Malware Analysis Report

2024-10-23 17:24

Sample ID 240510-qw3rqacd56
Target 2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118
SHA256 268a3aa9f932cc62f868a101dbf930b29396bb21acdead61e9bb0af527e72245
Tags
socgholish downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

268a3aa9f932cc62f868a101dbf930b29396bb21acdead61e9bb0af527e72245

Threat Level: Known bad

The file 2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish downloader

SocGholish

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 13:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 13:37

Reported

2024-05-10 13:40

Platform

win7-20240221-en

Max time kernel

142s

Max time network

147s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421510121" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{748EC791-0ED2-11EF-A40F-5A791E92BC44} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 ahlikompie.com udp
US 8.8.8.8:53 www.insidethemagic.net udp
US 8.8.8.8:53 www.thefloridahotelorlando.com udp
US 8.8.8.8:53 pewresearch.org udp
US 8.8.8.8:53 www.myhotspots.co.uk udp
US 8.8.8.8:53 lpmpjateng.go.id udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 www.widgeo.net udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 lh3.ggpht.com udp
US 8.8.8.8:53 lh5.ggpht.com udp
US 8.8.8.8:53 lh6.ggpht.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 bloggercilacap.com udp
US 8.8.8.8:53 pub.mybloglog.com udp
US 8.8.8.8:53 cdn.wibiya.com udp
US 8.8.8.8:53 bloggergadgets.googlecode.com udp
US 8.8.8.8:53 www.linkwithin.com udp
GB 216.58.204.74:80 fonts.googleapis.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
GB 142.250.200.9:443 img2.blogblog.com tcp
GB 142.250.200.9:443 img2.blogblog.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 142.250.200.9:443 img2.blogblog.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
GB 142.250.178.10:443 ajax.googleapis.com tcp
GB 142.250.178.10:443 ajax.googleapis.com tcp
GB 216.58.201.110:80 apis.google.com tcp
GB 216.58.201.110:443 apis.google.com tcp
US 192.0.66.2:80 pewresearch.org tcp
US 192.0.66.2:80 pewresearch.org tcp
US 104.16.150.108:80 www.insidethemagic.net tcp
US 104.16.150.108:80 www.insidethemagic.net tcp
GB 216.58.201.110:80 apis.google.com tcp
GB 142.250.200.9:443 img2.blogblog.com tcp
GB 142.250.200.9:443 img2.blogblog.com tcp
SG 172.96.191.56:80 ahlikompie.com tcp
US 104.18.164.83:80 www.thefloridahotelorlando.com tcp
SG 172.96.191.56:80 ahlikompie.com tcp
US 104.18.164.83:80 www.thefloridahotelorlando.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
US 104.26.10.22:80 www.widgeo.net tcp
US 104.26.10.22:80 www.widgeo.net tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.200.9:80 img2.blogblog.com tcp
GB 142.250.200.9:80 img2.blogblog.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
IE 172.253.116.82:80 bloggergadgets.googlecode.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
IE 172.253.116.82:80 bloggergadgets.googlecode.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 216.58.201.97:80 lh6.ggpht.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 216.58.201.97:80 lh6.ggpht.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
US 76.223.67.189:80 www.myhotspots.co.uk tcp
US 76.223.67.189:80 www.myhotspots.co.uk tcp
US 188.114.96.2:80 cdn.wibiya.com tcp
US 188.114.96.2:80 cdn.wibiya.com tcp
US 192.0.66.2:443 pewresearch.org tcp
US 104.16.150.108:443 www.insidethemagic.net tcp
US 104.18.164.83:443 www.thefloridahotelorlando.com tcp
US 104.18.164.83:443 www.thefloridahotelorlando.com tcp
US 8.8.8.8:53 www.tealdit.com udp
US 8.8.8.8:53 apps.identrust.com udp
US 172.67.174.110:80 www.tealdit.com tcp
US 172.67.174.110:80 www.tealdit.com tcp
SG 139.99.69.164:80 bloggercilacap.com tcp
SG 139.99.69.164:80 bloggercilacap.com tcp
US 104.18.164.83:443 www.thefloridahotelorlando.com tcp
US 2.18.190.81:80 apps.identrust.com tcp
US 172.67.174.110:443 www.tealdit.com tcp
US 104.18.164.83:443 www.thefloridahotelorlando.com tcp
ID 103.30.180.77:80 lpmpjateng.go.id tcp
ID 103.30.180.77:80 lpmpjateng.go.id tcp
SG 172.96.191.56:443 ahlikompie.com tcp
US 8.8.8.8:53 s1.rsspump.com udp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
SG 139.99.69.164:443 bloggercilacap.com tcp
US 104.26.10.22:443 www.widgeo.net tcp
US 104.26.10.22:443 www.widgeo.net tcp
US 8.8.8.8:53 mc.yandex.ru udp
RU 93.158.134.119:443 mc.yandex.ru tcp
RU 93.158.134.119:443 mc.yandex.ru tcp
US 64.98.135.66:80 s1.rsspump.com tcp
US 64.98.135.66:80 s1.rsspump.com tcp
US 104.26.10.22:443 www.widgeo.net tcp
US 8.8.8.8:53 widgets.amung.us udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 172.67.8.141:80 widgets.amung.us tcp
US 172.67.8.141:80 widgets.amung.us tcp
IE 209.85.203.84:443 accounts.google.com tcp
IE 209.85.203.84:443 accounts.google.com tcp
US 104.18.11.207:443 maxcdn.bootstrapcdn.com tcp
US 104.18.11.207:443 maxcdn.bootstrapcdn.com tcp
US 8.8.8.8:53 arvigorothan.com udp
US 104.21.30.34:443 arvigorothan.com tcp
US 104.21.30.34:443 arvigorothan.com tcp
US 8.8.8.8:53 applify.me udp
ID 103.30.180.77:443 lpmpjateng.go.id tcp
DE 138.201.94.231:80 applify.me tcp
DE 138.201.94.231:80 applify.me tcp
US 8.8.8.8:53 www2.cbox.ws udp
US 8.8.8.8:53 i1045.photobucket.com udp
DE 195.201.153.71:80 www2.cbox.ws tcp
DE 195.201.153.71:80 www2.cbox.ws tcp
FR 18.244.28.112:80 i1045.photobucket.com tcp
FR 18.244.28.112:80 i1045.photobucket.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
FR 18.244.28.112:443 i1045.photobucket.com tcp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.187.225:443 1.bp.blogspot.com tcp
GB 142.250.187.225:443 1.bp.blogspot.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
ID 103.30.180.77:443 lpmpjateng.go.id tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
ID 103.30.180.77:443 lpmpjateng.go.id tcp
ID 103.30.180.77:443 lpmpjateng.go.id tcp
DE 138.201.94.231:80 applify.me tcp
DE 138.201.94.231:80 applify.me tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 30ba39f0d9dfc242bcf5a13148c65714
SHA1 f35a36a5dd87eec68ee6d1e621224995838f30f2
SHA256 6cb7722d1559158bb31024e172b224988f0963e043cb8f60065c94c0e9f5b0a8
SHA512 bf732a235af263d14562f0f10495e910f18affdf4dd1f1f0507c470de7e9cc0d3f122f4e114962ab3342c434d71b20e97ee78dde7339a42300cb5a394f500a45

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 cb53b0039b109b98a67fd18a468bab5e
SHA1 6d186e96489850c3808815628702d4859b7b26b6
SHA256 9ba581edefe0b810add43e4561b53a9087c38d9b8973b18e7dbb92dbe8a562b1
SHA512 692ccca4c50403395a09132fcbd8e71c479bfbc0a4e0c61c5697b58377941f86707e6bb32ca603196a5a4dfe18a2cbe6bdbfe8d98c0ef4912bce71fa37b2e9e2

C:\Users\Admin\AppData\Local\Temp\Cab279F.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 d02d9539c07f8160f0d2216ce159192a
SHA1 3476e487089f9684b27386036b1dd80700be9d50
SHA256 fdf4e07877e0dfddf4706e5ba8cd7854d5b2ff13a0977010c2e7f1fcc654659b
SHA512 6d572a077864c4da31d8d8c2850f40cc90ab13c4941001951de4ad1a76a79fb3f17c2a16b16f09ab6cd065208f70cf9403fc5019d7c7b85d406e09786117d035

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_F82FCC341F124F6AC9D153F6ECE89FFA

MD5 43ae1240e82a88c27729aa2e43fdcd18
SHA1 d3d075e4a91481cb936b162a4aef36a7ec25ee70
SHA256 e3502b118ac5ee1eb32690694f604b973f3d5c4a8bc00c7a41e71c63ed96bdf2
SHA512 b41079e60d4fc1c4640a119dc1fa47bec6efadabbc0e5f4e4a3f4c89abb160e74914531088e273feaa670d3a92b00a0e6380fd94fa480913709f34ad1c971a5a

C:\Users\Admin\AppData\Local\Temp\Cab288B.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\plusone[1].js

MD5 fb86282646c76d835cd2e6c49b8625f7
SHA1 d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0
SHA256 638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109
SHA512 07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9

C:\Users\Admin\AppData\Local\Temp\Tar28ED.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84fdc84ce145c467a735a566f3e7d47b
SHA1 34ac98fc236e0e6f2c71cc8468683acd5fdcc3dc
SHA256 ae96294b5a3be3c83175f3c5aca5759d2a6e5e871f1e8b0c60125956dd325de2
SHA512 eef5ba11ac548abbfd3f2d003f9d370551dd674f2d02814f5586567b2386df8f15bb2dfbc69b0af2ef8b41d12d1aaa32a2cae29f9c4620c86faa01abc6fd3c37

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\cb=gapi[2].js

MD5 4d1bd282f5a3799d4e2880cf69af9269
SHA1 2ede61be138a7beaa7d6214aa278479dce258adb
SHA256 5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693
SHA512 615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b2d6c2a0ddbb4f786f6e6cd37324d9a1
SHA1 01ac2b26c306169a6cd62a57fc87ed7f6824d2d1
SHA256 f41dac8871334f4e9ae7c6fb698ff21846d10ab450081a6251d5a8781099cc69
SHA512 01fa62b604267f31799bfb682f2ec5dcfb40757d33e7b1ab874d35af169e3bc69c5311da6f2b9522eeac880dccef115fcf41f961d2b298a7eb84d5875a729a63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719

MD5 8054872b37200a510f4c5402c9bc8613
SHA1 3134db147434a201795bb804ff6f71cbe7c60b0d
SHA256 b949dfd054405ef3e4d0f1764cf2f14352b53e6bd6e10012681ffc484756c813
SHA512 219f3968e6fdc10338973ca4c622ad46d8ef8c566e8ed641b9a2f5c70e5754618a90428db4782b31af99e92573b79a9eba2f1d274d6fa8eaa006ce951cb929f0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc94f5dba9881dfad3a0077b4e4b5af7
SHA1 631ccb79877ea217a6272cbaf4dcf9eb99e61d60
SHA256 8f69c55fe48a6b0f4d12309be671caea589ffb46be7b921004b5cae032e805ed
SHA512 74bc39dae632e2e446286e6223407c08075006a4c1776be28bc88a805b02507838a3fd34fa9acaae6288257c77a708a2876492696d07ca62c98f0558d6761e92

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ae2fcddf52b383f5b1d81715645db92d
SHA1 a1f8172d58e433feb2e0c7948902e8f99e953e04
SHA256 fe54956071c05db4cbfbe72455a7270a229980ac486305ee4a8cb38817c3c512
SHA512 85000a9da7fd2e241825724133c1c4303ea4e4d827393d6522179346e4765bbfe7bb12dd11808536e28ae99a8de7108c765751362f8d4df80e0f5289d098c03c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 bcc8a49fc1d9224f3aba2492ec3ca10d
SHA1 45ee447a306db578ca634268d46344d0ea8711f5
SHA256 57197cdef50f665f599a35e4fb537b6bb3a2a7962593126aa2ef42a9bab7ad0e
SHA512 84acdb9d11a5c4f0474ff2e11bc4c34988b7cbdd023ed367f6e7d78c4146e5f591a2a6121cd24433a56439e4b13545468f621fbe62202a7b2bc1d9521a27b788

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b986a95708fa5828175347b8c897bf77
SHA1 4554b342f4899bd3c95b4a2d9b5aea64e6334bdd
SHA256 f832513c28a3c51606270fe6410a573614d2458a6c1282321f775f7a831ddcda
SHA512 d70ef2f0c2221d5aaca83415a169778d5d7b00da254e8eb07ece6ce2a28c50eaf4555b80f33058e89f4229fb2c7ee8e5045ec838202d02f10063f0963655273d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1de1346c6fecc4b30f823d2a952ac8e1
SHA1 e65cc4f11e8565e24b07c4de8fee1f026fadd157
SHA256 9ef4fc59708417588462e8ef6460ba1ffb1797a39d6d19379ebf4631834d4a5c
SHA512 c5b44e06cf1bab95de8b5a54e8c8fba5309ad9439b0bed0533178793308a9de8c8cef4b54b816d652429e76638d44b6f2e622ef53228a5baeeeefa938ad53149

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d9e5012962c3783dd3c022a6aff84606
SHA1 0f615cbe3225e133d0da6935e654497d5c90ddce
SHA256 f6a1c7fde691f774150238c0a4ae2ddb819004fddfee271ccfc594c815a15aad
SHA512 df724bf854f0153541f4fd9c80fd7ef41c13d40db0e71f227ad94bf71648a33b897775ca0acb785d7b204b809c75794b6a292acccbd55f36d05d4dcb06841e94

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 45d211742f2a17dc97af52f298b26d73
SHA1 913db012a5bff22795e9bf78df300f659b83fd6d
SHA256 5471cfd9219f96ee35d13a16bd8066831495d80fe7dcd8b7129b59fdde3ab8c3
SHA512 24ee4dc487f5613c06732e54d45c0dca15a25da0114dbd4743d0ea26dd7b6b1abf8a96268b9358e86c9d26747ee6cd886b0cbe76997bac20e5028c4c9c4fea85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 bfb1de7166ec9ae9eeec1402eb3b8655
SHA1 972f61bd2b9cb817053a02fc420f68a09753b591
SHA256 08135d309b40f1ba682f20ca2ec1b54c98883b895965a5625d7738bfdd80e84f
SHA512 53a3efc97766803b9e6e6cd5c57c48a2364fdf6306f91d24a12c73b688aa0f2cfc6216d5cf820db3e1a1e397ab2b395681ccf533040f837e778d649bb9db34d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d705187ce2322e6e8c96d2d68bea1010
SHA1 d11e9cec54973261e753095cc3c91f60f792522c
SHA256 8593b6b04d9dc5df9a6f9f1f4088358976374b382c30d5ed7faa156a1ecad5bf
SHA512 1b6374a2b0f68f4a7bbf9ece31c2fce08b9672769331613a012146da56741b7a1a30d0ee2352dac9a3820637c29dd167d096940243a765b87014db6a0ae267e3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1efec08b5156b985c1210023ba72f010
SHA1 2d4dde369e0a108415253cb11cd852ccf5fcce2a
SHA256 6590d113f0c9f8b8a70f465b45acfbd160c08c9fcf0ae1a6d118f442d63ba377
SHA512 60bddb8e3d0abfafbe0daa1d3aabfe90e1720202bfa74b024fdebbcb8cd464767163b7eef139eea5621bf8b16007dc34a687ab43f787e3fbd13bc12af2987dac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 93eacbe42ad299696f467c3d693a9bea
SHA1 ef33db616ff02868669b3a111d9d9c63406ac054
SHA256 b0aca19ce638e96df4b19d5cb71aa882a4f2ebd20f2284f76cc283110b955099
SHA512 7dce9d637cfb8e7e82a5b96a64fa7ef2ca90afdb104b5947475f441c8e779871ea187434dde9e8bb4b23f3b26e76cebb08d251c6fb45cdc251016963b8f451a4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ccceef93bca9aeea869b4e67fe40a888
SHA1 0b63d5de0aeaf7ce10c00e8aef73afa75c00517a
SHA256 87f5fe530b93ce4c04892a5dbee2b41c2ba49595dbbd80768345abda258c2254
SHA512 e0646d0217f38028b768a3a6e6ca651ae0aac7f4ee8c14c851d8ce923b27643cc65b18f9772671482e17d6f2fa0ebe5bea45bdc50ed64a3b6d8de3f11c6a62d9

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 13:37

Reported

2024-05-10 13:40

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

139s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3532 wrote to memory of 652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 652 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 3776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 3776 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3532 wrote to memory of 4968 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c15146f8,0x7ff8c1514708,0x7ff8c1514718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1492 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7992 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7992 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5528 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 216.58.201.110:80 apis.google.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 142.250.200.9:443 www.blogger.com tcp
GB 216.58.212.234:443 ajax.googleapis.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 216.58.212.195:80 fonts.gstatic.com tcp
US 8.8.8.8:53 yourjavascript.com udp
US 13.248.169.48:80 yourjavascript.com tcp
GB 142.250.200.9:443 www.blogger.com udp
GB 216.58.201.110:443 apis.google.com udp
US 8.8.8.8:53 s1.rsspump.com udp
GB 172.217.169.66:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 www.widgeo.net udp
US 8.8.8.8:53 pub.mybloglog.com udp
US 8.8.8.8:53 cdn.wibiya.com udp
US 8.8.8.8:53 bloggergadgets.googlecode.com udp
US 64.98.135.66:80 s1.rsspump.com tcp
US 8.8.8.8:53 ahlikompie.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 lpmpjateng.go.id udp
US 8.8.8.8:53 www.thefloridahotelorlando.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 www.insidethemagic.net udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 pewresearch.org udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
GB 142.250.187.225:80 3.bp.blogspot.com tcp
SG 172.96.191.56:80 ahlikompie.com tcp
IE 172.253.116.82:80 bloggergadgets.googlecode.com tcp
US 172.67.143.66:80 cdn.wibiya.com tcp
GB 142.250.187.225:80 3.bp.blogspot.com tcp
US 104.26.10.22:80 www.widgeo.net tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
US 104.18.162.83:80 www.thefloridahotelorlando.com tcp
US 104.16.150.108:80 www.insidethemagic.net tcp
US 192.0.66.2:80 pewresearch.org tcp
US 64.98.135.66:80 s1.rsspump.com tcp
US 192.0.66.2:443 pewresearch.org tcp
US 104.16.150.108:443 www.insidethemagic.net tcp
US 104.18.162.83:443 www.thefloridahotelorlando.com tcp
US 8.8.8.8:53 www.myhotspots.co.uk udp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 www.tealdit.com udp
US 76.223.67.189:80 www.myhotspots.co.uk tcp
US 8.8.8.8:53 img2.blogblog.com udp
US 2.18.190.80:80 apps.identrust.com tcp
US 104.21.72.39:80 www.tealdit.com tcp
GB 142.250.200.9:80 img2.blogblog.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 172.96.191.56:80 ahlikompie.com tcp
US 8.8.8.8:53 applify.me udp
US 104.21.72.39:443 www.tealdit.com tcp
US 8.8.8.8:53 lh5.ggpht.com udp
US 8.8.8.8:53 lh3.ggpht.com udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
DE 138.201.94.231:80 applify.me tcp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
GB 142.250.187.225:80 lh3.ggpht.com tcp
US 104.26.10.22:443 www.widgeo.net tcp
US 8.8.8.8:53 9.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 66.143.67.172.in-addr.arpa udp
US 8.8.8.8:53 22.10.26.104.in-addr.arpa udp
GB 142.250.187.225:80 lh3.ggpht.com tcp
GB 142.250.187.225:80 lh3.ggpht.com tcp
US 8.8.8.8:53 83.162.18.104.in-addr.arpa udp
US 8.8.8.8:53 82.116.253.172.in-addr.arpa udp
US 8.8.8.8:53 108.150.16.104.in-addr.arpa udp
US 8.8.8.8:53 2.66.0.192.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 66.135.98.64.in-addr.arpa udp
US 8.8.8.8:53 189.67.223.76.in-addr.arpa udp
US 8.8.8.8:53 80.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 39.72.21.104.in-addr.arpa udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 www.widgeo.net udp
US 8.8.8.8:53 225.187.250.142.in-addr.arpa udp
US 104.26.10.22:445 www.widgeo.net tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 lh6.ggpht.com udp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
IE 172.253.116.82:80 bloggergadgets.googlecode.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 mc.yandex.ru udp
US 8.8.8.8:53 bloggercilacap.com udp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 8.8.8.8:53 platform.twitter.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
IE 209.85.203.84:443 accounts.google.com tcp
DE 138.201.94.231:80 applify.me tcp
SG 172.96.191.56:443 ahlikompie.com tcp
US 8.8.8.8:53 widgets.amung.us udp
ID 103.30.180.77:80 lpmpjateng.go.id tcp
US 8.8.8.8:53 arvigorothan.com udp
PL 93.184.220.66:443 platform.twitter.com tcp
US 104.18.10.207:443 maxcdn.bootstrapcdn.com tcp
US 8.8.8.8:53 www2.cbox.ws udp
GB 216.58.201.97:80 lh6.ggpht.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
RU 93.158.134.119:443 mc.yandex.ru tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 i1045.photobucket.com udp
DE 195.201.153.71:80 www2.cbox.ws tcp
DE 195.201.153.71:80 www2.cbox.ws tcp
RU 93.158.134.119:443 mc.yandex.ru tcp
FR 18.244.28.58:80 i1045.photobucket.com tcp
SG 139.99.69.164:80 bloggercilacap.com tcp
ID 103.30.180.77:80 lpmpjateng.go.id tcp
US 172.67.8.141:80 widgets.amung.us tcp
US 172.67.150.119:443 arvigorothan.com tcp
US 172.67.8.141:80 widgets.amung.us tcp
FR 18.244.28.58:443 i1045.photobucket.com tcp
SG 172.96.191.56:443 ahlikompie.com tcp
US 8.8.8.8:53 t.dtscout.com udp
DE 141.101.120.11:443 t.dtscout.com tcp
US 8.8.8.8:53 glakaits.net udp
US 8.8.8.8:53 www.cbox.ws udp
SG 139.99.69.164:80 bloggercilacap.com tcp
NL 139.45.197.242:443 glakaits.net tcp
GB 172.217.169.66:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 my.rtmark.net udp
US 8.8.8.8:53 yonmewon.com udp
US 8.8.8.8:53 sr7pv7n5x.com udp
GB 216.58.212.238:80 developers.google.com tcp
NL 139.45.195.8:443 my.rtmark.net tcp
NL 212.117.190.201:443 sr7pv7n5x.com tcp
NL 139.45.197.236:443 yonmewon.com tcp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 56.191.96.172.in-addr.arpa udp
US 8.8.8.8:53 84.203.85.209.in-addr.arpa udp
US 8.8.8.8:53 207.10.18.104.in-addr.arpa udp
US 8.8.8.8:53 97.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 71.153.201.195.in-addr.arpa udp
US 8.8.8.8:53 119.134.158.93.in-addr.arpa udp
US 8.8.8.8:53 141.8.67.172.in-addr.arpa udp
US 8.8.8.8:53 119.150.67.172.in-addr.arpa udp
US 8.8.8.8:53 58.28.244.18.in-addr.arpa udp
US 8.8.8.8:53 11.120.101.141.in-addr.arpa udp
US 8.8.8.8:53 242.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 77.180.30.103.in-addr.arpa udp
US 8.8.8.8:53 50.201.222.52.in-addr.arpa udp
US 8.8.8.8:53 164.69.99.139.in-addr.arpa udp
IE 209.85.203.84:443 accounts.google.com udp
GB 216.58.212.238:443 developers.google.com tcp
ID 103.30.180.77:443 lpmpjateng.go.id tcp
SG 139.99.69.164:443 bloggercilacap.com tcp
US 8.8.8.8:53 syndication.twitter.com udp
US 104.244.42.72:443 syndication.twitter.com tcp
US 104.26.11.22:445 www.widgeo.net tcp
US 172.67.69.193:445 www.widgeo.net tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 142.250.179.227:443 ssl.gstatic.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
ID 103.30.180.77:443 lpmpjateng.go.id tcp
SG 139.99.69.164:443 bloggercilacap.com tcp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.187.225:443 2.bp.blogspot.com tcp
GB 142.250.187.225:443 2.bp.blogspot.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 238.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 8.195.45.139.in-addr.arpa udp
US 8.8.8.8:53 236.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 201.190.117.212.in-addr.arpa udp
US 8.8.8.8:53 72.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 73.79.16.104.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.151.21:445 connect.facebook.net tcp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.151.21:139 connect.facebook.net tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 static.addtoany.com udp
US 104.22.70.197:445 static.addtoany.com tcp
US 104.22.71.197:445 static.addtoany.com tcp
US 172.67.39.148:445 static.addtoany.com tcp
US 8.8.8.8:53 static.addtoany.com udp
US 104.22.70.197:139 static.addtoany.com tcp
IE 209.85.203.84:443 accounts.google.com udp
US 8.8.8.8:53 cdn.viglink.com udp
FR 18.244.28.18:445 cdn.viglink.com tcp
FR 18.244.28.122:445 cdn.viglink.com tcp
FR 18.244.28.110:445 cdn.viglink.com tcp
FR 18.244.28.25:445 cdn.viglink.com tcp
US 8.8.8.8:53 cdn.viglink.com udp
US 8.8.8.8:53 whos.amung.us udp
US 104.22.75.171:445 whos.amung.us tcp
US 172.67.8.141:445 whos.amung.us tcp
US 104.22.74.171:445 whos.amung.us tcp
US 8.8.8.8:53 whos.amung.us udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 kepingan-hati.blogspot.com udp
GB 142.250.200.9:443 www.blogger.com udp
GB 216.58.201.97:80 kepingan-hati.blogspot.com tcp
IE 209.85.203.84:443 accounts.google.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_3532_DAHJKAJONAGHYAHE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bba78cb58d24f4cab6635448f07da924
SHA1 d9c878b33ca2553ee70a5dcf1a7ab53c9a53d56d
SHA256 4cddce4ad949bb5cf58cc9eb263c16759c9500f5c638063030cdd5acfcb7b5fb
SHA512 bdd198d518a11cd9b59fa9c70f8d1e7caf923935c2fcb3b7e4c91fa329c4628f60b08027789174dc61d2c34dbcb19baa82a282edcef328f88e6ebb4fc9b191fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d09e152809581955de3d5c54ac4a88da
SHA1 a9517340116c59934593e67e898db78256a70d63
SHA256 b959de61959fea39441a9b764098e75cd58aa39e2f68cc9499f8dfcdb76b6f31
SHA512 4014982e8c3711180c54d3cf1d0009270e9a04be29b2434826ce01b08b56e7345c8183b1cf3adf40bd9fad38974740b28d5181d044ca3d1713598ce2fefcd195

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 61ab4fbfd75ca38694be739df90714b2
SHA1 5b4f1b48735c3d21a5b85255ad5a043d1dda6f73
SHA256 9411405392bd0992bf9c1a7f05372b94e0f848decd93cfc2dcd5bb3a1e072af6
SHA512 0c8519b48eaac7dd9105253e616a4ba2f4d2154ea3fd60ebcc514bcd60576e361c6c9b5b9ba9bb25ba2a7a51dd6356cc7d930c26cf3b3b02ea778e4b3fbdfc1a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 01b7156b5201a7c9c5e2a6dff74ac7c3
SHA1 249b60cfc02bad967322e470695118e5343cee05
SHA256 2aa7f4807b6df208c12b6b33e6c923c8ed187ced9c213e5e3f4482c70a2467d9
SHA512 9d002f3aeb6a7f0521a148dc72e7a1d658b13b67b290bf042eec817b7bcd0704eefa066b59353f683bf29ddf4d9a29d310fc29aaca648df73ca6220d4992cfdd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 27c8f888996f8aa36e9e780487320145
SHA1 6bf5c7e8262cd18fcd65b2465e67e26dad4a5ee3
SHA256 4b9675b20a2036b20be00dfc9973547062ca61cb54018e6ead8b1fb5caec599a
SHA512 472ceb41c97c5ef1e0df207205c2e7e2e2f0fe13eb77b18831fc288a2f58d5e05fb47e908900f8039ee7810819926febf7f4d26b79d89932bffa7e53587f6090

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 20080cb285e9f1731f4866e5bdda622d
SHA1 ec8d8bf1d6d04357c72f22b6d663412435ac3376
SHA256 47aff29a8bfd2e3c017b66cde9a6cf623f9fb97554d543891c2c35b6113ec8dd
SHA512 f943e8a54e36f2e86a3c0f03e8400c9b3945269de548c4433782b917b505c2821835522f53ae59f299febaf26e114a69772f2dae8e7c7ace86d3807a7167c071

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1689d3bf7f4915d9de44d06f263d2a8b
SHA1 0ad5b12e8998740717512a56412e82f15691d941
SHA256 adfce1fa0828188608ddebbe775fa8e1d62a4147298a2e54c04ab634540919db
SHA512 d06179556972da6429daedcacbd0ffc1d87f343038c45b2baf3a56da3240511762177fb35358e3c51a0916f53dd604463938f3ec029c70dc20f11c1382b37a3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8b2d7c599e297381fb833bc5449b66b4
SHA1 8c8117d6175121e70bdd2088e224b92157764e7d
SHA256 54dc6015e5caa03c664fda9cf2913f5b60e417976b8ca9f2ea47822ae3e5ba71
SHA512 9cd9add7191598e0860996909a034c8814c998e7a09f4bd1fdb82de90150090e5e03f15e20dbe49ebce675194bc565b4cf891b1baee7d9360466715098a92c61