Malware Analysis Report

2024-10-23 17:24

Sample ID 240510-egvxsahe21
Target 2d35830de7bda9575f0d0f8fe4299ffd_JaffaCakes118
SHA256 0cc807e86bf32d925b8acfb41733c7a7fb454a7e9c8b755c89876c357c1dca6b
Tags
socgholish downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0cc807e86bf32d925b8acfb41733c7a7fb454a7e9c8b755c89876c357c1dca6b

Threat Level: Known bad

The file 2d35830de7bda9575f0d0f8fe4299ffd_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish downloader

SocGholish

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 03:55

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 03:55

Reported

2024-05-10 03:57

Platform

win7-20240221-en

Max time kernel

138s

Max time network

143s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d35830de7bda9575f0d0f8fe4299ffd_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B43B981-0E81-11EF-86DB-FA8378BF1C4A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207e25f38da2da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421475182" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000098a1bf0c5345f5d64f2c06594216f447ccd6cd42d9acc36867e5f139e888ce83000000000e800000000200002000000061cd48e0d5531ccbbf5ab6bd09647cd7c68e515fdd7aad5507541da00a7b375290000000637cd821ec420dbf7b0fad3041544aa8b3d89b1744790129ffaed5d9533e173659c9d99562517172d712cfff3dc9981ac3742fc0ffc7e1a8aefc5795f8b380173351b4caa7271e0e4a4f92cce795aa0e204efd9bf49165eea169862c447b315a3f161c1178efd65f897844f891838e04abd358b013ab8995232a32e09ef153ec576cff0e637d26f4b87f2aeca20f61c2400000000709e9e2ccad0d0644e93155840f538e4bfd15f423df9353a08c3ffaf09698abfa098e0eafdb9d844ace424c621d75dd5ef9605a1b6bd7dc3c413962665084d6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000008c5368510fd401e21f1bd0d66c16a066435a4b16699374575b0df34fe41af52b000000000e8000000002000020000000f44dd664572909c8354cb91a2a4731addcf56fc5602d93a65e6419f7cec24e7b200000007d324d56d558720f09e385168a141588e15cae12333aaf285754499a746af0c24000000030ffdc17215205410f2cb66a4fec6afd7ec3cdc5800916810802e3316030c98f8ce225bffc939dfe2ec638226a961a05b00ed47000fecd5edce6b301567ea55b C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d35830de7bda9575f0d0f8fe4299ffd_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.200.9:443 www.blogger.com tcp
GB 142.250.200.9:443 www.blogger.com tcp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 216.58.201.110:443 apis.google.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 142.250.178.1:80 4.bp.blogspot.com tcp
GB 142.250.178.1:80 4.bp.blogspot.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.178.1:80 4.bp.blogspot.com tcp
GB 142.250.178.1:80 4.bp.blogspot.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.178.1:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 www.tiempo.com udp
PL 93.184.220.66:443 platform.twitter.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 104.16.246.103:80 www.tiempo.com tcp
US 104.16.246.103:80 www.tiempo.com tcp
GB 142.250.178.1:80 2.bp.blogspot.com tcp
GB 142.250.178.1:80 2.bp.blogspot.com tcp
US 104.16.246.103:443 www.tiempo.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 feedjit.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 104.16.246.103:443 www.tiempo.com tcp
US 104.16.246.103:443 www.tiempo.com tcp
US 104.16.246.103:443 www.tiempo.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e93c7e73478f89e7b5a8f687309e4bb5
SHA1 e5b6d700a5fb5038c0b7349e52a3ed7cd4ec828b
SHA256 de406075733e4392bd640cf86a211cacd67cad5fd7b53804d28f65fe5945d9fc
SHA512 2f89b31b995e0672c2fee35f9f0c95071a9f2ffa372d21e77cfcf68609db9d9e9abf51c8bc31a1f9e621d34f20335eea9bcc4cadafd497d0e81ac15c732e196d

C:\Users\Admin\AppData\Local\Temp\Tar1C8B.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\Cab1C88.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8327510755e5c9a3c9b229346a693247
SHA1 7f4fb423b15dca3b7e50d2d101cdf24e95cc9fcd
SHA256 bfc62cd7997ab17bfc894b53c87dffdeaecd36171f91b08273461317968c60ed
SHA512 3dc84fb065b1fd2198ad4fbf2122f5045db04a12f3de1bab5eb2b0941349196676ae21ef17efbda64a0011f404667af9dc6fa27293eec1d09157d04d612287ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20d748e92d61555b6ae29f57331df0c0
SHA1 c9dcd6701febf8b919653bc0d89419ebe6e60357
SHA256 64bf5bf722e377a35ce362c6e4bb811574ce028a82925605ce8bad06d7725246
SHA512 a8bfbc2c5f8ddf09464d8a469fd874d49177d2caab2b6c0627c79d92d85d8fa4979adbbbebbfa936c71fe662217983a28fa1be9f845291e34aa67649e38f6e95

C:\Users\Admin\AppData\Local\Temp\Tar1D8B.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25dec20de33591cddfbb09399acb0dac
SHA1 de8fcafd001933c9dff8bea2602d27c19044149a
SHA256 5ba2e2ecfbb98f4a48aba633224a92f30d2a2beb963eadf7db532ed11aad31c4
SHA512 147d90b93f61a82f76249baabb3a557c8ec04b359c231b42641e45b7fbf9970de7e46a35aae7318a5c209dbfe98d6f4211654bce94f2d2912c9b539377e43247

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f8d672200b7e4c381d91887b9ea35fc
SHA1 093f53694148b89b3f04c9b6936f0bd14ad5a937
SHA256 5fb5a40ffc93ff6e72f6f7161bb1a3d3fd792bc468e34d31866642a0dd33de71
SHA512 c485c7f46351cfe3b17a7e7809430d31e59b7e52430c606eed6e08c789281e82599f6f56552963aa3bc133b4221e33d7c946d458ecb3a045bfe4a9c3389a6187

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 41f4a27098b1265785ecd91ec942e5c1
SHA1 15665e7e8c8a1ba7d229250a895ee0efb29c8154
SHA256 3027927ca833066c67db52d330236735eca052b61dc36b93ce4791986f0dfdc4
SHA512 64f3065e0c627a75bcb76cd582aeaed949deef29a3a670fb6a412899113cd26f980a20f8fc3df01ef5c96abc9b1b1efb41fa20f5adb0214a7e513acd9e7ee6d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5078010da8638b3c3bbde59a6d679706
SHA1 ece9a9f309a1f4a3d109aa32ef0381eafd6b3c45
SHA256 94fe5634a4547cd63c2c6204cbb97d337d184133020170e637f3cea1bf231db8
SHA512 dc8c04f853b85b1def291fe6fff1cfac939e73965a2a53a6fcd0baa6a39192b80b701ff0c6f82944b6aa70b87616c544691d9a8493259fd354d2bbef4416e4d7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 614a2efcd8e1f948615a7864d27fa8fe
SHA1 a6c9d46cfa7cbdf64e487b427dd8b8294f8aedba
SHA256 6afa465a9b571b9f59ba2f415f81a1ebbfdce6a126095a0d435de7cf5e47cb64
SHA512 133f62675f9d9a62c6c0df30f2cb012f1b5da99bd9231ee92422f3f5c6b53932ae24bb9768485a08d99629cac1de47010bc190db2f13e3fe19c3768b637f02a2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5092dc0ac536de01a1ac005469c42c45
SHA1 85d08f8ee42e775b603a28039bb96a44f4dd488d
SHA256 22f035389967bfc4cb152fdea59b3e661b4afc7a5f3f1c5d71f54bd9924318ef
SHA512 8e182ca57b3b6e732ff8daa2fef999ee13d3cae41ed3fd572f7db84ffb502d0e8bd5de602e653d28cf8bf56c0e54aa9ea9da8a0c73631e8eadd01d1708fd0592

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 24f5d6283233d9272df72612edc6facd
SHA1 3d4e0cc35c477ad935e077bd8cf0440083407bfc
SHA256 91834ada04662f76089451836b7d4828b2c108881c9b8338184b65bd8d68d39a
SHA512 c8720bbfd757ba9a4adc53e6acb4833faf10565f141880b985164dbe83fb4670b5372ec0000050620a065ff8d81eedd69885a90ff7d218767a708e8f838bd114

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\plusone[1].js

MD5 fb86282646c76d835cd2e6c49b8625f7
SHA1 d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0
SHA256 638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109
SHA512 07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\d958c2443827afb4c3324ad23ced6026[1].js

MD5 f21102888ad11a3fb4344e24184a3f7e
SHA1 f5900eb3e60c2f9e8563b8a1edd70c83954bd287
SHA256 c78352b668e538cc0616e2b6d33718e548c18627d777e20512cd5df20d07c644
SHA512 3aebe96d1924292fe46aedfc7dfdff5933784dfac61a5a077a08ca3a2a3ee99a9bd827285c1b5538cef29bd69c92429841e8ea60997a3467145970cdfbbd8026

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719

MD5 19ca5564b7f25504f8716568b6596e8c
SHA1 fe9aa574c308bcef5f0aac1ca72ae63736b8fb04
SHA256 1c5ce987ed4149688f3e9ac2e1be2aa9c57c355d6aa02bc63c793d609a3efb59
SHA512 55793f8195ce4e59248f59bd5a36f2163478b7d9c1b84d7fb0a4b3aa5c729b2dffbffbe1cd86f4b16a47a9f5d4492cdf2185c58bad3194ca74c926e9558a6976

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719

MD5 aca766d74edfe97d7f1548580c1bb3f7
SHA1 2f51242d5ebeb4a1a48932be1aa3444fdecb0326
SHA256 a8bd81b15e146fab0b71c81a26e5f338d62d9045e3eb0ecae4351a656b183448
SHA512 3f8df8215bd16db5c8d2d9df6e11b3f8b8fcabe3de52b8b5e3ba0f41ff7b6ca34b34e5fc1f40dcac7eb3e588c288330310bb73444a67bbcb846df6640ad630c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719

MD5 08b42de8e5fe706ca8f5159cf7f38b76
SHA1 33c2bbdbf57a54ebcc6a17da1419d661c46899f1
SHA256 c18980e956391123486c0cb4398901884bb4d3258b9b9b6b3f14c2c224bbd65c
SHA512 1f7e9fa94c503036b895a2ab9029af9c798c89826ea2e5d3e12c4a8c01c1c773c1237dcf6515249224a13fd71581e2ebbf69381f121e8b7dcfbbb61a7618d772

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f14169dddf7cf788988ca04a64a19ebf
SHA1 1c452e361f86fb19782adad97b39a526c4331069
SHA256 3694b75abeca9f1ba9573c73e8eae0457f40f6794681b13b91ed200b462f63fa
SHA512 1d42fd6dcedd2a60c7738936e8d63d60e9d17abf54fdd9cea8c57e178d7e0f0a1f08dd50d0ea55819e0376074d010650d512022eca5257520d48955ba70123d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a98be2b334129457edf66cf4010ac511
SHA1 3304a9fbc733596bfb7825f30902fc1d38c79334
SHA256 06794e0661b0d7fa3a0d95657cc29b0b43783dae7997a1a6da852e0db384a1a2
SHA512 ddcb7db441a8d8e9f1a716896ff96fbc182f0cad72ba93f30864151e505b06d32fcc5ca376ba9f772ea18b2cb812c489338a81c859b29811b6f98d1912f9b359

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96c5ad17fd726d3deb41ee2506e39ebe
SHA1 28cfbcd28aed64a1bd131acac1330975b39bd59a
SHA256 9d9a17c0807696fade250326b29d673dce49918e0bad409b222e8f8df77414a4
SHA512 453207670ffe98de2752ecb0136d6e09e7f8e96884b990bb7e7100e49c33efb5fb83bd6b6e96a157eec3a3df42ee02ec9832050ba9adbdf89c1dc9116e415a34

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d60f202a1ee7c61cd3aba25032553197
SHA1 729970166a38d23f743eda004d67b9242ed2046f
SHA256 dff674ffc80670578895719f420fa099eabd13162ed0a01f1c05f176135a6f1b
SHA512 0110cc5b174ffc8e92b66e997cebe91bf1c68e4415f8358153d7c20fdf84259d7c143a7284e3f4c3e4f4be4a7549df2810fa5371df2e2d36e2d964692a07090b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e72438d84dfdf275b0441761158c4ee
SHA1 290d5a663d300d5868263f04d08dc47cd19e9af5
SHA256 aaa8f5ef15f39fde2670169c8a665ddeef6acb2374128fa47278ed0b7673701b
SHA512 930baf8da8591558a9509b83a836ab633ed257d7fd5051f23bed10d712766d12c42152ef731f62aedbd758b32f5c67a18145ab067530fefe48bc467015d8f64b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52cd4d8e7ba6edebfd0218135fec2ddd
SHA1 9c395bab04bf5e34eead0339dd4ca1876f4143f2
SHA256 697d5087d0fd1ea0da17aa339b127405de12a7a78d8826b3a5427cf5780197db
SHA512 aba719cc0868829dd9afef28f09d777b216a213243d9bd44937a2b71ee02683c3f3dd2d718e81d1e1a79cee0c495e7bc92518b62cdd8ca884bdfaf12b8744815

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 72ec485259df1d1d198cf5d627549086
SHA1 c52b860dcaf5f354df06b235037dd32f5e7e05f5
SHA256 bab79c8aeba1935267c33b483d13d353d8e337498584ea84f8fe1515de471305
SHA512 ef1be93cab799fe313035a980326e06155916e5939c438cbf82c8c6cbda07bd9798437f1e52b2985ed9fa82ba33ad909aca836c757e09020e8491186481198dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 14763d2161e1327523b6c43462279dd1
SHA1 197aab154d6211e054e0c26125e0ed95403fa1a8
SHA256 1e06dcd713478ec3eb8cbcedca804e6a9adf3dce5931fa90ae8b4165f8e72e03
SHA512 b514da99f4109e755cdba02e1f0ec6abfd2f4efd95bd68240438fb954a9775ee1337f8d9a07f871a9716dc2418c525d52a9f47e035a4acd55a80701f9b3aadfc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 419232840ffa4bee8da9c67688619216
SHA1 8a213a6382953997748c5e144e3b4e0c02493cd6
SHA256 736e2073f30feeb092fb81faf88cd649409353619fde658cdd91d6110e708ada
SHA512 3166a8326c1d98945fee7652db74f3646550a1eb0631573289e56d2531a61df6ff648462e61cff91d4f5ac60305c590689908c22b20e7efcf512e05f609724ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 caf3f27d6210630003039a729c31f97a
SHA1 e3639d8792ca7468f32c904af8ea453f55b95b17
SHA256 ba27bd0a733721bc15d1e2bd1a054940e6f3e9d34145739074868906e109386e
SHA512 810000611ca1fc64041de24d9bc3c63bd72997d2705b540d83091ea3f6626cb7b52e96d0dea0e82ba98b457fcb86483e5444588b32b54a9e843cfd5b919d3190

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 197bd3ff18c2fd32c9a144b69978f823
SHA1 0a211cd5177bd98b8d0c425e05c407ed66bcfe57
SHA256 7ada5d428bc9676e2c7531bf2d89ce3d59ce603670e46aa6108bd932d5b11ccd
SHA512 c66de171bea6e247b771085b68c774dd80615946685a460d55cd741fc0ff87d966bbfbe2634d8b0c1c6cc8c624e143534a7a7548a06bf72bbe25ec1b9cbad588

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b717e83dc5100fdfb70c03a10441456
SHA1 601b1060937b3762dfcbe45c2c0a9ba9659bc938
SHA256 8e34f9b229cc7419a67d3254287adeb64a42832483b95da2ad492dafc90a18a7
SHA512 decb0a832d968d0c7678cbef7beefa4e28389e64a9c86990416706db9d7230a1eb80df7026ddee11d35938a103f117dbfceb65a378fdee0c58b590257cb03943

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 7f5b64d8487c3f2a7b88edf16384276b
SHA1 d830f3ca6851601f43033272e2cfecc255059595
SHA256 dca8fbebbc02fed5af5d7c0a60c3c06e007873e6e3512540863f04ec0f84cf0d
SHA512 b9e1f81d9724373aa8f8729b055aa0ea5c388f1ef8005a0aba14713f048450298cf4d5827c0e481704a2289e40e4141bc10581f70f116f85987273a019d22335

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f9eaedc53d79f3fcf0bf82e965a7136c
SHA1 173d0f356b1c29004bdf4b85c78eb3361175f495
SHA256 c3faa645d1c4d55207f25a71974ef45f5002a0ef8c81f2f53dc64b42c60e6caf
SHA512 bc724892c7ba0a770869be2620f96054452f8682eaa0308eb504e725d6ad07086017e928c8748ebc7fdf4907a1d58421d2409caeb963f7d5c2fc8f428b40e5e6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6f435345cd8abe4db10a8962107f8ab
SHA1 5cf85b8bdcd16820052629ab4b70df27f0d9fb9e
SHA256 e6817d0c5380abef0beb7328496dbee9124639a1a3ac33d87c3318dc01cca903
SHA512 758851c6a979fce692269356d878039206fe685378b491dc3c6b824469385529e852e9eb99e354ecfa9b2ae85256b37088289a456af74528b023f9db5064e648

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 434d07170b2592c5e84703376789c1fa
SHA1 d5fd1c9c831c2f41948928a3d59d48e776bd9329
SHA256 3620353860816eb1a52526ce43b7780532b004b53174631c4c52f7bffd4bd447
SHA512 b865542e8d8b3820a6e12fbbe2b2d8e33b1ba5972ff01b55979cbe6d84ea81d2c6696d58acdec9be88941b733666de6b10e86d1134ba82dedc90648a5e07661f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1a9d4f518ed78dd904a5ca84efae842e
SHA1 22ced4eb488cff2d96d4006af7fb279c5827f602
SHA256 4a0849c55d69f6f7df039abc4f421ec2b99ad1ec5b1948bc196eeda911503821
SHA512 27946a9b638ae853dd80c92e0b44ea6a7d31a03118565016d011518922be1059f0177a139d0548a5ee4c53980c003340fa0f6649a808880995a56ca67409983e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ba0cd13885bd82c3af6064eeb766a1d1
SHA1 15895761216b907585856cf3396ca329ca343f66
SHA256 8570c9898963b114056da108d4508e146c70805f3d3ce8b1ee1c13db6e4d536c
SHA512 1342c8e8168a770ceddb7d944ebd0b3579c4a9635557e1daa9ec64d0579c5a732f9eb06928689e7a5bf39ca41a5475cdf33f6b938cc60fbc34f59b020f0cb0c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e6c78a455a8044089e87ebab3c61cfc6
SHA1 9d362f9354e635f1c3f045244173546231e9ba72
SHA256 f06c41efd38ea5419ca39fc2df6a0e6603e27569b53ab01c636d43516ff7800d
SHA512 796fffb8ffcc0aca5e574498686eb7719211b0f53d7187ed36d2372636cc5ffacb8795278cb89a7bc406f1a72810cfd952a123638bc96a4d950fa008275c2799

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 671f16692a2c1e22dcffbf92a57f69a1
SHA1 4c516c2047af90043d44e8e8cf12ff0f30330b52
SHA256 84dfdf35d2ae3ecd6d156d9e1a046b7b419d321df20caf68ea4004dc89ad7089
SHA512 faf2afa3f2caf6cf4c61dd72d4d394ca30f9e2190963795d90a0d668ed67ef1436e97c6a923a84571170b7f6badb2ca38f07bb7f8d5c802b216833fca496dbd7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2542e7f6adbea172f36709c8e9a4de06
SHA1 47719f83c8b7b09025f32adf5c3049418ee93619
SHA256 9258dc18bf0354aaa6dc2bec6f19c5c5a58d1dd4e60d9b0fbe1c92f2554184b5
SHA512 68e502199954b5589df2e7bead5a0b6fe462598faba9c0ccbd442a13945c6f5115e801b897b0fcaf58e96265bc53752ea63a37be2520975cd54aed3eae8eeebf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 10137733fdf93840ff8d2a8cf926ffc4
SHA1 cb703c8f166a1ba65bd7d09916535a0912e2e5d2
SHA256 ca760094011d80c3630221631e7fc2083f96fde48e9a8ab7b7aefc8c19e984aa
SHA512 d35127955a4824a63c28779dbebd17fa6426192b6b4c81c739e91297cc363ba4692ca64ce7a447fdbbd9b472e1bda4768dae1bc5f343c5f0cc07b5ad04f718fa

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 03:55

Reported

2024-05-10 03:57

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d35830de7bda9575f0d0f8fe4299ffd_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4608 wrote to memory of 4888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 4888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 1612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 4112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4608 wrote to memory of 3984 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d35830de7bda9575f0d0f8fe4299ffd_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1880 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16362656952606190552,8861662291566681483,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6856 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
GB 216.58.201.110:443 apis.google.com tcp
GB 142.250.200.9:443 www.blogger.com tcp
GB 142.250.200.2:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 www.tiempo.com udp
GB 142.250.200.9:443 www.blogger.com udp
GB 216.58.201.110:443 apis.google.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 104.16.245.103:80 www.tiempo.com tcp
US 8.8.8.8:53 platform.twitter.com udp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.178.1:80 2.bp.blogspot.com tcp
GB 142.250.178.1:80 2.bp.blogspot.com tcp
GB 142.250.178.1:80 2.bp.blogspot.com tcp
GB 142.250.178.1:80 2.bp.blogspot.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.178.1:80 2.bp.blogspot.com tcp
GB 142.250.178.1:80 2.bp.blogspot.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 104.16.245.103:443 www.tiempo.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 103.245.16.104.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
IE 209.85.203.84:443 accounts.google.com tcp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
GB 142.250.200.9:443 resources.blogblog.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 216.58.204.66:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 1.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 66.220.184.93.in-addr.arpa udp
US 8.8.8.8:53 84.203.85.209.in-addr.arpa udp
US 8.8.8.8:53 73.79.16.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 translate.google.com udp
GB 172.217.16.238:445 translate.google.com tcp
US 8.8.8.8:53 translate.google.com udp
GB 172.217.16.238:139 translate.google.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 connect.facebook.net udp
GB 142.250.200.9:443 resources.blogblog.com udp
GB 163.70.151.21:445 connect.facebook.net tcp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 www.linkwithin.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 216.58.201.110:443 apis.google.com udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 developers.google.com udp
GB 216.58.212.238:80 developers.google.com tcp
IE 209.85.203.84:443 accounts.google.com udp
US 8.8.8.8:53 syndication.twitter.com udp
US 104.244.42.136:443 syndication.twitter.com tcp
GB 216.58.212.238:443 developers.google.com tcp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 163.70.151.21:139 connect.facebook.net tcp
GB 142.250.180.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 twitter.com udp
GB 216.58.212.238:443 developers.google.com udp
US 8.8.8.8:53 238.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 136.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.200.33:445 lh3.googleusercontent.com tcp
GB 142.250.200.33:139 lh3.googleusercontent.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:445 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
IE 209.85.203.84:443 accounts.google.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
GB 142.250.200.33:443 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 cristinafaleroni.blogspot.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
GB 142.250.200.33:443 lh4.googleusercontent.com udp
GB 142.250.200.33:443 lh4.googleusercontent.com udp
GB 142.250.200.33:443 lh4.googleusercontent.com udp
GB 216.58.201.97:80 cristinafaleroni.blogspot.com tcp
US 8.8.8.8:53 97.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_4608_ZUGQBCKNOGNAKGSQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8680e1116ebc33b5e3de134bd50f4bf0
SHA1 9d74f82d5f0fd0931176c6bd5b86fbac24f75731
SHA256 0f18528dc9891d4ee1c632240cb656522afd409525ed5574a25f2c98f61c2be5
SHA512 926c699512b7680935769bafbfde2c7dfaa73cb12d08522d4e20a3d333e4d5205f7817307a4553bbe7f41ee6a35f5fb8b8b51ba70faa62e5a089855382a0b746

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0af8b500dc2088e4900e965a47fbe500
SHA1 0bfb922ab314a8192d4fbc17caf7ea25e553532e
SHA256 675aec325e26b496d333429e3bf18d361153b8061820ff03b8f9ed993bcd9f2f
SHA512 10745a230b8a16611d93652cd31531560c9862cb0953755387aad65fd873c81e46fd2c4c12e1e4375f572c229cfea8272407abaf084f944016fd1eec5ef84191

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 70e696d5317b17cb89e6209f567a7203
SHA1 d37cd3928d8dfb56f5137ea8b8c8d9e769676b30
SHA256 980880d21ea36ccd4a0d393e9d7c779ca6ec64ce70e4d658de4a0dc934048db0
SHA512 6ea0723f3a81fa79f9ed42d2535ca5bb3e8fb64509af3d074f8b6e4882329832e9eda6bcfab685ed879d3773396be5fdd9efbbaed9f76e833b97a601c8b85775

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8aa716ceab637c5deef2c24f1f9e24c8
SHA1 0c8bc295eb8fe64f1fd86234182a5d64215d4f19
SHA256 4a9eb2c4e1c3c672b929a2a33a33eb1ca2147d61504870ca87f4c65287c5f204
SHA512 cee1c02cb39638a07dcea503cc97be8de445ed7cd545f1103c6c59fb6236ae2dc7b7803958344620f109d4e4247000dc34ff375937e5f62dd03761394e09b5e3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 767b1a71a9600503b3170f71a0e79763
SHA1 4bca803e3327681b8971f90618ce6ad9c2f0937d
SHA256 3e310ff985af07ffbbd43e832668611df3523e4b28d860afc613ae4a747070ef
SHA512 bc69c068cfba497581a36840750834d9d03cec3b8cce23bafb6dacbe7f084512159973289f5de4b1dce1492ac066f0141d5c11c28785503f854679bb337b6f17

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583311.TMP

MD5 11c8387f9c6355e2615f000be37d7b8f
SHA1 6230c021c96081241d603dca6778bee38784c944
SHA256 09f30d64c8db29b1b6ff90bec75bbd94caf56e842b1647caf240615728023d25
SHA512 23db0b4634dc83c2828dcf1f67b93f84ce7803fcfe55fe95eece97dcdcaadac52778ec7362047c89a3d51f84534dced6bdaf7201c6da894c2ef99961c63ea611

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 4da60e12cbbd6516b57233b8ca04620b
SHA1 641f4b407753408a7f88c46fa99fdbc7d203f74f
SHA256 48e1bc30fb32f752834615aec726b76f63c7aa199fa228c42da0245df6af8354
SHA512 6f753415e8e7bd78e17ab9312e86644a504dbd0a2dd33bf2ee7ffdc036318cb01d8eaed5071e31932d1bbdb9d3ea3fc4b48e3fa9d6cd2b89ca0c468f6914904c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 1bf9f5dad670fc8d2433f6bdbd5dcdae
SHA1 fed31e73e59b88491932ee122dabe125a780c5d1
SHA256 67912403da01b961a187e6433a757d8d847bda37c07475bb2d175d9c081cf6cc
SHA512 819b6c395788d10eb67a5de8397b81d08aa888e64b704bbe9db1445d60f1bf70de723250b925838443bc972f202ba16376a6e43c7c8d24f74130f92f3b5dff0a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ad012cbcfae89c85dd7c4fa577215d39
SHA1 49045a0d32f7b87523d8f941f0beb6c658f7bd8d
SHA256 452095a46ac4181380984b6811b272d2402561e8762abeb473754d9c4ae6ac8c
SHA512 5d61e3d9e340cae8511a0ab21e338f0d98a6e410e8596c7acd2c227175110f70333f95cc2f79970696e41ed16ba547791a677aa8259935555604425aa306e58e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 5bcc282be19ca638044fc4a86284c796
SHA1 647253c046041580509d6b0f92887f9e176bf7c6
SHA256 32cdc12fcff47fefcbe5e099f1a4a0a88149d1b5a266d6f64facfa3617fbeb34
SHA512 4476ade221a439572d53a1d40d377f3b434cf14f0c17f04ccd019555e368119ad7cbf0e614aee08324b43a7c87460db1b46abb54c369a6b9c53c6d6ddbb3f7f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 80c646a6a153f461fcb5ba730a829bf3
SHA1 a6b61f5c8063e6913d511dec396bdb7a0aa51306
SHA256 08eb0fbecb4d4cd2d696c3c4e9c507dc5ba7ac93f1409826320d0668d4d99b0b
SHA512 ed41c60544499f19a089b9a14f4f7e7cefc1c55574ed86b7134a26f1ce4482e93409602e4109a44fc1f06e4ade7cf253a56fb0185e210f62d5eaf17fa17020a1