Malware Analysis Report

2024-10-23 17:25

Sample ID 240510-g3682sbb26
Target 2dc3d8088c5355e2639bb994dc8d2e4b_JaffaCakes118
SHA256 66a9c653a0e4bc89c2e27facc6a55ab5265808c63a256cd02374411e7afc78ed
Tags
socgholish downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

66a9c653a0e4bc89c2e27facc6a55ab5265808c63a256cd02374411e7afc78ed

Threat Level: Known bad

The file 2dc3d8088c5355e2639bb994dc8d2e4b_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish downloader

SocGholish

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 06:20

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 06:20

Reported

2024-05-10 06:23

Platform

win7-20240221-en

Max time kernel

140s

Max time network

145s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2dc3d8088c5355e2639bb994dc8d2e4b_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003c2e68e68653591705b0764dc80771ae33d2ca08bb2b27f6d72d5d99523fd6d1000000000e8000000002000020000000752aded8a97480eede221bd23f41ab0ee5f606888d1b75f6c6385cd9e154d1e020000000a864fb1ee69a38ee56eed2a80a68bc700215aed48111c0ed321a0da227b29b9b40000000659c900070f090fda6d36ba8ead61570115fd28c6f0deb54ab48eb73577e1faadb73ba11161c6a21761cf2d2dd06939b20281af213fcf5e53130d04ee25fa48d C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701e1261a2a2da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7384ED31-0E95-11EF-9B89-EA263619F6CB} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000001f2b5a503069a7056e6016dc3761085ab14e8c1ccb764c623481317de8cf7a7d000000000e800000000200002000000063c2fc13367cf6ab0f64a5b82faa096f124a6d03888bf6792b8d67c1a8f858c290000000fed04101ba58d43426aa419902d94bf5ed68637e22143d6be1e2ca531a34f3bd14e5225cb0981d203a46a8f0df73eb9aa127ad684ba171bb7dd35bb8087669d014b3a5cc9208e46a46c4441cf11f71ccec3142ae18175e342b11982ef6002b7bf84a16a415b4c624b2298659aaf17e323aca7307e9b14cde09db451596ace0a4a1c9966a231b7a369b84645523d940c940000000ed8f5d445f8982c53c69fe8cc1ef300df0382045cc995a4904bceb88a29a1059cfbe0dc6aa0bb513b595eab7e36fb9ab8ffe5e758117911d9dcdcc41d3f9194f C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421483919" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2dc3d8088c5355e2639bb994dc8d2e4b_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 www.feedburner.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 scripts.widgethost.com udp
GB 142.250.200.9:443 resources.blogblog.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 216.58.201.110:443 apis.google.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 172.217.16.238:80 www.feedburner.com tcp
GB 172.217.16.238:80 www.feedburner.com tcp
GB 163.70.151.21:80 connect.facebook.net tcp
GB 163.70.151.21:80 connect.facebook.net tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
US 54.241.243.143:80 scripts.widgethost.com tcp
US 54.241.243.143:80 scripts.widgethost.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
US 54.241.243.143:80 scripts.widgethost.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
GB 163.70.151.35:443 www.facebook.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 db9bc220fb74abc4e040d2dc0633c375
SHA1 0133ad8b1779ac1624cf2470b5313812ffa07247
SHA256 96674b9592409013291336c3b1ebd44c6aa76d1d4659f64ad2f96385b6a6c22b
SHA512 5c003462325d87ab35859c76ffb481576d21612725a6d68a3189aeeafcf7af9b5ca49671de02a034be5b65f76f1993da1018966076037a51d200404ee13a0f6c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 b6e71adf7324685d8f60c97bdb99f892
SHA1 ac45dd58c3dfb5d68ffdbc27817f1e5ad5720830
SHA256 40a181e9a8b85b862afc89a604eb290be3b5cd68937feb9ccfc467d3589e8e5c
SHA512 f864a712e300632059c0678ff5f54412fc7f7a1db02e469bcdc77be452886b55cd3d08ff51076278d1a21b091b2fc459e30c53b0d8e8855dbfefa59f0ee4cea9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 55e24a6e379fb8515a840ae6105f6794
SHA1 9c2133213b79fc6a5eb70611879f350f9d9110e1
SHA256 148d72e182c68198e24d52caab0c87c66aa564e1fe2d718e8dd2649b7bc121ce
SHA512 ee6173854be26f8fa4deb506734d3c29e5cb59357e4bc24a72809c9d5701eccc5d05faf4cf8500e0ce8f9f6e95313d0762930428dc617d5cf5644f806976f295

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ebb2b3d51f0a4f28c8fc305fa2e64a3d
SHA1 e7d20da31da5c74367e5573a56f4e4072a251930
SHA256 96bae593a740dd3262ff3b32efb6323901a1ac5cc751c41d731f29095c3814f1
SHA512 3d1b2968c332fa2045f12bc0ee8f902e5f5d98dc4ef8b533eae98c9052a60a062a8b3b22c13e70abec0a13aceb9471913a68734a000cee7dbe6cfbe75b6d652e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f6555d622f6325e272c677f5b4959afd
SHA1 d1bc5b002b84f9fc14027fcc88461f26239d19f7
SHA256 afe1435f296b581f7001dbe0a8783f22e1295efe4608feabf107b67f1574f9db
SHA512 3593780c68f643cce0b72794491d236f0c68e95f1c741324083edf4aafdc51212fbcdceb14e06404bdad448c501ac233d845cee0a91b99114d312e0b7e5c997a

C:\Users\Admin\AppData\Local\Temp\Tar14C1.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_F82FCC341F124F6AC9D153F6ECE89FFA

MD5 b4123484d24b54da9d4e9fe08bb5c22f
SHA1 af25edf0addd166e54601a1e1e6d111baaa47b9f
SHA256 2a0daa3d7e6dacc01134b1d0f304779a7f9fe29851e1af03554a7e9eee972737
SHA512 ca526fdc0659ea2613123527174d0c42fc56773e873124c32359d25a3405f2515fbbd658b51202a39d7c0d4d75a07fce65a2dd1994f53120a47895f9c8e394e7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_F82FCC341F124F6AC9D153F6ECE89FFA

MD5 172831834ea62b24f27ae09586544041
SHA1 1bb2f6eb9c319fe96051c9a7db6cc4b882912471
SHA256 c88fedc9c4ce58c474cbda40048f9c60ea139d81438401ca3f9f38de59e57319
SHA512 ab2e156cf49e575074aabec3dc76df497408755944acb34ea9a67f85eb75bfd1fc4eb898b445cab38d6cfb799288668ca6ca9338422de9d774264dffcda4de44

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\platform_gapi.iframes.style.common[1].js

MD5 7ef4bc18139bcdbdd14c5b58b0955a67
SHA1 afe44fd9a877f81a3c36f571c0fc934324c6cbd7
SHA256 192bc707852c5986f930528442d88a79e5bcf4513aacc2b722a3c5e964501838
SHA512 6c2920e80e4d5059588a32f75bc2b5dcc19f8d68224c0935d74f9fbf49476ca5b1ce43c279768f3d36871dfcec39f36db3fcad559c2f93cc540154cdbb04dec2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JB8Q1DZR\cb=gapi[3].js

MD5 4d1bd282f5a3799d4e2880cf69af9269
SHA1 2ede61be138a7beaa7d6214aa278479dce258adb
SHA256 5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693
SHA512 615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719

MD5 08b42de8e5fe706ca8f5159cf7f38b76
SHA1 33c2bbdbf57a54ebcc6a17da1419d661c46899f1
SHA256 c18980e956391123486c0cb4398901884bb4d3258b9b9b6b3f14c2c224bbd65c
SHA512 1f7e9fa94c503036b895a2ab9029af9c798c89826ea2e5d3e12c4a8c01c1c773c1237dcf6515249224a13fd71581e2ebbf69381f121e8b7dcfbbb61a7618d772

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719

MD5 9b2af6be162059fef0abacd8132ffd54
SHA1 1e5b604d3e40b2fe6ab2e61c516ffced06ab9b72
SHA256 eee6a5d1349e821b37e6cff59dc3b713be5a6d6721ffff03d4f22cf0f5495508
SHA512 1b79a9e33f1a34361764ef97d232d4e176d7a4c682dc734fb5c74f4985d77a60a301ef70727e42b554fccff9ba813f19b33e82dfa7593521484450aa3d414b87

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dd41eb83386ac973d3888f182511855c
SHA1 7632f708f3e38a5c7aabb823e370e396a8791640
SHA256 788b459f5e50636e7fae199bac2bdbd992576dfc1b01e5b1d06287869ee844ae
SHA512 bcb120593580a28770febc98dbb0bb46cdda3b7cc49a89ed8b4972cd7be79332e60a08e4de978a3751219dab2803f43528b897dac6f2c796fc2b1907bc904fb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 732aaff931f92cbd789a4027c941c5e9
SHA1 3ef423a363276811c13e93f2ac7d35618c59d595
SHA256 30cfe43042ab88e0f1c185dbbef893b3b3a2d0c2e6424c10c8fa2edc944410f0
SHA512 8396443bb456e33d6eefa526327e8e2d57a35714af073565291f3f87b2e382e86cd5ac8c41da18ddc297cd37f20c0ee7fa652b54d40f614241ca38e9d7b92a9b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 96ae36bf5d39c0ff68e0c86c2d03a91e
SHA1 03bbcf43433cfe2f8dfd77d3c34fdf5e5c7abd66
SHA256 f7f1f13ccd63637c68cff1a1e8911fabbb74817eb1df3f73734f34fe779537bf
SHA512 b777bd960f99c8e9084032ab0d3bdeebe875f5cfe5ca246a89785e17fa5d81beddd25b85e467a6cfbba718676574cb5862d9221bf160d1120277d1ed85290279

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15a20476c7a69befb6a271c456827730
SHA1 cff0a897fa8a5402d75547bfd181e4f622219475
SHA256 563e95cd13e5cce3a3b22e0242c15a69263bb39fe46c464e6c3f2b6014bdd6d0
SHA512 79d4602a770579739ed6a8a5186fce1ff837f24550387000bde84ac85ac615ffeb7be4746775a6fb798a0e4a01eb8874df213b2b37b5a767fc496eca249a178c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84d25a427d3a16a952966bb6ed19d772
SHA1 691f129b3df0e0fd57621c1a545432ba7d7f097f
SHA256 62a688df325b5f9018f3a28ab8b6756fe98305470ba83e965af6e3f8c33d043f
SHA512 8b5623dbb5a90684b46c021742e8e6a0314e7314ed70fa0ac2dbd3175ba4ce1b1336f85916e9fb7e4aa81962a30c1825f9cc2931e377fa077168f6d511559392

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ba993a257d0583c91f433dd011649f33
SHA1 812c5acfae637ea242f0a27964b1b9eab14d125d
SHA256 c9f7a2cfdc3547909654ed05f0729fa0a8bbdd1bb1c19162c4d01718a9dee0d8
SHA512 2c96154c09067dc626c218c9607fef4db3ba579a309c6dc7a91b0c7beca0c218624756255b75571d027b7c332bb2850e2780e82d3497995c8dad8d906b3b11c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f68dcac15a4eeb39dc6ab74edd80b686
SHA1 d8bd3bff37949f7d037d8509c4d5b0af1019ac58
SHA256 730005843e61508e9845c9c2d5c38e1e010211405bce9def9dfdf6cf60de31e0
SHA512 521e4841c96121a2a55c648da18903667b4c19244e8c7c842830cebf68f241135a3c0a0c13ff2230ca5f6e9ab9e099ca089841e38455a37b6c52665a40239fec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 780332be2c16a79d439552c08dc7918e
SHA1 5bc1c6ae6381e983d94da1d44395626525d1d286
SHA256 1556cf0b37188c289dde82540783b915ea3e68377581e51c16ecac186be80668
SHA512 8e8b2264e259b94b050b54f9913fb126775fba339d617286a8af90d79b37cf2c8a403131b2f6d44cf4b27a405e542038fea3b8f1d71d548f424b7b3ed5994cae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 35f06b155d9161beda922a16be8d58c2
SHA1 cf5c50a83815910acd13c45ac3434a73d7007af3
SHA256 73d8562bf577b51a3b37fe7c4e6e6f6f0d4c552260ea29b6f0ba23eef1ed31df
SHA512 1b651b7609ff257c0fa3516b017fc5056541bd199f2c30e6d1b9606b12021f74f62ae361424edc9851bd9c361196d3dc5b67eef12f0c8c28269d752f7ee04ae0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f7b91d72a816ba7c95961cec5c4c4ea
SHA1 545e651294ca899376a4042c6bc8d8906f86f2a1
SHA256 120375b28dea4f9ad55cdfe45aad43303ca3cade937f70ba3a5b4092c669f4de
SHA512 b2710f4ca17dfbe438b3dc0d3f89cfd70577232458eecbb02eb76e65b59db41b6e8ee00094602a50da1e824d2d0f3f7a9cef2cc06828e705239880a8878f730a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7be22f6b07a374d76900ce4fe7be071
SHA1 7bc673804e96c0e2c407e5cf29231bcc07e31885
SHA256 ccbd41e0a7b2950a21a5c82e67806dfbfbd67e0da7934541ecda17cadcea71cd
SHA512 926b77f84b557e5239918db3ef9820f406d1311539acb9038be108261125d89009c803e26199a1ba078507b7939407730535e55682917ada487e9af079806078

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf046d271a011031191e1ffd0f9e886f
SHA1 d25322b5f6ab1d9d25f571aed571d145c2477f65
SHA256 e680897edbf3c39a2bc59ffbedd89b782fbbd2a9e5532e3782aaf4436d182810
SHA512 85c669c4dea3ca8d5cd529bb9b0649749ffbd4c6d42a6fa94a7f5ab1f3dcef31d68ce7e2bcf6aac29956230fa8220be00b733852e5af117debf001ff9902867b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e2267caf771786a97a8ebecb6174a93b
SHA1 d7f0dc19db7a27b7ee4039e10f170cf272024f00
SHA256 09e9aa5ebafdf12b42b72f4009754bd25b6d05d3c68cb17689ae7ae8b5a6ac2f
SHA512 a65e4c0687048cc2d0e150fe93b3aba0d61a2cbbbd41adb675b5511df5a5355fa230def5017786a87a6c2808a17c8ad80cfbf31608a10885d3368fcfa0deea2b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb608d7cc122651b06f058b428b60c16
SHA1 899f19c3d511d5427d607054820c04db78626ad7
SHA256 e03d44d5c6fa6bf3e77b37d14196596260a8f8a8cf839bb903431aa9de3833fc
SHA512 6fd0ff6d93724184639927e8caba75ee9d48f3c53cd11c26b7f5f00886cd86bdf1ff77902b59583cedaf381e2e659d2cefc7539014fc5261a38821ef176aead0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 036dec8a39bcc8c1a095efab25fc4150
SHA1 bbe133a3b0eae315560d8384d0631986f0b15484
SHA256 51d25cd491818b35aaad46f92acbee56f73eda0463530bcef488de47447ceb74
SHA512 803c5fe5e21e125a109d3f06f8d378ad3677fefafd031d0a2aef1452b94b2fa5ec93e1841e46889c008cfb68edcdff9d3da3b2aa862a47458a3d0293fa370f95

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 05eb44d5a07a0edbdb41b8c810db77b4
SHA1 431bc724018492fe88c744d43913e9e42420b657
SHA256 454449baa3f1a12c2d1cfe1eaf7a633b9e2cc266d028c658bbc3525d69ba3dc8
SHA512 c50f8921c40b3cc2fad0238d8ddef0b141369a18cb8adc12e43a8c9b19c39b9e619b6c0373764f1ff8d90c71b99b74c1130742b3fbf387864e2db547a4e2f3b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 36ae716f057afe1d4ab4443ae447aa24
SHA1 0439831fac23b2cf45d2a6c5bceff72a9dfc2ba3
SHA256 c756053a95aac22cf71da674e16fcbe9107c6b6226181e6f400dfde8fe8541f5
SHA512 2259fc3b9688e81b81913efc0040c6b217fb6235635fa26a886e0617b4b1dd506c5eb0c6119e580ea7c75e7c4bdc99ca787d416385c3ec036e73e30e2c760ff8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c9d4bc8cac454f3a6ad751bb0f91229
SHA1 d7ee59babbc5f9773687d702a2405d5e4ad661eb
SHA256 8e6060fc06bb6489a0c43db3233b71a61fe750741ea73b5c67524084cb0b0f2c
SHA512 7d99e89a7408d697c06c5710ccd11d13064c30cdfdbd0230123144ac27bbcd216f17fb23901851993e3026c172e49a464c7a215bf68262753daf80862b1e7c65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c8ba10665b7c51a83924b9fde11f183
SHA1 f748bc2a80a98d73ecfb8bb1593ad088636e8ddd
SHA256 a5099f69facab1eb166aa6705120952aa0c58d87f41767d31ace7693834fe5d7
SHA512 784a933ed275a8645eb627fe7471ee04db23f31adecdc7a873422637ae063b15a358d72d6054c6bf5e21776546797b4628010604e6a3a387ad0d0039d0fc6194

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b75dbbbd1ff91256f668f35c4e75e11
SHA1 878508292afe48f5e509e4d4708402329b3aad87
SHA256 39ad03e018c50acd465b0ec9bd4f41f970311ed66370e70676cbece5406b54ef
SHA512 d853c8e7723d167b0ac291f2e8b5e17d12c388634eda7c136201a8f37cc0b3f20c4564e3a52f95b2833c2e7a6434b1df7267003972599c24a638c2d69bb4442d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e1b8cf0c890ad55a64b482bdd51e7d4
SHA1 fc4956ee94f5d69c83bc22423f1886299e70273c
SHA256 8fbdecff4f82c35f31bcf4e0073ae3ae1d509643c75a9f03ce9f12e32131b1de
SHA512 bf4c089bd733fb8a18156ef6578a9781d1782845fbb34ce13d53382cce4d9426afb59d16225bec4bde033fbd7e24c244c7815df3573bc7be5029266c9ba22100

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 27b84e86cd5a5b67b339f298101f5b15
SHA1 ede694375f5f20a79c50cdecfae3888a77551ade
SHA256 5cd98f887fe3ca048e21cb72c7327618cd6be965d584535d31c7c580cf304b95
SHA512 805053b88a96c79da44df03e1d5bba1cfcdd163e8d692ac89db918952092ae7cb39587d3dd4b02355bfb66f0ace3e1579e5ce0dbecbcb5343da8e8b2e8929a9b

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 06:20

Reported

2024-05-10 06:23

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2dc3d8088c5355e2639bb994dc8d2e4b_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2dc3d8088c5355e2639bb994dc8d2e4b_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4912 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5812 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5360 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5484 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4056 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6180 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6368 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 13.107.6.158:443 business.bing.com tcp
GB 51.140.244.186:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 158.6.107.13.in-addr.arpa udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
BE 23.55.97.181:443 www.microsoft.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 2.17.251.4:443 bzib.nelreports.net tcp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.200.9:443 www.blogger.com tcp
GB 142.250.200.9:443 www.blogger.com tcp
GB 142.250.200.9:443 www.blogger.com tcp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 www.feedburner.com udp
US 8.8.8.8:53 www.feedburner.com udp
US 8.8.8.8:53 scripts.widgethost.com udp
US 8.8.8.8:53 scripts.widgethost.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 connect.facebook.net udp
US 54.241.243.143:80 scripts.widgethost.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 172.217.16.238:80 www.feedburner.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 54.241.243.143:80 scripts.widgethost.com tcp
US 8.8.8.8:53 186.244.140.51.in-addr.arpa udp
US 8.8.8.8:53 181.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 4.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 9.200.250.142.in-addr.arpa udp
GB 142.250.200.9:443 resources.blogblog.com udp
GB 216.58.201.110:443 apis.google.com udp
US 8.8.8.8:53 www.microsoft.com udp
GB 163.70.151.21:443 connect.facebook.net udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.200.9:443 www.blogger.com tcp
GB 142.250.200.9:443 www.blogger.com tcp
GB 142.250.180.2:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.201.110:443 apis.google.com tcp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 225.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 216.58.201.110:443 apis.google.com udp
GB 142.250.180.2:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.189.173.20:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 20.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
GB 163.70.151.35:443 www.facebook.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net tcp
GB 163.70.151.21:443 scontent.xx.fbcdn.net udp
GB 157.240.221.16:443 static.xx.fbcdn.net udp
US 8.8.8.8:53 16.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 allergenfreeplease.blogspot.com udp
US 8.8.8.8:53 allergenfreeplease.blogspot.com udp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 216.58.201.97:80 allergenfreeplease.blogspot.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 97.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
GB 163.70.151.35:443 www.facebook.com udp
N/A 224.0.0.251:5353 udp
BE 88.221.83.251:443 www.bing.com tcp
US 8.8.8.8:53 251.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
BE 88.221.83.224:443 www.bing.com tcp
US 8.8.8.8:53 224.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 50.192.11.51.in-addr.arpa udp

Files

N/A