5093867485 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 904515d543fbca97bcd2c8dcd9feb1c2 |
| SHA1 | 2f442f79d4732ad6fc61f2ffe0e4923ec409fa0e |
| SHA256 | 5a1ebfb46bc1ab2184150526368f3f5f548ef34be71de72ef7e4d9633c6f5f5d |
| SHA512 | 5596922fda6d21e05e9b1be95d5b3052f41dc347230ecadb8c57bd855470d7b3492d5ad2114bf5b4dc301d01c5c7477a402873b40b3d476a82af049f72143d0d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0f86e4b7451eb299687e2448a86e6c8c |
| SHA1 | dccab8eb4ad748ab08c6120b36cd6dae4f6cbb4b |
| SHA256 | 561c20022bcec3eb639540db2f38c4ee6a808d9f6c2cbf1f647726d48bc93357 |
| SHA512 | cd920a4ea5c7421d04dbc3ec4882a0b554876ba78f0ace8d0d1ec2059e36f7c63328b759d6a7442fd6c57f3ccd1a70eef4f194e0929e007b3241dda056239724 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f24a962e4c978e4ac45bd4b85aa640e6 |
| SHA1 | d96719e337015714602e2390c2e7a0b4e24d79c4 |
| SHA256 | 2f2dc9c8ebc6684621da42a609283e5543e8cd604acc0375c7f6a28c9454a8e1 |
| SHA512 | c28446f3ffd59b746c19beefd663cb9cdd47f0dcad54b5196a181c755c59423eaed587f2dd58748ce379299bef7a9ed3a28a440b480539aaa10b8fcc41035de5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6106bb063419540cd670007196738a0f |
| SHA1 | aa3d1516d0b046eb42171128ce0a2b4e175adbbb |
| SHA256 | ae28bab9ad2103efe424ae446ec1e70f8cbea74b6a3ffcacb9d50f101d37330f |
| SHA512 | 0b6d2ae6290b90d1632da4fda73db6f749d135a2cfd2cafe109ce3f66f4bf26ed2723e890f208a477de1964b02ab947b0985d3c75efb2fa9ae0e06261ba83016 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6c3e96cbef50827811714e62ff93f887 |
| SHA1 | 57f77550234c3461beedc35ba06d0cab45d76b49 |
| SHA256 | e8b394e302d3a48bf829afa3534a6bdb9f850b7b62fc952e3e9507f4c4cfaaec |
| SHA512 | 12cbf668e67e6c48a1c0789564a8f13d0dd0f92417ee88d5348f9a91d3c36a0ce147096a1477a09a1ce1d7f3a2f547b4347badba8487f2dd13a5262f75a769da |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | da480bb3299f396878d17bea480c1f19 |
| SHA1 | fb8fd731f4567398c9cc43b76866bd3c69c15aeb |
| SHA256 | 7ec2041035cb50193998aea9ffea428bd7ccebb8c2942fbc96c6c9826c6ab755 |
| SHA512 | 65a6f7517eecb7e97bb727b2f9ab22d65e7950739dfa35a57c2973318342fc5edb2dff13aeef96607240c9e1f75d1a03d58fb3aff650660602a70692652eb48c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d038169aaf181136d1f42067ab56e5e6 |
| SHA1 | 1a670a78c681c08b8093cf928f957d6c1d6d6152 |
| SHA256 | 784a255106417dd62e36b8ad4f7de42140d5afa55fd675c4c4c28d15ef961065 |
| SHA512 | 26417b0e4674f4242bf015ca99b891ce444e4be823e32de571b1ba4d19a9fe449268ff5b80efb4308edc8277be9e5194edaca6916009f8a025470700b7468242 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b38d24549a75faa382b92c27f02c3f6d |
| SHA1 | f52a94da08d92c8b773dabd81949e40efe8a6404 |
| SHA256 | c8eed6d2b1c908d9bf305b30e6b892f7c4ffc208db8b26450a49e4217618dc06 |
| SHA512 | 801dd8950b56f3653ae841e203ea78b531c7879f63707a1f9bfde7a756dd45e654e1ea9f45d6e26f81d0b083e2f82ba085d8eb0b530b10597f8d49be422b8faf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 61f24306db66e23a23b9b8c4289bb5b4 |
| SHA1 | eca8a35ed9431cdbd6880f7b8e882f4ce685d938 |
| SHA256 | 4b7acf35c1ae85ed6b878056215da03f6c651e80cf3c4b8a3d9f4b4ffc16dd02 |
| SHA512 | 27988a879de5d3d76ea4fbda96dc9c3f74a3b19e2a14ed28ce88f900572d3e96d9424cc9ea8ad5694f694e14146e20572ed3cffe8654336af64bd2a8be0edf8a |
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
| MD5 | da597791be3b6e732f0bc8b20e38ee62 |
| SHA1 | 1125c45d285c360542027d7554a5c442288974de |
| SHA256 | 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07 |
| SHA512 | d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-12 18:49
Reported
2024-06-12 18:52
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
125s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1d46ca5d1dd3a4128aaf74091f63f91_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5464 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | css.digestcolect.com | udp |
| US | 8.8.8.8:53 | s.w.org | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | css.digestcolect.com | udp |
| US | 8.8.8.8:53 | css.digestcolect.com | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 439b5e04ca18c7fb02cf406e6eb24167 |
| SHA1 | e0c5bb6216903934726e3570b7d63295b9d28987 |
| SHA256 | 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654 |
| SHA512 | d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2 |
\??\pipe\LOCAL\crashpad_4304_ISQHDBQGGRDSUGYL
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | a8e767fd33edd97d306efb6905f93252 |
| SHA1 | a6f80ace2b57599f64b0ae3c7381f34e9456f9d3 |
| SHA256 | c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb |
| SHA512 | 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8afef6236bf143423a72a26a51e0dcd9 |
| SHA1 | 5e0dfb273a0fc26351f9e7d343b9d49b21b7554e |
| SHA256 | fb7ee0bd8e12b233cf35316edd08915cd66d3f0da1bc713be68fcde3a8d75ff1 |
| SHA512 | 62d74d5e61965f7f5d98520591faa17440354abbc2c18a0b3002fa5b1118d12fe4cec357073c5268e8c61fb9ea2858980f29647d46e4a09532fbb06b2b16e05a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 30a365c4e9615bb31910a50efdc5d919 |
| SHA1 | 4a8359455b6c70a8e774c1b5bccc5808e4eb5288 |
| SHA256 | e7e78251a23fc363a47374de33b960087c6ee13c0cf5014cb29d5cbeeaef98c3 |
| SHA512 | 2fc8e079146781231d40b9e803f9879aeb7b2ff823167526d116bd929e45fbb90fd3e13a69478513b646fc52addbb041f2cadb54aa6805806136fa0fd2befefd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 429f54f92823ab87b606240dfbc37ee1 |
| SHA1 | 3ac886f6e303fdee0ae3dad49a2085811a534907 |
| SHA256 | a272a36de17fecb29e2c80ae2359758405a50ca4affb555a7e8a1c5c086ac788 |
| SHA512 | f820ca92e0ca75d9fd431f9c3d7babf06c1e8c304331f49c90ec283284e467e4547df793ec9255f6f66081332f9eb2dbf5bbf52e026ed5fdd8ec316c79d64299 |