Analysis Overview
SHA256
5a6939ed61fc750f060e19645a31b0df6f597a682913a7505f8b3db1cc5ca8d2
Threat Level: No (potentially) malicious behavior was detected
The file a3b324c2ed72c24b06a83a67b172dc2b_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 03:37
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 03:37
Reported
2024-06-13 03:40
Platform
win7-20240221-en
Max time kernel
142s
Max time network
144s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55064DC1-2936-11EF-995F-5A791E92BC44} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424411748" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ebc3702f57a4934588d79887cf39197b0000000002000000000010660000000100002000000070a596a5d52a3f35d9e3f35dcd487d900b9395e16a1937e6e15aa073cfbf3915000000000e800000000200002000000003838de09cab57e5961e390b6e7a065fcad32adb5733dbd8f7daec933f041fa0900000003a7ce10a76ba8f16008aec9cf23ca7f13d2628bcf2a2f330c20262e38ebeda00133fc629aee415194db99f21604e5e0a1fc043f4959ca6836c70cd246e714d4085a47f846431b8acb7b5078a1435be319f646348549632c0085175f50313a19204b374bc899296a452545883afebdd8024579fdfa5043526392fe240437226c9a31670879c88a2a92962e7034a95fb67400000004ba529aff19af58e677abb48836bbba2682515424906406d1fecbe2062ec3946bd1341d09cd4ecf00ae3b57e3498bdf5ac905cf9650b39e33f42ac4955105a13 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ebc3702f57a4934588d79887cf39197b00000000020000000000106600000001000020000000641fa608a1c1f5fa446014f4faf290a5687e76eb28e89ae37e7940a06a10467f000000000e8000000002000020000000c39728ca953e638d9316886cedbc19213956e7a10376bc1ab39c6f3df27807fa20000000841c8231c7dd548ce702cbea1ad1d92529ba9560095221726c1d77502948873c4000000083bb8824a245869bf705f0bc34581a90f9a0fbc742c08a9bc21e1b59bfe584f99dd557ddf9dad524904ab17c9884509b90b6aee589c813b653b8ba3a812a8a84 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607e113843bdda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2952 wrote to memory of 3036 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2952 wrote to memory of 3036 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2952 wrote to memory of 3036 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2952 wrote to memory of 3036 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3b324c2ed72c24b06a83a67b172dc2b_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.google.com | udp |
| US | 8.8.8.8:53 | naruto-hokage.do.am | udp |
| US | 8.8.8.8:53 | www.cy-pr.com | udp |
| US | 8.8.8.8:53 | counter.rambler.ru | udp |
| US | 8.8.8.8:53 | naruto-great.ru | udp |
| US | 8.8.8.8:53 | naruto-brand.ru | udp |
| US | 8.8.8.8:53 | anibest.ru | udp |
| US | 8.8.8.8:53 | aniday.ucoz.ua | udp |
| US | 8.8.8.8:53 | anicrow.ru | udp |
| US | 8.8.8.8:53 | anirai.ru | udp |
| US | 8.8.8.8:53 | kinocopy.ucoz.com | udp |
| RU | 81.19.89.17:80 | counter.rambler.ru | tcp |
| NL | 31.210.170.12:80 | www.cy-pr.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| RU | 81.19.89.17:80 | counter.rambler.ru | tcp |
| NL | 31.210.170.12:80 | www.cy-pr.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| RU | 193.109.246.70:80 | kinocopy.ucoz.com | tcp |
| RU | 193.109.246.70:80 | kinocopy.ucoz.com | tcp |
| US | 104.21.69.195:80 | naruto-great.ru | tcp |
| US | 104.21.69.195:80 | naruto-great.ru | tcp |
| RU | 193.109.247.85:80 | naruto-hokage.do.am | tcp |
| RU | 193.109.247.85:80 | naruto-hokage.do.am | tcp |
| RU | 193.109.247.85:80 | naruto-hokage.do.am | tcp |
| US | 8.8.8.8:53 | mc.yandex.ru | udp |
| RU | 93.158.134.119:443 | mc.yandex.ru | tcp |
| RU | 93.158.134.119:443 | mc.yandex.ru | tcp |
| RU | 193.109.246.86:80 | aniday.ucoz.ua | tcp |
| RU | 193.109.246.86:80 | aniday.ucoz.ua | tcp |
| RU | 195.216.243.16:80 | anibest.ru | tcp |
| RU | 195.216.243.16:80 | anibest.ru | tcp |
| US | 104.21.69.195:443 | naruto-great.ru | tcp |
| RU | 81.19.89.17:443 | counter.rambler.ru | tcp |
| NL | 91.226.31.82:80 | naruto-brand.ru | tcp |
| NL | 91.226.31.82:80 | naruto-brand.ru | tcp |
| RU | 193.109.246.70:443 | kinocopy.ucoz.com | tcp |
| RU | 193.109.247.85:443 | naruto-hokage.do.am | tcp |
| RU | 193.109.247.85:443 | naruto-hokage.do.am | tcp |
| RU | 193.109.247.85:443 | naruto-hokage.do.am | tcp |
| RU | 193.109.246.86:443 | aniday.ucoz.ua | tcp |
| US | 8.8.8.8:53 | mc.yandex.com | udp |
| RU | 87.250.251.119:443 | mc.yandex.com | tcp |
| RU | 87.250.251.119:443 | mc.yandex.com | tcp |
| US | 8.8.8.8:53 | top-fwz1.mail.ru | udp |
| US | 8.8.8.8:53 | kakuzu.ucoz.com | udp |
| RU | 95.163.52.67:80 | top-fwz1.mail.ru | tcp |
| RU | 95.163.52.67:80 | top-fwz1.mail.ru | tcp |
| RU | 193.109.246.128:80 | kakuzu.ucoz.com | tcp |
| RU | 193.109.246.128:80 | kakuzu.ucoz.com | tcp |
| RU | 193.109.246.128:443 | kakuzu.ucoz.com | tcp |
| US | 8.8.8.8:53 | privacy-cs.mail.ru | udp |
| RU | 95.163.52.67:443 | top-fwz1.mail.ru | tcp |
| RU | 95.163.52.89:443 | privacy-cs.mail.ru | tcp |
| RU | 95.163.52.89:443 | privacy-cs.mail.ru | tcp |
| RU | 81.19.89.17:443 | counter.rambler.ru | tcp |
| US | 8.8.8.8:53 | js.hotlog.ru | udp |
| RU | 89.208.236.251:443 | js.hotlog.ru | tcp |
| RU | 89.208.236.251:443 | js.hotlog.ru | tcp |
| RU | 89.208.236.251:443 | js.hotlog.ru | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\newbanner[1].htm
| MD5 | cd2e0e43980a00fb6a2742d3afd803b8 |
| SHA1 | 81ffbd1712afe8cdf138b570c0fc9934742c33c1 |
| SHA256 | bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d |
| SHA512 | 0344c6b2757d4d787ed4a31ec7043c9dc9bf57017e451f60cecb9ad8f5febf64acf2a6c996346ae4b23297623ebf747954410aee27ee3c2f3c6ccd15a15d0f2d |
C:\Users\Admin\AppData\Local\Temp\Cab1B40.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\Local\Temp\Tar1B62.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f3165a718d187d302b3963dda9e24c51 |
| SHA1 | 883f1ba98590f02efb58b05a3798ae7d02c160ef |
| SHA256 | 7dc6812582548b4581a1d5530daea7efe404893f573bd627d4f14694b09c57eb |
| SHA512 | 9e4205437fc6f488d5dee778c380b80dfdb4eaf64b02b0e13ab95c40e835af60e8461cb9c07026ac9dfed801c18d29dadecc2681922ddaaddb6a0c6ad9a3cfe8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar1C49.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b5933b2042c94da6f6481353116edbba |
| SHA1 | e7f47dec19d11317b5c0963dcaa37b55834d04d7 |
| SHA256 | 204e236a1fe10ff6cfc12305c56691f1201879ae403e6d547d6c16db9b43adca |
| SHA512 | a923f7280b8dd196afbc8a4d0a548e70fb7b82fda16a8de9ba01624584fc732b35c331ac65035212eebe61105168048a4acacff4ec0e86469da510bdd4e2a5b1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 29d297a8858f044a4ca38e2afff353b1 |
| SHA1 | 91e577cbdfc1eae84447d0ee36a54f401bd5f94a |
| SHA256 | 6764ea322facb9922d2426d0ba21a00b75ada3121bee82ec9042f7c80ec28b4e |
| SHA512 | aa93e902cec6bf928406bee91c586fef2a2528c6bf9eb09f3473433e07c66b49420ae492ac55cc00a06792e1a17f2298ed247926a75718b345523b3974a84323 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0d5934473c67501eec810911d31e4b7a |
| SHA1 | 3d1e97894bbe7a7e90563251f53d4083f16453f7 |
| SHA256 | 4b9620995faaa55a126a50c1fa3c4d057501ceedea71f325206ce82b7ae8ae19 |
| SHA512 | 84d42f3f6dc1ad8bbbe728a802f839c45db2b37c0a6ea5b1fa84cf9bfd0634cc01dccaa1d380e0e7e9fc02f6afae50d2bd34a24b584e14bfbc68b6bbf28f9481 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | 3bda034a15996e8ccd9afdc3b3da19a9 |
| SHA1 | 1f8e5303deb56ec97abec30e37a2a6870a7bd129 |
| SHA256 | e2d1cb08bf891f6966ebb1d04dd314f09952eb9fd3e84cc52e279da88dc662e0 |
| SHA512 | 0fe96ad9131361ec50437153d1166feb15c3442544da72c1618d849d9b1d454b55d6f0c0fcdd3de74b1510fe334962da144958cd37d55361a17eb5ab8f97151e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | aaf642c144cb3bd3525180135ccd9cd4 |
| SHA1 | 9090f98c36dfcaaaf9acbc11663625ef1bf8e251 |
| SHA256 | 7b74d59821064a65268409899c4dab29b31d5a3b03f0a711a8d531e3998f8a92 |
| SHA512 | 83c37ecb17feb1652e0b3f64968025be7f5fd605c9c16d958c1ef70bc395a4dc16ee8e2c030825d1fdd3c3f6466aea438c43f09bf916442b2982622db9ce5931 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
| MD5 | ee6bad06594c87f316f0d97e93c61ca2 |
| SHA1 | 82f2578706b16663f11d4658e2db7576fa154a0d |
| SHA256 | 1c8dcec8bb716748c985b40379c63083543b847abd5cface5b21f09c7e71017d |
| SHA512 | 6ac3daa56c5049169e8f44d28396ce56066b8a0035e1ef4f5e268906366b44052a0229122ca39604b1ea23ab6b513620b90ee0f0d5396e0658706cb248896548 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
| MD5 | d9f99f631cc45b009e4d8c7fa02ccba5 |
| SHA1 | 15339e7c50438d272eeccd49161a93eeee4678a8 |
| SHA256 | ff52f8b83f9423588b391c48528991e202c059c2c4f9c4446e5fb3e03f063880 |
| SHA512 | bb63879265fb5b117681be74f3f3f1e94c51d76d0e4c0f0235011512bec96ee1f06cd2544bf1bfb7b9e8e374787675bb7d6ff2f73200a4e04b33395de3d58652 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4d986787c472a82ccf3a59f325c60929 |
| SHA1 | 2ab162810bd717bed2f52464299e75fc4f376e3e |
| SHA256 | 9b7816ab6127106f5f91b5e884bd0fd72f2abf515fc8aa163be8bf9be175d9e2 |
| SHA512 | 1fa2d58b8aa1b7f8fbff6bf199abc45a0f6f4246ba4dc2f086e23aa0fc88b354f59563fc875d14b465eda0a10b4352a5cfdbdee610f4b94e031e9e3c3ee36986 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4a970fab198e628d52dcd98edaaf7a89 |
| SHA1 | 6bb5fde4f447f62dff8fb1d102fbe77184449ff1 |
| SHA256 | 563f2f735ebb02ce861bd1633cd7440433a7fc7edc96ab28533bd8a7fc27a062 |
| SHA512 | 290390392500c2477c88c24ad47371b1cf07a320f1961a870cb01739f79289742976ad9a349b80d6a30d91bc828f9aef092ca060da5380235d8497310c6380f9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 937626eac9c5dafd7cbac603f8d69b63 |
| SHA1 | afa1ed1cb42d9449502ba0ab086c43ba5325744c |
| SHA256 | aae0b4bdba1422c0dae6a0af70b4c583a0282c38a95f18d201553aee89eda145 |
| SHA512 | 5a16a83a43f363094f9da184c430bb7b2c5aef5a77aa4a666c13990765962f4de42f81a0772661cce3b81f62b2bfcf3774436ebe67e2982251e0499d622a6fe8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 021bbc71db53dd620dda7a92018534d9 |
| SHA1 | 75abf111ba8a557072ef50ee670514e38ed1e0ab |
| SHA256 | aef7dd62adcab975355ce808462fef23cb59c64d8632270ccada096a6fb64b50 |
| SHA512 | 73cea6f7d2e923b0069efe7d66edfcca74d905131c3309ba80507d66c6e1033b24b4378f73c936d32ce6b49a749a4e7b0aa8e45601787cd33ff8176ed06c49d6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ba82f5ea92097dc80747162bbb44d698 |
| SHA1 | b8023cf4a5b1e75d99070c7dadb1a4793a21281e |
| SHA256 | c45c7f675d46c1ab8b1d348a1b5d6775678e290949aca25dfb7b91bfc9415b7b |
| SHA512 | 502281c3ca18486c7ab002b1886a7e41e68b2b6ab0af328ae92dfe9501b5374c09fc377f5444d86b45a20eec8510174fb8acdfab555f1cdb64f60ea9500faa72 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d64070bec4b0f3d971e2e97842f75bc9 |
| SHA1 | 99fc54b02f29bdc3105a112d683bf832970f8501 |
| SHA256 | c89bbc87893d770b06b70b42eecce2eea4599068a2d765f70b18f2518bae9769 |
| SHA512 | 55c7b739ebef20a66657b282c0b3a4b1060b7d90130c539be3d3246ddd8c3407e28cfe95f12b1f8eb0c61df1fba1950ed76b3329b7ce45df1e53069f3fa2e8c9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e35afad25db713cb6f7c58eee18457f2 |
| SHA1 | 828660311a88520a373e2b8843efd566fcd5c172 |
| SHA256 | 1388db25bd017a606b963037924b8eb898ce571f0ccbbefc986526bce9b6818f |
| SHA512 | de0c0815784ae15e330af3f20b01f6cacc1dae707dd10835bcebc422fd5e2a818f88b7d37b18b14d77805e5f43d0110197257b6819dc6f5048ea1feda7577862 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 52a9e5a1a998169e7e8c570cf1bf9516 |
| SHA1 | 260806ed5e494598aa60265e83fbd86614d0e078 |
| SHA256 | fa8eac461747eb2135d153899a2e5e64f8aa8d14677d9929d7e92b18e8f74107 |
| SHA512 | baa23f715a383bdc081059f123954b74c0e7fd1e015d84f7086d659f71929cd508be78ef340de516dd6420d37221133635f4776091b4e4bba37ef86c4570e0a6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 85d9a69a76b8a99047defcbc87064fc5 |
| SHA1 | a87a0c5536336dbc81f1b31e0238b9b12594c2f1 |
| SHA256 | 8ad03b32ea002670a3373719bb6176343d87388906a4e402b53b8e0054c309e4 |
| SHA512 | 830363a8694c149d2f1616455839e2c8c691151c6764001fd734cd83fd89da30ede8e5659e6fc5c4a5c041a15b8f5336ab92803366fa8ab99c912f7504dc5650 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 52516fe61bb26504166916fdf161362c |
| SHA1 | 2bfd5d1276fc877d980ad4be0df04f3ddd16e003 |
| SHA256 | ad34b2352ff32c0879ced58a47f632b5d183fac4d2da5ba55cc03fdc38ab335d |
| SHA512 | 006ad80175c6f762ef6eed840c9420c015bd14ca612536b51fb91fff19212507d657beb4485e8ee3023e4368fea3a8917c33a6a44469859b51f88d553eac1584 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 1eb2781f6f7e450927e6853ba1bd8299 |
| SHA1 | 00a8787c06a58a04dd33c02b2e87b3e581ccd5cd |
| SHA256 | 915d1f27f2c9fbab770defad41e805b30ce744126773839dda0028fbfaffc2fd |
| SHA512 | 2385d77949f45a2c8d73c5dfebd4cd4cdd6bc293e04ffc1cc376e4e45625c6a5110440da56bdf92bd23d9a6092f7c03cd126d4344b3bb173c881085e872896bd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3f82cac2d0d1b381e844b95712eea3f7 |
| SHA1 | 26552e21414f579de4fa90cf8e7fc8d1ad303400 |
| SHA256 | fc981e525261db643654dd2be50961d9785b49b92a94f2655d1cf52f5155c08b |
| SHA512 | ee84c8d219909d5ab1e0e46699887dc4b755857363732ae145e1491052f75e0802576dbfd662310d6ab482dfab5c2942004a020cf92e217ddea15441d8fb5c55 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 43f7c8a5ed62da862c773cb3e9c9ba86 |
| SHA1 | ad2d79e56aedbe72904cadc6c63445949297e420 |
| SHA256 | f70ed5d056c72406b9333486d08bf844af78c4f3b6232158ceca6c7a72c8fa42 |
| SHA512 | 51ac42817f6e18a35439c524394ac8c4cca76af5d92448ce23d6b97f2ddf22dc3acc94a04c12aafb6178f4355e742f628617a83bb4503c6c2c9b673b69cbb5ea |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 67b7522a69e74c9248c114cf7607cde0 |
| SHA1 | 97dfe0c96f57428a92924035a4203a02b207ec0f |
| SHA256 | 40ebe35d02d599b36ecc40be9b9aed86264d6631cd9dfcf4b77319c1458272a8 |
| SHA512 | e92f164662fb202166e2f0c831915183cfc8f8c7683e841743607954031366debf07037a6ef14e51914d6772c4efd09359cf9675bbcc122d907ca35cbf2e7f5c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8bdf35894a7fd6cc8abde1215d0337b9 |
| SHA1 | ec22f91d9814233559985eaf328ba0e9e1aa6bbd |
| SHA256 | a15771897dba329093d8c68e02efae48bbfb58a97d159be68f363bfd985b93bd |
| SHA512 | 4661a5f4b036e0ddde7b3fd1bd23195b225da9ab0244d961bc60ea937bcd857483a9dc7d06d8ba5424351ff2fbbab97bb6c822d7351670ab1f731d135865e623 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b1cefbbcfd1da00a0cf01aadd6b3b080 |
| SHA1 | 3ce1120103c26df82f92fc6b31cb9988e35095d6 |
| SHA256 | c7a5dfb85a4a6a707bcdf5593e8f14503ebbdc2080688ffc634bdbbe53de05f9 |
| SHA512 | 37759752dd73ff6692098cb79b775cf324aa09cdce37fc2dd991ca56ceb5a369846ea28037df564738f4311fc3073606057f3284c343ced6a155cb0b80d2ece4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a7041002490b1a1e51e0e8f998efd8c1 |
| SHA1 | 001cf5434c9ccdcb34efe7df0fa45d5af3f2ed10 |
| SHA256 | 46461d9aeda37aad2c36e93632524beb7684b59f46cedf08f63869efee005ae8 |
| SHA512 | 52675ff4bdcff2de6b753ee25f6f68363f34894845f0b03f49c6bd4176705c6cbc17b81db1053d9d2acb886b1c85ecc40967979d7ae02742fe8654e25306b74b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1993e4ff66b677ba58f619ee6335f3be |
| SHA1 | f4c009a19d15bd614c609250fac0a7316874ce71 |
| SHA256 | 8816ce46ceb23af0c8b3c519bb95079a33d31f06be10d8e67cc90f7a775237af |
| SHA512 | 6b820138ebb9158bceb101cfc46b981bc10c0af0cb50c5638a66a089cae295c3969cbb7475565047b90d686c437f2e1f8d36b699532cf6f1723e9a58e2606383 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2db880166a7489af94bcf373f813af5b |
| SHA1 | 945a24b7809c81fbe3f40e25764369437c37b07d |
| SHA256 | 4a117914999f8a9bfcd3af80724662e0af9858b8a795d8e0ad17a4b52881de46 |
| SHA512 | 5638c6801f0b128848ecf29d072c6b141eafe097288fd53907814a1bed4b551375959f8de3670a833d3342b47f2f4ecccb27e044dd6bf44d6ad9703781c726aa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 15333d12a9d3676c3e0b37798db4d86a |
| SHA1 | 8790a1c245afa7aec7f3bcabd1c2da5f3a360358 |
| SHA256 | 0972e40db051370cc6c36e4e248504997d3b5296ffb09aca3494432ef3e8c4a6 |
| SHA512 | 3956640845e63e98d1c7beabff9778864c98b0f1b13d5b03a1d6ee1a2d730245bb444654333f4cafa43acdb48c9edcbd2a9da7eabec8f9bb0fd55c2016cda1d3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1301c4d185852690f3e500daf7759339 |
| SHA1 | 09bff17e0d8b70c87433d4883e6697c7c70daf9d |
| SHA256 | 2769d55cbf01095ec78df8f33edda0efba35d61947265ec6309692d1631ca2d8 |
| SHA512 | d91e2fd25192a7a9a826e8cf43a4a792ce7f2d095301185409e921a8e5c11b82b203f5fa6115a3052571cda30939ed97ec28e8cb73473e0fca2bfc3f463bcb1d |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 03:37
Reported
2024-06-13 03:40
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
127s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b324c2ed72c24b06a83a67b172dc2b_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa292946f8,0x7ffa29294708,0x7ffa29294718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4176 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | s85.ucoz.net | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| US | 8.8.8.8:53 | naruto-hokage.do.am | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | top-fwz1.mail.ru | udp |
| US | 8.8.8.8:53 | naruto-hokage.do.am | udp |
| US | 8.8.8.8:53 | counter.rambler.ru | udp |
| US | 8.8.8.8:53 | kinocopy.ucoz.com | udp |
| US | 8.8.8.8:53 | www.cy-pr.com | udp |
| US | 8.8.8.8:53 | naruto-great.ru | udp |
| US | 8.8.8.8:53 | naruto-brand.ru | udp |
| US | 8.8.8.8:53 | anibest.ru | udp |
| US | 8.8.8.8:53 | aniday.ucoz.ua | udp |
| US | 8.8.8.8:53 | anicrow.ru | udp |
| US | 8.8.8.8:53 | kakuzu.ucoz.com | udp |
| US | 8.8.8.8:53 | anirai.ru | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | eaa3db555ab5bc0cb364826204aad3f0 |
| SHA1 | a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca |
| SHA256 | ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b |
| SHA512 | e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4 |
\??\pipe\LOCAL\crashpad_924_ZVRLMZKTVHWQTIQX
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4b4f91fa1b362ba5341ecb2836438dea |
| SHA1 | 9561f5aabed742404d455da735259a2c6781fa07 |
| SHA256 | d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c |
| SHA512 | fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 5026d82f137912d6cd3e867e6e91b023 |
| SHA1 | 5de19951c9f10999054047845d5c97550f06f66d |
| SHA256 | f22af93b942a5b911c544f18594d94bc2985a050fc65a7e7aef1a0e85a14159b |
| SHA512 | 3b5fd4e268942ca4962e5719e35a45bcdd03baca190d8f4519bc50a0248cebb7e431068ac6b38cde5fa26a55da3e483e1d45d6d3c3e621164260de8cdb1f083c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | dd73ecab6eb742e54e2cda90ac10e23d |
| SHA1 | 24c1c4b9c5d24a02363c5f5968948e40622692b2 |
| SHA256 | 0ee5e18d784bd9192535fb307e4581605afbccfed4fd9ec3e95ce368f2d7d32d |
| SHA512 | 392b23002aa58abfb15be123f3a6fe20bec320d608f8481b4b62ea33804d26c9f635d2d045baf8b36b43083ec7e2aaacf686a2d7be7c143b6e9c3fdb0164f8a3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | bbb653632d4cfb36b185ac8adad32df8 |
| SHA1 | df70344fd3d95b8cc10df7d74661ede6a8765813 |
| SHA256 | 30d726b5c3fe9719fa169bbace21b982399cc29c41b7de21e01c14ead4dd1dc4 |
| SHA512 | d086e0dec7ea45b74b61561ccbade0516283f3423af7dfcfacc9d9b6d2d62c32f63d6b3043d65ef0a148b8a5dd5132ebde51ace6d6ad94f12ec1f9fc99451a8e |