Analysis Overview
SHA256
3383bb3301b3388fe7f727e7d5c0d7f91295458923cc310ea458a2a99cd56909
Threat Level: Known bad
The file eb2247e90f728d534a39b1ce900f4960_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Socgholish family
SocGholish
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-13 10:43
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-13 10:43
Reported
2024-12-13 10:46
Platform
win7-20240903-en
Max time kernel
143s
Max time network
145s
Command Line
Signatures
SocGholish
Socgholish family
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440248495" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{213ADA31-B93F-11EF-A0C3-D60C98DC526F} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2500 wrote to memory of 2520 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2500 wrote to memory of 2520 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2500 wrote to memory of 2520 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2500 wrote to memory of 2520 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb2247e90f728d534a39b1ce900f4960_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | img1.blogblog.com | udp |
| US | 8.8.8.8:53 | www.contemporist.com | udp |
| US | 8.8.8.8:53 | feeds.feedburner.com | udp |
| US | 8.8.8.8:53 | www.yankodesign.com | udp |
| US | 8.8.8.8:53 | www.tuvie.com | udp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| US | 8.8.8.8:53 | 2leep.com | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | lh4.ggpht.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | img2.blogblog.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | lh4.googleusercontent.com | udp |
| US | 8.8.8.8:53 | feedjit.com | udp |
| US | 8.8.8.8:53 | widget.networkedblogs.com | udp |
| US | 8.8.8.8:53 | t1.extreme-dm.com | udp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| FR | 216.58.214.74:443 | ajax.googleapis.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.214.74:443 | ajax.googleapis.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 142.250.201.170:80 | fonts.googleapis.com | tcp |
| FR | 142.250.201.170:80 | fonts.googleapis.com | tcp |
| FR | 172.217.20.162:80 | pagead2.googlesyndication.com | tcp |
| FR | 172.217.20.162:80 | pagead2.googlesyndication.com | tcp |
| FR | 216.58.214.169:80 | img2.blogblog.com | tcp |
| FR | 216.58.214.169:80 | img2.blogblog.com | tcp |
| FR | 216.58.214.169:80 | img2.blogblog.com | tcp |
| FR | 216.58.214.169:80 | img2.blogblog.com | tcp |
| FR | 216.58.214.169:80 | img2.blogblog.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| US | 104.26.7.118:80 | www.yankodesign.com | tcp |
| US | 104.26.7.118:80 | www.yankodesign.com | tcp |
| US | 172.67.135.47:80 | www.contemporist.com | tcp |
| US | 104.26.7.118:80 | www.yankodesign.com | tcp |
| US | 104.26.7.118:80 | www.yankodesign.com | tcp |
| US | 172.67.135.47:80 | www.contemporist.com | tcp |
| US | 104.26.7.118:80 | www.yankodesign.com | tcp |
| US | 104.26.7.118:80 | www.yankodesign.com | tcp |
| US | 172.67.135.47:80 | www.contemporist.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| US | 172.67.135.47:80 | www.contemporist.com | tcp |
| US | 172.67.135.47:80 | www.contemporist.com | tcp |
| US | 172.67.135.47:80 | www.contemporist.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| FR | 142.250.74.238:80 | feeds.feedburner.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| FR | 142.250.74.238:80 | feeds.feedburner.com | tcp |
| US | 172.67.207.90:80 | www.tuvie.com | tcp |
| US | 172.67.207.90:80 | www.tuvie.com | tcp |
| US | 172.67.207.90:80 | www.tuvie.com | tcp |
| US | 172.67.207.90:80 | www.tuvie.com | tcp |
| US | 172.67.207.90:80 | www.tuvie.com | tcp |
| US | 172.67.207.90:80 | www.tuvie.com | tcp |
| FR | 142.250.179.97:443 | lh3.googleusercontent.com | tcp |
| FR | 142.250.179.97:443 | lh3.googleusercontent.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| US | 18.208.5.78:80 | t1.extreme-dm.com | tcp |
| US | 18.208.5.78:80 | t1.extreme-dm.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 142.250.179.97:443 | lh3.googleusercontent.com | tcp |
| FR | 216.58.214.169:80 | img2.blogblog.com | tcp |
| FR | 216.58.214.169:80 | img2.blogblog.com | tcp |
| FR | 142.250.179.97:443 | lh3.googleusercontent.com | tcp |
| US | 104.21.29.45:80 | 2leep.com | tcp |
| US | 104.21.29.45:80 | 2leep.com | tcp |
| US | 104.26.7.118:443 | www.yankodesign.com | tcp |
| US | 104.26.7.118:443 | www.yankodesign.com | tcp |
| US | 104.26.7.118:443 | www.yankodesign.com | tcp |
| US | 172.67.207.90:443 | www.tuvie.com | tcp |
| US | 172.67.207.90:443 | www.tuvie.com | tcp |
| US | 172.67.207.90:443 | www.tuvie.com | tcp |
| US | 104.26.7.118:443 | www.yankodesign.com | tcp |
| US | 172.67.135.47:443 | www.contemporist.com | tcp |
| US | 172.67.135.47:443 | www.contemporist.com | tcp |
| US | 172.67.207.90:443 | www.tuvie.com | tcp |
| US | 172.67.135.47:443 | www.contemporist.com | tcp |
| US | 172.67.135.47:443 | www.contemporist.com | tcp |
| US | 172.67.135.47:443 | www.contemporist.com | tcp |
| US | 104.26.7.118:443 | www.yankodesign.com | tcp |
| US | 104.26.7.118:443 | www.yankodesign.com | tcp |
| US | 172.67.135.47:443 | www.contemporist.com | tcp |
| US | 172.67.207.90:443 | www.tuvie.com | tcp |
| US | 172.67.207.90:443 | www.tuvie.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| US | 172.67.207.90:443 | www.tuvie.com | tcp |
| US | 172.67.207.90:443 | www.tuvie.com | tcp |
| US | 172.67.135.47:443 | www.contemporist.com | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.97:443 | lh3.googleusercontent.com | tcp |
| US | 8.8.8.8:53 | imp.tradedoubler.com | udp |
| US | 8.8.8.8:53 | lh5.googleusercontent.com | udp |
| US | 8.8.8.8:53 | lh6.googleusercontent.com | udp |
| FR | 142.250.179.97:443 | lh6.googleusercontent.com | tcp |
| FR | 142.250.179.97:443 | lh6.googleusercontent.com | tcp |
| FR | 142.250.179.97:443 | lh6.googleusercontent.com | tcp |
| DE | 18.185.13.67:80 | imp.tradedoubler.com | tcp |
| DE | 18.185.13.67:80 | imp.tradedoubler.com | tcp |
| FR | 142.250.179.97:443 | lh6.googleusercontent.com | tcp |
| FR | 142.250.179.97:443 | lh6.googleusercontent.com | tcp |
| FR | 142.250.179.97:443 | lh6.googleusercontent.com | tcp |
| FR | 142.250.179.97:443 | lh6.googleusercontent.com | tcp |
| FR | 172.217.20.163:80 | fonts.gstatic.com | tcp |
| FR | 172.217.20.163:80 | fonts.gstatic.com | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 104.86.110.66:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 184.25.193.234:80 | www.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\sne-stand-for-ipad-by-bryce-johnson6[1].htm
| MD5 | 0104c301c5e02bd6148b8703d19b3a73 |
| SHA1 | 7436e0b4b1f8c222c38069890b75fa2baf9ca620 |
| SHA256 | 446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f |
| SHA512 | 84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | cefa7b5d09fccea951997010b4a2c482 |
| SHA1 | 95b87c94985640d0b166cfb46a34ac6e9d493681 |
| SHA256 | 122d2c79a9c2e24b2456b79e4696481cc165a2fd086c98085e7648bf6c85fa13 |
| SHA512 | b64acd8adf4d9b6d0850e66dff532fe1c4613a50007e11542d27a96b71adfdcc0892dddf7e710ecba14beba092d165a46a1290009ced977c95dee450ea1b6488 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | b08b3f48ce49fbdf52a9b3251155f967 |
| SHA1 | 6e3d5e840ffb4a5b89aba3f4e311d368a8062e61 |
| SHA256 | 4a7630a71d7ae873f5af598afdcde694b1fed764b7ffdb78b90de68bcc8da173 |
| SHA512 | 57eb36cfeca12f6cc4c0bba6ebdf5601909e2686d2f5ebda747792feebb6b4177d2201eef6bcce57231253c42517cf9dd501846f142c2d3a572118f49b35c14e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
| MD5 | 67e486b2f148a3fca863728242b6273e |
| SHA1 | 452a84c183d7ea5b7c015b597e94af8eef66d44a |
| SHA256 | facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb |
| SHA512 | d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
| MD5 | b62b70fc7f8a85d9d88e5eae9a5b9397 |
| SHA1 | df297f0a656c47f6b58b64c9bb17165f2507e3e2 |
| SHA256 | 81b7bfdc0023895bb9ac9eaac8b4e616734c4d58a52eb776ad3adb755115186a |
| SHA512 | f6331dca0171936f7676474a246feece988b26f175a353edc856065b2813166c1aa37c9164ccffa800eaaf3b8e10bffba64bab6ba4bca12c7139dd6e5c9504e5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
| MD5 | e4199e5b9062588cc119aef31b921f41 |
| SHA1 | 6a83b94df855e0d851bbac5a77489e4d94037d60 |
| SHA256 | 1cbd09cb986d702f30351b336ac5d680a01672e6cbdef5b4cff14a22a5a4516c |
| SHA512 | 315280fb13ee4796487eecd3de46b441f60b915b069611a6ada5c462213dfee0728e83316fac353778668118c41ddc222e553cd65c7418b4da6da72ea2f0f78b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
| MD5 | c8c671b825dd679abce7b2655e57542b |
| SHA1 | d16b1e395549516d5363f9dfdb188a13d91e6c9d |
| SHA256 | 92b2cf016c1a08a9d31b3b8bd762b35e3b1d50b0426c34326ec116991a34fef2 |
| SHA512 | 7580157538ea3a695a13a1fb840fe84a0e38ed2ec2dc1648f0fc5f3209ab8308777dac3a1d3a39e3c3072ba054c51b78d02f8beebe774f71d8ad6843cfb63767 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
| MD5 | 633d7aa6179e4039a01be394daa9dad8 |
| SHA1 | 071cf78ef515651f5231814e8e04e2b91ef3b072 |
| SHA256 | d227c0bf7f03f7128d0ebdf5dc4b43ed228586592dfdbe983ebbcd8a2354c77d |
| SHA512 | d364218b47957ebeafd53a082979c37882d2473b498fa1cdf93ad6a53cb570c4e6211e649f908458ff00794cf20f5b1a9e3dfdf1d6d3ebc804f15e4d6ad9a03f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
| MD5 | e5c6bb3b4c127fc31a7a30550d211940 |
| SHA1 | c248917f6c1725a1ee0e40ddf1e636a8cf328aa9 |
| SHA256 | e4a99c6b3dc910952ccbdf8630a528da63caedb2e20e791e2d1c4ecd9f11b9e1 |
| SHA512 | ec6c32e5221d21c5bcba07860588a2826ed53bcc1f71ff2b1db685aa3efec2e3331fd75e61033cd387ec803833a85e2dcda2f3d26b75a421a88a679a2f38ab47 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
| MD5 | e935bc5762068caf3e24a2683b1b8a88 |
| SHA1 | 82b70eb774c0756837fe8d7acbfeec05ecbf5463 |
| SHA256 | a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d |
| SHA512 | bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e |
C:\Users\Admin\AppData\Local\Temp\CabC361.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
| MD5 | 971c514f84bba0785f80aa1c23edfd79 |
| SHA1 | 732acea710a87530c6b08ecdf32a110d254a54c8 |
| SHA256 | f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895 |
| SHA512 | 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
| MD5 | d95579e14c2f47bfad537a924816b008 |
| SHA1 | e5b025f609db1cd4f04a176a115c3a7973c3ba54 |
| SHA256 | 4081a58a14ac351d5850b1eba304f8968172a3a9bad882642cb16a68665186fb |
| SHA512 | ff8fe3d25d96da97fea32b396db86dab4fbd93b7c738141a8714b74b9e1fa508e5fc9a34d4e57a31d95b867e8a24fda8a19bbacaf4dec0cc81983cbbcf3d7e68 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
| MD5 | ac578b96183fbdaeed962d9637d70faa |
| SHA1 | 39a4aad0806eac655ca073c27dcda18e2fd2498b |
| SHA256 | 5e7150976a2451bc3f940e96fdba7c1a38c85f0ed2b812714c0cbd26afb7a1e1 |
| SHA512 | fc738305e7bedeebbeb4336f8ed6011bb3205c5bee325f0cfb983fee896beba83598cb4c46088b08ffd12ce7c202e735b3bc43d8d7b50e856881ce3eee3cc0d5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
| MD5 | 4853d30595021c2f8892cff70f1e0a35 |
| SHA1 | 189831336f79f4dacc1fedf462e3acdd55197056 |
| SHA256 | 866f662b0d740332fef41e413d95e8ec4d3f0d36bbc79f286efe58f02e6900ff |
| SHA512 | a7c01576f77bc70500182ec0cc3def320323318cd2176d0d08f936ccdf09c3f9ac25e01e440cb36e42faf978f3a11f95c8787d0bedcd8355483834d116fd40e9 |
C:\Users\Admin\AppData\Local\Temp\TarB607.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 766d1007e7bfd0a2192895ab1c9fd7f7 |
| SHA1 | 18bdb04432cab15860a703d3e4192d1c137e5c48 |
| SHA256 | d5c859afb22662d7b6d792f6aa1044862e167f8059460c801cfc70cc803e9ec7 |
| SHA512 | bead8abbe65bca33209445478dfc5e54c639f3a231561600d1acecbf30bfd491ac4d52452f151bd9559102efd9112bcf516701bf58a657029dae2d61d6775246 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 00dd787ef26567d7b688cc52f6a9404e |
| SHA1 | 79f6d3eb12ae912a2a469014d4c424e691974a1e |
| SHA256 | f6491c338a3efcd70e25dfdc04c91a3a3479307fd947265bbba311a698d985e3 |
| SHA512 | 4eca3f30f7cb1485536529d51ef8b40c304a8357e984c32452b09863302e8399dab947613458361d37bc42a79f10bfe871c002ec9d618f9d44f83c1fcf448150 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2e5a85e8791c2210df74cd337a3e151c |
| SHA1 | 7701f4eebd6051a734f978634e332a77a546bbf9 |
| SHA256 | 39fddd94a8d9636840e6a82cedd6aadc583a54dab4866615165e899fa275f80a |
| SHA512 | 6ad71b420ad744a752f54735d36b9bec3f0174d31d8474f8b36edc8dbcf466ad5b6ff553a258e5225b4b9b272bcf73b650f99452496e9b02d8b073d5a10a1865 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b1a91bb92f2087c010e0abc6d8a7d3ba |
| SHA1 | 9553d80352415606585b68c3d42b39401644cbf8 |
| SHA256 | 16916da5ff97d0be7ee0e6553c1a2663949c739a003eee914109ee8b7bb0a288 |
| SHA512 | 31f6dda562d2a8a0c4c3cac9cd4962b8161fb459bec696001739e586a81a3672490f54610141aae870de4d8e304c7174241d49badc9c05d31eefe0e2b46df098 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7e9526e691cf8b5042441fd66bb06a7c |
| SHA1 | 77b056082dfad50f3239b1c5320256bb9ca92361 |
| SHA256 | 8ec4c27eeb2f1eb795af9bbae6be19dfb32d170f756b08c57f213ca512056870 |
| SHA512 | f14130089013fb5715613b6b5a3121dae7d8923dbde41ef686ee804b327296e286bd167dc49832cf68327628877e4875f53fc997bc3743cbf7b643dbdf10e407 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e4171454c416c3768f4ec6da7730e697 |
| SHA1 | cb42bdc6d560c2484eba77dad8bbee925a84bcfd |
| SHA256 | 4945fd578322642bc84c0daba1e8c8a49131660f51bedd02475ed8d89cb1be33 |
| SHA512 | 21d135b92e3b1a978d2b8240ce520a63366d2ad12efd96db23a0c7a9060c035936a7ae8b14b684751cf7a9404c9b5af075ce8ec67ab685c47cfc5ad6bd01320a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 04eb16443865ba6c0405cd5735984763 |
| SHA1 | 3539990554b502d0d00df4b5a21d021067339c75 |
| SHA256 | a1bdadb860133514fa2318799a1ea0fa18cd595c1ea57b1f70bf7d48f11d1b26 |
| SHA512 | b15b3f42d4994ac57ecd89fe6fafaec1b3ee1575738c5f8aff7805d3cafc1af104c9f1bf8a7ea467bccceb24140a383d0e62865b5e595a5c90d87eea55e24f3e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 651198d160e98848adf57fdf0aecd3f6 |
| SHA1 | 8243035b138fae271bc0f217409021ee79956e22 |
| SHA256 | 058cda80b552dd98e80ebcbba93e0ce284c7a2646f864d13f8a3135e44a2d94a |
| SHA512 | 843499408a4731c30cdbdede187208ed1b9438007bf4fdd757a487741efe314864d9c965034ee08e2efc9c2f0ef1d042c769e0c68bcd0d6aaaad3baf42221431 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 9dc4ed52cee8402d717dad713664a0ca |
| SHA1 | 1782d4f7b87496cf58bf8bf877e67ed8eb0cbab4 |
| SHA256 | f1fc697dfcac1aa5efdc6cf347220a2b8f8becca7063fb23c1279d5dd04b6c96 |
| SHA512 | ff8b22f4c175d75d3fe5c85851668e0cfe73c555fc23718e0cd599f5069a448644269a0df33766feb14dbc11b19bb886223c69620c012e794d697df0708ce0b0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c1e4f072d657faa222e9ae62989b1d5e |
| SHA1 | 0ebe552447c6645e7f028b2c097364203f85b4c5 |
| SHA256 | c91881df91d906adb3d035be258b6f219c14c053931db03797d84ca2b73976bc |
| SHA512 | d19655a2deffec63d0e25c4bf07ca1dde48886da6debf9aa190b02d01b08424d147e17572dd39ef726f47f5c27a0219c7b310e7301e3fce8651886bf70f44a5d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6607791dd3e245eacc98700a94105309 |
| SHA1 | 6a32cf8b10917d2a8745ab88b9a04369d61c497b |
| SHA256 | edc0548cb9b354895464b3086575cb6887b663d7d976599cd754083a51790dd5 |
| SHA512 | 38b7b8058f99de09bf5463bbd848b2ca92284dd7bfdc20a90e8c52a0757efa4d22effaa00cb581de1689844d163f576417b3a0ca2afa07ce44ddb2f56b447879 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | be6bfce65c24f94b16e6fad7f4272c92 |
| SHA1 | 449c0de0ef068a2e3ff03238f0145a9fa93a0050 |
| SHA256 | 53aef32363013c23ac1670ed2687c695d659f1441b0d1c8dbdf5212c93112748 |
| SHA512 | 28ab48c4e88a29f6c2233cc41fee29b76fe14da34519570c3232ac5aac2a613d9d36d5e33dc64a0953a9badf46879621fc4441e052e46a002c258397d9f8e722 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-13 10:43
Reported
2024-12-13 10:46
Platform
win10v2004-20241007-en
Max time kernel
145s
Max time network
150s
Command Line
Signatures
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\eb2247e90f728d534a39b1ce900f4960_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff998cb46f8,0x7ff998cb4708,0x7ff998cb4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13731396472519099655,3051552343315775705,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,13731396472519099655,3051552343315775705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,13731396472519099655,3051552343315775705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13731396472519099655,3051552343315775705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13731396472519099655,3051552343315775705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13731396472519099655,3051552343315775705,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2704 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| FR | 172.217.20.202:443 | ajax.googleapis.com | tcp |
| FR | 142.250.201.170:80 | fonts.googleapis.com | tcp |
| FR | 216.58.214.169:445 | www.blogger.com | tcp |
| FR | 172.217.20.163:80 | fonts.gstatic.com | tcp |
| FR | 216.58.214.66:80 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | 2leep.com | udp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 170.201.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 163.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.214.58.216.in-addr.arpa | udp |
| US | 104.21.29.45:80 | 2leep.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | feedjit.com | udp |
| US | 8.8.8.8:53 | 202.110.86.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.29.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.179.139.118.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | widget.networkedblogs.com | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | img1.blogblog.com | udp |
| FR | 216.58.214.169:80 | img1.blogblog.com | tcp |
| US | 8.8.8.8:53 | www.contemporist.com | udp |
| US | 104.21.6.189:80 | www.contemporist.com | tcp |
| US | 8.8.8.8:53 | 33.215.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.214.58.216.in-addr.arpa | udp |
| US | 104.21.6.189:443 | www.contemporist.com | tcp |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | feeds.feedburner.com | udp |
| US | 8.8.8.8:53 | 189.6.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| FR | 142.250.74.238:80 | feeds.feedburner.com | tcp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | www.yankodesign.com | udp |
| US | 104.26.7.118:80 | www.yankodesign.com | tcp |
| US | 104.26.7.118:443 | www.yankodesign.com | tcp |
| US | 8.8.8.8:53 | 118.7.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 238.74.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.tuvie.com | udp |
| US | 172.67.207.90:80 | www.tuvie.com | tcp |
| US | 172.67.207.90:443 | www.tuvie.com | tcp |
| US | 8.8.8.8:53 | 90.207.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| FR | 216.58.215.33:80 | 1.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | lh4.ggpht.com | udp |
| FR | 216.58.215.33:80 | lh4.ggpht.com | tcp |
| US | 8.8.8.8:53 | img2.blogblog.com | udp |
| FR | 216.58.214.169:80 | img2.blogblog.com | tcp |
| US | 8.8.8.8:53 | lh4.googleusercontent.com | udp |
| FR | 142.250.179.97:443 | lh4.googleusercontent.com | tcp |
| US | 8.8.8.8:53 | t1.extreme-dm.com | udp |
| US | 18.208.5.78:80 | t1.extreme-dm.com | tcp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| FR | 142.250.179.97:443 | lh3.googleusercontent.com | udp |
| US | 8.8.8.8:53 | 97.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.5.208.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | lh5.googleusercontent.com | udp |
| US | 8.8.8.8:53 | imp.tradedoubler.com | udp |
| US | 8.8.8.8:53 | lh6.googleusercontent.com | udp |
| DE | 18.185.13.67:80 | imp.tradedoubler.com | tcp |
| US | 8.8.8.8:53 | googleads.g.doubleclick.net | udp |
| FR | 142.250.179.66:443 | googleads.g.doubleclick.net | tcp |
| DE | 18.185.13.67:443 | imp.tradedoubler.com | tcp |
| US | 8.8.8.8:53 | 67.13.185.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 122.115.224.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 34d2c4f40f47672ecdf6f66fea242f4a |
| SHA1 | 4bcad62542aeb44cae38a907d8b5a8604115ada2 |
| SHA256 | b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33 |
| SHA512 | 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6 |
\??\pipe\LOCAL\crashpad_3736_SBLSQXWBFIFNANKW
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 8749e21d9d0a17dac32d5aa2027f7a75 |
| SHA1 | a5d555f8b035c7938a4a864e89218c0402ab7cde |
| SHA256 | 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304 |
| SHA512 | c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 6520151e07ec7521bbd47d80e12d590a |
| SHA1 | 65f811f8effb468a09bd842d5db29267be5f293b |
| SHA256 | df9df345b4749d169ee3f5524e87f05329cf256544f7cdf292cafd6f1b9dc903 |
| SHA512 | 4bed0bd2817d71de8a9180da0291be2bc017bd9f433707756f193405d3ea184d6e32b8167b99d505cdc0387660a67adfe173e53a85e8035c75bdbca522ff653f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | b9dfe17dc1758b365ec855c01bccfe09 |
| SHA1 | fa2c10281d60462c7d4a05866bccd23147185cbd |
| SHA256 | bdd1c199e6be81ceff1a952cd82e12ce638f835e7ad7cfda8cb8fdd29a3c2e86 |
| SHA512 | b627a39c2de71991639103dd85340bb3e43be4b7171957e024284d43bb591e39033f063faa6edadf6f3b95409dba6caa61d3577a2703577de34a3b42a27d2711 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2f57efb10eec447e6068d18335c156ec |
| SHA1 | e6144694abcaca5fe1fe79de3c534e7c72f935a8 |
| SHA256 | 8845adad60c78fddfc3a3c9c9c8ba6c8d20a0eb13141962e24e7984a9ff1552c |
| SHA512 | 27a51d55d8888eeb1fadc7591557f2927abf58a6e46683d929996fe9701e514aedfeb748ade08e77e4f55cd036594bc2f84dff8d02e1be7ad06006e6ab6d33ea |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 2aa092dfa91388d2111d12163c9fccfb |
| SHA1 | 0ee0170ec40c411b9e06bf70d85a50d16cdaa899 |
| SHA256 | ce6871c684bc626c3b456228d7ad793ae88dc90cdda9ab03614e0d16526019f6 |
| SHA512 | 1777034ea5d0ab70bb84d5f83a1cb6ab1ee3ba56c48f22356acce1a1b1793d49f3a8eccf41e922ed6d376f40beafdae56355f9db2b505fc1c63d46837d851e95 |