Analysis Overview
SHA256
63b8aef384c437824c54047f26c13029955ed664e07c92e14c45c745559d2478
Threat Level: No (potentially) malicious behavior was detected
The file a6a960c544cd8905befbd21fd9cdedc5_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 21:32
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 21:32
Reported
2024-06-13 21:34
Platform
win7-20240611-en
Max time kernel
117s
Max time network
131s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000002ef5f5905240e5cf94cd14cd5f32726c132a7161d8e9c33707bad9ffdd2ff575000000000e8000000002000020000000933e2629c3991ac7d5973ced1d7573533f940e78b89207118374af5ac9821810200000004ca858a88b490b19fcaabd56520c2da684b403333ef7e715abf302c0175d0f5840000000400f8cae36c8bb35aa46563b09139cc30b639c28816e30e75e9322bfd247e58beec5108a5edb0e3eacfff51d49864ed8335f396b2e84df0e8544a6bfcf8c8abd | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000bc25f898386d5f1a662a44e69c33ff22a9e07ad35e83e57884bcbeca0b5bc900000000000e8000000002000020000000b99eb69383abd67c3b47fa38db3a7a5dbb48211b44186eaf54e0c5e552d038e290000000c2c41b95fbae9179ec657788dc5bedf9be8869745f499c50dbbbd7e320141ed6181852a6c3f9e24a8e7a28280a0748c56eb8c0e24bf801e517e57623cef470f9c96eeb7df3cb29b267076b21d8002bd0f2447a36362846b6eb045ff81a71c7405d8a0084fcc2000fc7b88bd2af0cbe4f0b37c3f8a223102ea0272994d06f07bc1bc062b263309e0b1e24c4e1ff03de95400000006080b6d09280b1ac5de4475cfb392e9c4f9d5834daa5a1fc8da99482d4b627d07dec5de7af9eb71a3b95ab2f46ba12775dd547ba97128f7d4f5e5671000aff2b | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424476205" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4054573cd9bdda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65FA2C01-29CC-11EF-A85D-46C1B5BE3FA8} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2460 wrote to memory of 1996 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2460 wrote to memory of 1996 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2460 wrote to memory of 1996 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2460 wrote to memory of 1996 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6a960c544cd8905befbd21fd9cdedc5_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | buro075.nl | udp |
| GB | 216.58.204.74:80 | fonts.googleapis.com | tcp |
| GB | 216.58.204.74:80 | fonts.googleapis.com | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:80 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| NL | 84.244.165.144:443 | buro075.nl | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6F0O117Z\jquery-migrate.min[1].htm
| MD5 | 4f8e702cc244ec5d4de32740c0ecbd97 |
| SHA1 | 3adb1f02d5b6054de0046e367c1d687b6cdf7aff |
| SHA256 | 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a |
| SHA512 | 21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f |
C:\Users\Admin\AppData\Local\Temp\Cab3B7D.tmp
| MD5 | 2d3dcf90f6c99f47e7593ea250c9e749 |
| SHA1 | 51be82be4a272669983313565b4940d4b1385237 |
| SHA256 | 8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4 |
| SHA512 | 9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8a023e9af78309e39785fb014819febb |
| SHA1 | 1d83c43d3d9098ce755f6072861a1941d23df70e |
| SHA256 | 6a69ca514919c721593757ccbc0d61e7a2bbb7ff355784da65d42f2833902bbb |
| SHA512 | de1401dddcb09da25e18c3ab1ee5ee13750bcc0c8230b9b1bed5fb12d69f013a76512429e784d20744d5a87371f66f58ccbdfc6d3ce21eb32df0a80eb14f4f3a |
C:\Users\Admin\AppData\Local\Temp\Tar3C31.tmp
| MD5 | 7186ad693b8ad9444401bd9bcd2217c2 |
| SHA1 | 5c28ca10a650f6026b0df4737078fa4197f3bac1 |
| SHA256 | 9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed |
| SHA512 | 135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5c2dccbd0bbe70992bf4b85a2417e489 |
| SHA1 | 2b8327b2c5fd7532f8e813f81dbc06bad4d6b48b |
| SHA256 | 8c256b1a3958886f8673e64af9618083ce84d7b2c1ccdac1200ae21136735e3e |
| SHA512 | 61eab8b1d11acfa586f3299a22247f38100ee913e81e28907951a2b1d7a862508563aee9c84cd5985316215c4a8dcba9e89d0676ec464e56aa5250f78cbacb39 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6b5990002092c378045391e1391a1c5d |
| SHA1 | 49c58d000df8a1569f0da7e71aa76cd9a141a9e9 |
| SHA256 | 5f53d949799c143545b9e3075881ab22b133c55e92ae40074ead640564325399 |
| SHA512 | 43eb4439506f4c098efc7b61db161ddfa51bd117012ea3e931f7ffc88c7ecb474749c87cc44a35336d8a867b52e0c1bbda5bb8921ca2eb51c867fbea9905dc39 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d321ecc31657a5b3ac450e7ff7ed78d6 |
| SHA1 | b852d08f85cab4719c9b66f4c53c41b3a171150c |
| SHA256 | 4502ed93f043097324b528ba24229ab0f32895171ce59b5605d1de9b7920f6be |
| SHA512 | b112b6e6cba8898ac092b3afca338202e663119669a49ca203fd2f62367661f6653a03c7adda8b419014197b6342e8cbd3cb0cdb2c045ea8fba352499c239454 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7bb2aeae82b381ecce2adfca630c634f |
| SHA1 | ed0dc2d61049b912209327746fa7ed424e33e474 |
| SHA256 | e146aef20ba39a6c569f3bb2c1240d94643d1a09d704b9fbadef9a63538fabfc |
| SHA512 | 70a54fea66bfea4607479b49d481af32841389f6a86376f9717b1b7f161d1bd16164178654d950313665a8378be959813aa30d9d9956ae2e0b8aa45b62b3eea2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a316023009d4da3cacdafc70e8b98e40 |
| SHA1 | ce6fa04be917786cd81c7a1ee76a71b2e6965ce3 |
| SHA256 | 75842009065ea270d3769d102a98541668dc6332886e624cf967483a565db5cd |
| SHA512 | c9f83f25badec86a5188ef0188dbc778727c9028d2c1b13f7dd1fea2dc3bddee8987deda1deb2348a88e1438b41d9b96be8b7f723c4d120c368cada2495bdf66 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d2466cab8ded4a9fea4bce83b6915183 |
| SHA1 | 73fd2f9681402bf255b9e2a5c99ea81c5caaa981 |
| SHA256 | 43cce8712b2619c0e72bd42c58c04d8cc61030e1d763b8a0d7806d9f98b275bc |
| SHA512 | 30c3de3ec59e539c8c9cf6532f861c6226a34b84fcdcd7c7b8699738db59a561e36150ce74240e365872fc2524f221fedc5431df7071d05028b5282074235737 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 22e21da579e15af15f26a92cd0fc8025 |
| SHA1 | bb8b41808ae4b442d7e301c7dbc9c90d4bc958d0 |
| SHA256 | ea64370c6a3ae79babe3a8d28641f8105d8fb5b755328678e22d91a9b4c4b52c |
| SHA512 | 38c8f633c050210f796cecd9d2f18a4bdf1a0def5464ac08010e212add270af748cfafee3bc238894e49bfac94d5f99d04632057a4775816c021034f5268ca10 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b0102b5e1700cd0447b9e134b563eeac |
| SHA1 | a734eebf75f482c7bfdc85aaed4a6d04d910ab75 |
| SHA256 | 7815ca9fdd71f32be0d5e347c3014093d75ab989beb8f8473c7996da7f30130d |
| SHA512 | 8802b970f83b86226f6b50cea8fca6be6346f040bad3a8248b3434702bbc9e4d71238972553771de695870cd4807c6f8edf694bacd73f7ffab69bb2a1ae46b2f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 95ee378e6239f3119e8a99ca2cce21e5 |
| SHA1 | 92e84dc715c87e05be60e491ace07f59018a54d1 |
| SHA256 | 4e4751d3c149b5cba251aafd918088e9fa8e3d84ac1d2db4541fddb6cbcfec05 |
| SHA512 | ffa27f7eb3e255dbb18ed861186645c21b347beb50e77a15a745758dd6f2704ffa1e897d046ce8b5a792bfbbab4a35311478443129357f22ad75234e6aefea4b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a77aa51654da405c86d5a02bddd732b9 |
| SHA1 | ffbdd70c3ad95690eb8fc07568e5e70a002d057f |
| SHA256 | 0d8701cdf368a70492d96e3348fa0fdfd5ddfab178c3a05b04d60470f51db0f5 |
| SHA512 | a6d94bb3036ac6e80d8f4ae0ff8e55c1a882e4469f2a0aee9fa27aaa3e6e0a18a72ad92e26dd26ef5c35a7dde35e88981e87cc9310d78756bac458d976faf4bb |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5114b0e53b1e4dd233f8495e1480aa50 |
| SHA1 | 4ce2367ac778450ce1ccdeb4b59e220dcfc1416e |
| SHA256 | ffd7fb7b18c48a05f0db57b8bcae65558b46391a15215ddc652bb841b5f84473 |
| SHA512 | 0e470ee8e7759e1609b85efc369c2fd4c13ffaafce94dd98a2918aaa046bab5fdd9873dc0475fba1a51bb8d42819705096f81132258a719ab530b17285b1750c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2c8879a472393e72ef608597b3fc45e1 |
| SHA1 | 0bd31398a13c4626fa7be201f5e1dba5f1f6f31b |
| SHA256 | ec8640d6997c6f5b224dcd0216177ca95efadfdc7646d78e5f2d127b4bfd02e4 |
| SHA512 | 41398b585a11003c180501665e1f8ec1feacb558d888867e888d2101a039b06dcdc310142fead69d9b6a8b43947aa19ba8194f50ef639edaab18f4d8d5df4eed |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 845921ecf6659897c9096a53b2c680ce |
| SHA1 | fbf1b22e6b15029a514eb7acc7f2cec9eae9d4bb |
| SHA256 | 3bf1600b1b951539d9c5f48eb40d9a358f051a6741436156e3f040b832db1027 |
| SHA512 | d1297f936917a9e2020fd0ea57d02c69a8eabe67513ebebf42fc65e6245f3a95e1d052b45393091edef4fec18dd292d7ce465bb1aef4c3a4d9a0ec54b49bc293 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 91a2b543e41a943ac0335471dcf36572 |
| SHA1 | 839bf9736979a0e5655ba82c6351458fe30c1972 |
| SHA256 | 4a7d783f0a412fd36fcf793c28544c7f59bfd74d7ba8afabe9657365f3788858 |
| SHA512 | de349541dd77f7c7b24dc9b8088d2a11a0b174bb0cc754ccdd216ab90d640731304e8f779ba05cc8bf024f45ed8401abcdfc5bc8c79d22fc766b3de52b27f415 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 72324ad679fae9c1a3b888d9e529ab66 |
| SHA1 | b159be48db05d9d04f111227db2451aa0e544e3c |
| SHA256 | 715a0d61407c7651b0cd40325cdfe0b4e9785feb5a90c5a75cb6138b82a47d3b |
| SHA512 | 10325420c97b98e435911afe0d9b766d168c01656fed031fa6d2d8c08b93ae601bdefd322e0f83018a254748dfe2e79ef9faed109db506ff10304c09e76bf3b3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 509b43d7dfac2e126c2b5b71e8ea2361 |
| SHA1 | f6294f7dc5f7f4be196f0991c3de08b57fdf4b6e |
| SHA256 | aae5d2678c8b759a8b83b3fca552b62172691e12196613f83e7be168ab62fb89 |
| SHA512 | aa3044f49a74dbc99cb8e71502bfdd5496b507c857d202dbb14bfc538edfce2d6cc5f2977733ce0108592014dd673b80aaf6fa5cebf6a0ea38425c38ee82fc9e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5a99d29989d6b342f32367b7056b47af |
| SHA1 | 216d75334241ab718a0250633abf6df405ecff83 |
| SHA256 | ce6cbdf8daa2fa6940ac69dd5e91067d7398e3f59354017a7de570c119c80625 |
| SHA512 | d7ae89e6e198f5651418051ab9dbf78c38b08d692f2cbb9824826054840b9105e5190a4d19327c9ca5628d23db96f6d8b1c76027458699139d1c76ec18f04587 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 784a6a63749699b668b1f3488e028c86 |
| SHA1 | b10df5c2f819df5aa4fdb04e29a1b76e69f745df |
| SHA256 | 07c6b55715acfef59175c2ceb079f4b3c49a6a52d62754710fa2e75b82e3d96c |
| SHA512 | 0c87d08b90e8a9b583542f00404faca642e32a05b4a2b17d7e25319fc45dc45ca287aa91ee81d17db2b2bc5c696a57ff9bd7212889ad8250cb53d638809fa8d3 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 21:32
Reported
2024-06-13 21:34
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
128s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6a960c544cd8905befbd21fd9cdedc5_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc763c46f8,0x7ffc763c4708,0x7ffc763c4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4384 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | buro075.nl | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | buro075.nl | udp |
| US | 8.8.8.8:53 | buro075.nl | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | eaa3db555ab5bc0cb364826204aad3f0 |
| SHA1 | a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca |
| SHA256 | ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b |
| SHA512 | e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4b4f91fa1b362ba5341ecb2836438dea |
| SHA1 | 9561f5aabed742404d455da735259a2c6781fa07 |
| SHA256 | d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c |
| SHA512 | fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2ba005b690b96b0f49a92cf28af9811d |
| SHA1 | 853e2bc37452ea684c28643e10cb94bf25c9a3eb |
| SHA256 | e1d41e56b844c648bf46d97da3326c004cbe54df2d6f344669a345ae82fb90f7 |
| SHA512 | e838733e6ffaa86467ede4dfb355551a6057a1c6f2814d9606a8b3accfccd2764cc08246357ad0707f7a3dfd59b6e972bbcdb788e5fbc8595e74c38ab90bdd8b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cac14e3a-871a-4547-a7ff-d680afca4ae5.tmp
| MD5 | 1c8fded2800fff39cd4ae7ac83b73f38 |
| SHA1 | 04adf8fa8d6d75a17c4c4a8a27d63b8f644de63c |
| SHA256 | bd4f5bfabd96a619a03a0e14b629d67c0e86ea3ef50bf42f8d283a0821ff88cf |
| SHA512 | bc0c962d5599b2162560ee3ae161b2339b89995aeb4b3d88ff00c2507563e3f186f6bb751dbc987b95371c4daab02ed0867ff51b8d1f4b4d0a75cfc59fbae9e6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 1dc7f28f64f989db92910cff734d565e |
| SHA1 | 05f745c8df2a9fa2a3461a3f615ff3ecedb063b2 |
| SHA256 | 4a5d2d2af16fc5c453e4c927f8be4f855215b210db42f560f7a7b6de1b67c6d9 |
| SHA512 | e9def73d5fb18044a52cb80109a5a19331690a2c133f6dcd1157b1113cfb3c959aeeaa803eea55fa00665b81704e66fd014fda292e206e5ce9f55bdd799425ee |