Malware Analysis Report

2024-10-19 06:59

Sample ID 240620-wspnksvdpj
Target 08866ec866bc6324a21580821f7880c2_JaffaCakes118
SHA256 6524578837a74f96b5d4a259d58299e2763306f040edc189c6386a62199cfe06
Tags
modiloader persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6524578837a74f96b5d4a259d58299e2763306f040edc189c6386a62199cfe06

Threat Level: Known bad

The file 08866ec866bc6324a21580821f7880c2_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader persistence trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 18:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 18:11

Reported

2024-06-20 18:13

Platform

win7-20240508-en

Max time kernel

149s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msmsgs = "C:\\Program Files\\Internet Explorer\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Internet Explorer\icwhelp.dll C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
File created C:\Program Files\Internet Explorer\explorer.exe C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Internet Explorer\explorer.exe C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe"

Network

N/A

Files

memory/1056-0-0x0000000000400000-0x000000000046D000-memory.dmp

memory/1056-1-0x0000000000400000-0x000000000046D000-memory.dmp

memory/1056-2-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1056-14-0x0000000000400000-0x000000000046D000-memory.dmp

memory/1056-15-0x0000000000220000-0x0000000000221000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 18:11

Reported

2024-06-20 18:13

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msmsgs = "C:\\Program Files\\Internet Explorer\\explorer.exe" C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Internet Explorer\icwhelp.dll C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
File created C:\Program Files\Internet Explorer\explorer.exe C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Internet Explorer\explorer.exe C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\08866ec866bc6324a21580821f7880c2_JaffaCakes118.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4648,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 131.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 74.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 211.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp

Files

memory/3144-2-0x0000000000400000-0x000000000046D000-memory.dmp

memory/3144-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

memory/3144-0-0x0000000000400000-0x000000000046D000-memory.dmp

C:\Program Files\Internet Explorer\icwhelp.dll

MD5 c342c3d874ec39a72bca8a0c5a6a0bf6
SHA1 317c4755a3d300ea5e9e4fd85884dc80d6bf45b5
SHA256 8dcf2e0ac2d2a91012aafdba920e1cca7043864b0fa9a8df18251cc72f2f64b0
SHA512 36205e775f4dcd9320550eeb13f5dd4f4e18952bf46c84921a867bd81315f3c4248ce6cc29e62738a226b2a87f570fd99c7ee828e03f9116d11e3b2485540769

memory/3144-14-0x0000000000400000-0x000000000046D000-memory.dmp

memory/3144-15-0x00000000005C0000-0x00000000005C1000-memory.dmp