Malware Analysis Report

2024-10-23 17:24

Sample ID 240510-rvwgpadh63
Target 2f965367145ca56811eca11302776e6c_JaffaCakes118
SHA256 553c26c234e5f0822dbe13e7c0f9245e1cdcdd44b204b5024c2c03fe5508a7ba
Tags
socgholish downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

553c26c234e5f0822dbe13e7c0f9245e1cdcdd44b204b5024c2c03fe5508a7ba

Threat Level: Known bad

The file 2f965367145ca56811eca11302776e6c_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish downloader

SocGholish

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-10 14:31

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 14:31

Reported

2024-05-10 14:33

Platform

win7-20240220-en

Max time kernel

120s

Max time network

144s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f965367145ca56811eca11302776e6c_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008a8d9f2f64bbd4b21a80793d9bca41c97bd5b06e2990e17a4bb9d439b8e63230000000000e8000000002000020000000e9a3210c97bab8777470ca8cc9cb36779f06af69eaf3422a10819bb5c6038268200000005e037732e3a84427f433b69ca822db5bf048250a29ada33285213ad94b87f29040000000424e4d228169de67f0dbe46f45fb624be1d88c185502b25e4e4b3a0f4ccfa1cc13af70b8dae1a272a89062dff1a422c5c654d133e85348f58503bb95d3ac54f4 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA6788A1-0ED9-11EF-8A04-E6AC171B5DA5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421513352" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000069e2711072d499fd255e5782aab2b7e0734c4f0a6f12893a13da11679a3df194000000000e8000000002000020000000be81772cf1c1d2b3ee5e620ad2d6bf9d0167d965ec30a588b43ed7ce42c0f9b490000000294769943c546a01c9ab77c22570d00aca751cbb66f6efb6d84a547f02fe52240f090b9f82e020b236c83268bda4e49ef6185ed086b3d37879c483c77d91f5421c341c1906458845fc9c835f6bf1cf9b9b68aaf305b6773f1f8b432d4efeec2743b42349efa297b319c19ac371230bbcbd87a27050e4e62db75ceba85d55f0064431f26cc486fea48b78e0b84205fb0640000000f8378aa4de643ded83d10529ba1263e4f2012e4af42818ad0b2cb7c2a3423656605c5f1c5f0dfe8ea95b58c0bce6a8821032520098d3a43a60439c12da9159eb C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bad2d0e6a2da01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f965367145ca56811eca11302776e6c_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 216.58.212.234:443 ajax.googleapis.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 216.58.212.234:443 ajax.googleapis.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 s-passets-ec.pinimg.com udp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
BE 104.90.24.194:443 s-passets-ec.pinimg.com tcp
BE 104.90.24.194:443 s-passets-ec.pinimg.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
GB 142.250.187.225:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 storage.myfreecopyright.com udp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 16.182.68.137:80 storage.myfreecopyright.com tcp
US 16.182.68.137:80 storage.myfreecopyright.com tcp
IE 209.85.203.84:443 accounts.google.com tcp
IE 209.85.203.84:443 accounts.google.com tcp
US 8.8.8.8:53 storage.myfreecopyright.com.s3-us-west-2.amazonaws.com udp
US 3.5.81.104:80 storage.myfreecopyright.com.s3-us-west-2.amazonaws.com tcp
US 3.5.81.104:80 storage.myfreecopyright.com.s3-us-west-2.amazonaws.com tcp
GB 142.250.200.9:443 resources.blogblog.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.178.4:443 www.google.com tcp
BE 104.90.24.194:443 s-passets-ec.pinimg.com tcp
US 8.8.8.8:53 assets.pinterest.com udp
BE 104.90.24.194:80 assets.pinterest.com tcp
BE 104.90.24.194:80 assets.pinterest.com tcp
BE 104.90.24.194:443 assets.pinterest.com tcp
BE 104.90.24.194:443 assets.pinterest.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 5f2e74546ad3de88021b951f2523916b
SHA1 a9e99f6e636853f221d0f634738e8b1fe3c9941f
SHA256 e72ba1b6aea3f94e8b1d01c58eb6ea2c4c83bf0af45e1f92315f5215aa506a06
SHA512 ce47bb927ce4c71ea3c521aa9387fe25b38529df8d12dac75b5a8c93b26aceeb865b77dc57e1ffdf5cc765a8d128edab14629dff7a467aec4a8fed78cb4f6a54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 30ba39f0d9dfc242bcf5a13148c65714
SHA1 f35a36a5dd87eec68ee6d1e621224995838f30f2
SHA256 6cb7722d1559158bb31024e172b224988f0963e043cb8f60065c94c0e9f5b0a8
SHA512 bf732a235af263d14562f0f10495e910f18affdf4dd1f1f0507c470de7e9cc0d3f122f4e114962ab3342c434d71b20e97ee78dde7339a42300cb5a394f500a45

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 4db1d5f19a861912b2cccdfe43c72530
SHA1 d3de6a1c8db46a2286521b9d95c7e553cabaafa3
SHA256 144003aaf6456bd582f49a48c1a914dbca30e2781b6890f03f8b265bad35306d
SHA512 ff0e1d4a261ce47bc4a7255cdb7bf5ea9ea69116d23778fc7fe35865d40ffa8b7ec90a1a41933de6760f45e9a9ef19eeca66498fcd18abe7f2ee71e33f8891e5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f5ef70c5d1ff683546b8f9a2bb857785
SHA1 71b4d0d2cfeb8e8360984e33b3654be27ed09504
SHA256 74fddeeac35ea717957205b6f440cdaa66d78001c20eb787f7e9a31446fd4b88
SHA512 037ec6fb28eb28b6b13d9d457a3120e4ca1546a94963d0af00752e676759968e6b7875c1de903f01c791ccc3ed0117bec37af030321bec32bdf1cfeb246b6358

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 38fc0e0d55b95f5846c7c5a2cd0ed97a
SHA1 b8f9ebcd3d5e0ef1808def4a74576e4608dc425d
SHA256 046240fe85e275f4d46b6786e73db0e44e8ddd69eb1f53be6553133494b43cdd
SHA512 633e78b0b34938ebab3f9691d741b21c2cb10222665ce0af2f8165d6dae6cb104a947001af05485fd82adbfd946cc031c339f778d5d6e3d99e04b9947e5da2e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_F82FCC341F124F6AC9D153F6ECE89FFA

MD5 43ae1240e82a88c27729aa2e43fdcd18
SHA1 d3d075e4a91481cb936b162a4aef36a7ec25ee70
SHA256 e3502b118ac5ee1eb32690694f604b973f3d5c4a8bc00c7a41e71c63ed96bdf2
SHA512 b41079e60d4fc1c4640a119dc1fa47bec6efadabbc0e5f4e4a3f4c89abb160e74914531088e273feaa670d3a92b00a0e6380fd94fa480913709f34ad1c971a5a

C:\Users\Admin\AppData\Local\Temp\Tar127D.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\Cab127B.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 739cf3e5d1594dc7c0574dce07a853c0
SHA1 adcfa6375616b8c2f8f2ae82b7ef115d5d12f483
SHA256 0c60f3566102dc329a5988f03f6491599479681be48d1bbc425b795d5684e172
SHA512 27c9930d308ff0fc8107ba970a8795d55d81b01def683fa0a6c1bd17cf661bdc44e5a75acaabd1e1df0db0bee1dea7726ba08881d394ee2f99f6307511e77896

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar137C.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 124504f480b3078416a5dfe9b9be470e
SHA1 8c17446b7ebfa35209880a7601bba744d5c410ec
SHA256 f71c3a4e9ef23fffe51328532eb90aa50045bc00a0d98ed390e883f78d167bcd
SHA512 6ee264f41c89aee73a232085e6d29f4f8c9e74d29fddc6c3a47d800a3b948fc88696574c1db72f9579a8e47348f0431c3cdbe6f65ff0a1c81423ff158e5ae773

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0977264c332cd64e2195ee015d469906
SHA1 ffbbb963667e6e103b9ecc26655f1f4c5364d953
SHA256 f9a938bb284c475657da48cd9c52edf754fc3b8d53218aa3225988290ee64ebe
SHA512 9e1ad1496dfcee9380aed710bf88609341a4c6a5f6b3bca9f517cdafe3b675b88ccfe6b1207e8ab57611e87f648f2a9c2eda14f4609bbe6114c623dc9106e7f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e3eb079fbe90e31ea8ed48b2a46cf26
SHA1 3bc80604bf8d8dc2dab89198673dea31bb41a0e7
SHA256 fb34095e6a0efa51f97580ff07059a74ab6106badc9cc58ef076528328cd83a9
SHA512 d9482a81d33d094f325b5d0d57ee173b2c42fee72868137b91dcbe5653d157f392495a9a54341b544bf87abf8858ec70a4dedadd95263f016938736c4bcbe2f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d3ff8f79779a6934404c71b201ce4a4
SHA1 0a0fe00708d2b6d2369eddc26a91d27f1765cfc4
SHA256 a0290d19141cfc6b72675c366011decd1fae676b9be0869d512a168de9e9d947
SHA512 aa0e9b70f8bc6e876b55010b3b23d54233153e8e75097f5789b1167f817bf46f8a2115032f069201259907673f368767c65a9cbe88d2159ceb623edb9f2e8f22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7789a02a30460ae9c0ab8278198665f1
SHA1 f8d70bb57332d96e31fdbd196745d122170049ce
SHA256 74abb679f74953003220e5852e28a2841bbb1b8358ee094c3153e7ec965ef672
SHA512 c48b73950b07cdaa286835e9e5be71564ff6bd7349faaf2b1fd26a53862f9d9729481cab89c70bbcfbb208f8ebf11fb7c8c7022efe0331f2a590fda501fa09ee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\plusone[1].js

MD5 fb86282646c76d835cd2e6c49b8625f7
SHA1 d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0
SHA256 638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109
SHA512 07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e2b8cc33f1dc00a3045000a5ac6424b
SHA1 cab4b9b9adf62d8390b2f81cf17b1a72d59dda05
SHA256 dfd7812b26435818b1bad96e0252c2b51b9a9168ad09f99780558b02631c2e57
SHA512 8a4d3854a8584d29fe30e2125f04feabaa5067d535531c9ddd76c1024144d753d90ce3e2fdf1ebf009ab9d788b7c48d8b74e4e3770bf90c0b3232639911d4a7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c3c84dfff04409b2e0ef0565ae4b7a0
SHA1 09e69d349714f80786cef5a3512a6f48e514cb26
SHA256 13c5b82a7df3e78fa867ca48020bf5928f7a8fc2d0670894f007429d99a4081e
SHA512 b53605ea5e607edc11efcb7f4b8502b1c3834ac07d9e0de517872e10bfa3a2538ff7d49e9fdca2eef613e5cd13488f30b3a11af3c40c0ff477085e25eec87fce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 599857a40e6b8930b0ab220f69e1996e
SHA1 aa4a1e1a4218ca6e9174a77b727dec9c1a0fcd10
SHA256 08e4a46bc90e9deab8f19c261cae4229b5724af9c19ff1a85ca2b40e676d8176
SHA512 b2cf36410b808f51d80cf047e9ae336984a1f3776ed1cc72aeea3c6c994d2504705ddefca0464ddfbae1d1e65b1dd6b7a6654b1713fb382a5d4cb1d66a80b43b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cbee3eb08aae37adea5d4c7fd0560b7d
SHA1 8f1083189edd70a3ad163bbc4b24e4bfebad8fdd
SHA256 4a21c87eb06b8cab796626e731857bb8a2c6c716ad0ca2d4447df0f52414f084
SHA512 8bf1f351d6a3210f4df0bdca0a971fc9b551a81f67015c8d75c11c3cf84b66b0f13f3c8067acbe18018e6ed38d12bde038964a51f40f49530044563d438c5ab0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 89ccb22860ef81833f849e7cb4514808
SHA1 21cdfc48705fafa856ed3b2facf6549e42c0c81c
SHA256 bb137fc10e3d6b8ece8761d22c9d21cf8e20c4cb9d6b1ab7710758900dad7f21
SHA512 7a0a5bbb4a49cbea5693975840d8e79565e5f073b07bc7ae6617d959bbdfe84ff444ddfafe82e8f0facfd20a6931da19bba1a478e50a5fbfd9f2d07267bd354f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dd4beb91ae9dad8ecf37e2913288a7d4
SHA1 4184716ae212e456d5878af3d1fc2a40c8005e89
SHA256 38193ef80eb5ce162f29d1bf40311e63ea2fe781de182309f79737c5fc9fa2d1
SHA512 bdb3d5499dc178d000efe0be0587d561298980c08eaa9a8f3140cec71ffc432a8a98ebabaf2b30e7801a8e6ccfb6966acb40de6be7c09b7633e494137e5681ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 33df159f061ae298d8a421807218df82
SHA1 a1c868b9f941e5ed19af9b4387a8b2fcd5ac03bc
SHA256 76e712aa0f8e50e4e9b22ae3d89925b4d88a287ad3a7b1c76f80c3326e6fb364
SHA512 774280d1332433a9e3731ca0a45bd3af323c0e93ff32594c4b9439a60cfc78e6ccaa73376d8e7b951fd9efce4b22ebd4ceed5a8d96a96810054f36e9e7fd6719

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 399a11b846d4cdae3ac407c285e06216
SHA1 c5bde03c1093a5c01b85d793895e210e7564d1df
SHA256 82a0c0bec79369d086a4d37b95287a713e57e61a177394ef621dae71c18a599a
SHA512 16924a597f64d8f834e60db72cb2341c6021cce50773ad04c3e737602d43f4714775ac9345ee4dc105a64e3fddd8167853f400ae28c6e189081af527fad5717a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0694e726428fe9bbc31d46a635492486
SHA1 a01bc2bbaee2e09198f46d216b551bead7d24690
SHA256 65ecad92823e954a409497365fd897c607c5a1da00d2d372982df42e29590e0b
SHA512 7104279b92243339dd55dd5665a7ac8006bcd5b415efb55f9b8dd00a672c01781bdc185a155ef1250146e1d558849fc3998215ba5a605c831ea63ab4a2fb5496

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 247b734fe3d6db5c6b668f5297a4ca91
SHA1 79a9ba5bb89b76769d3929cec86a5ab0c9a8a343
SHA256 12d4959519718eb41be84c2c81d2fd5d99b6fcfbeb78d195fed2b41eca1d4700
SHA512 9fa5eb40abdbbaa17b5f0de8f8c2b8eb624cab583f55752b1c12c15123f52dffb7a779089c0864bb626d35b6891bd884b2e5b9b68691a60707941ac0a0505294

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84a99003e66e174db3986bdb6b5f12ed
SHA1 7cf1bcb0e9817b8af2ad1f64f46b26b159ce89f3
SHA256 895c047b54744a2bcf829555e131dfcfd0dfdc8a5a6f812ae6c27fdb93d354b4
SHA512 a9091dd4c5b8de24a3a7e4b856f6eb36780e418758091c9fd199200b1571753752e0e8d0670618e47e0b13c86694552554eac9df5f8c053f330566736b9510c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a194bf607fac744936a2c154d641004b
SHA1 89d34dcfe1bb4abd08ac11a9671f5c433b2ee081
SHA256 10c468b1b539abca854c7f1f157f3408ef768ba4bb2021363c772879abcc6ee0
SHA512 3a41bc7359924ae7beda1b06a223633e0745dc7e4d7fd40879ad003d9eb04050268ddf4f1553ab89e3fd871615e2d659f9a4f9bbce570edfd369ce78bb23a643

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 39f39e1efc883500b3c3680c69f8c119
SHA1 ff31e64a177b46e7486fb634ca43ad70ba94d01b
SHA256 b030eac37cc404833f9475babe11464883705a831506209d1d062a208f2cd997
SHA512 95ebdd0c984ed59faeffb1bc0aca9a56ead226fefdc3e5db24365f1ca33f110ad08f46fc990183ab2b205b21ceaf20971ebec3fe1626b94495f0f0fc758d8035

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a50e729e89a2000531e4916d58469813
SHA1 aa59354c27f6e6283293318cf5578be1acde9c27
SHA256 f941de128bf700dbbea91983be7053e4f50bc632e95b301f66b8e2531548bdac
SHA512 6d0e0cc0afed579fcc60701542fa6f21c8da3c0f39251527d136f4cc93d70573d7ee5f69850578676c7b2f866f814747a5140ad899e51e798856b1cc58958693

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c042bb6811085bb4a68fb9dbdbc6200
SHA1 b128662e5c02f5729269053339dc313c51ea3a78
SHA256 b5358750ec5e8b9623c6cafb20b1fa653812fa4f35bccbf3ade3392c2923f62c
SHA512 144a7207b0b57a6596846103a66016cd769c7c6fcd12f5b7dfbd7a32ccf42307aa3cfa5933771f966fe943b440b8fc277435b559282fa0bb06dee1b8ce98752f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67229ea759e409d55741925b58e04a55
SHA1 4b56df0d9d0789e500d4bdb4114225ba4efc08fc
SHA256 d3585c824a0cf078ebcb3df36d23357ffd3bdcb7ec5d07bf7f531a83f7f22a0d
SHA512 5bfa86f969acbfba7b0b3c99581aa31c01c3a9fc68fe4195ce3f67ab8d220c4b740af16196d4389101fa8903e22f72e0cbc13d3bb255ef1c38533f0ab3f5e915

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a756650bd646fcff42d03699253fdbb8
SHA1 ac1f8359e3c1c905a152b599a8cab1a4ce019162
SHA256 dd2cb9b5613d292cb101aed6e4b133b283552695502af0411b4265746f03fd1f
SHA512 c3de4bdd0d2776d7225952a6a743225961f50793a1dbbe7eab81a640710a1ecdad5e11a66223053562bd5e233a97fb4facfe4ef6be26098142552dcddb84044f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2fa42444b20447ad778c5e5734bcf802
SHA1 98fad140abbb7a2abacdabca2659cac5281dcbaf
SHA256 080070e7245de9aea43dc1460629ddb3a1970194f93c262f6f4e05fa4d222fe9
SHA512 0bd22b5a64e3958573d74ba396a89e781088ab864580c02526e91441348dcde95df28b03eb6a3e6eb55c89d8cf3188cbc7e05f7abc1bada15705e6c42629ca85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e2f339e2126865e3205fffb1800559a
SHA1 2424d6472903788abf749654db6185dc00af432b
SHA256 8f308f25fb1dfe8f13273e5d014827596e65d789e684fcfcc421e717c6b76396
SHA512 847e1946dad42b3732a797a79075fd174b70ff26f6db866436a290310cba65c87a51948401843db65ffaa69ee12a99d49bc2212227272edf59425b7a496e8dab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f90e70360c445346c6c9f6f40c60449
SHA1 40a8b846cbea22249f0b45c686db9d297616960e
SHA256 b62ed9cb4ec3eb087b777b8c683c63062ef225dde1c937c973d2e77490f160ab
SHA512 16a4d4034a59d2f46f244ab77515979bdd4d46a459a04b58c84a2ca93913a1f416890b21c6d49e859200e180e96e6679f8f9567f989afe539dbd2b7cf69d785d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d3956867d90beef7ba3c79fdfa423da1
SHA1 24c7e280aa96d65012c9234a6ad3d563cd370b32
SHA256 1af9203237b7f81d19b3e744ba2ab5f52ace24231a53f94a2f85d4ca7fc9966f
SHA512 f842d0099716e77b5d6c093f3234729ae9f314cae8e894c30a215327b8e73a37e2eabf4ba48b938c1aa57cce5e465ffc84b133031732e121072b09357b831901

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 694330170cb3abc837c4c3fe4bf6ac6a
SHA1 cccfbee1655d2c4d378bf225e823f540b3a9b6f9
SHA256 650e1f3f0c40445160acacca20947c0059bb2badb75613411320163d97b24590
SHA512 643e08a1d12333415921a98e171fb0cb3059f7b061cf416778490059d252dae9a9b78a50ecd8eff58e21c547075767013fc2c19f75c93deac92585762857b1e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 4d011efdd6476563e8bb212a2aa5314d
SHA1 26ee6e93d7ff930b7e56285581b176e107b69b32
SHA256 97a5e565bd7e77ecfbd9a0bb6c3107f2913dc81036cf0750c6c9b2ad59c6d2d7
SHA512 271511bc6fe5cba8dd9d787989bc0298b7a305595358dd2fbd9760bfd6d52d63041f9c6464eb1c3e370feda3f540dd204078baadd8cef6838811185ece0c999c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f9a929f301acee96035617d854dcbd9a
SHA1 a8536d490481baf8b13c7fa1c2db560e59256528
SHA256 5299fb664c9c198bc4613eb46896db409463cda421584974a63e0ff60038932b
SHA512 bdaf2d54c0ebcd88d62e1b749ff8114a94676ce411c0bfc556668a86d3b62f9b6d52c22a0923994a8e60e4cd0e057ff2d72d1d421ad7388c63891d0372c32503

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aed108a5297efc25b687ee100d92ae8b
SHA1 1540dba41689fb30cba9c268b79c8c02669d589c
SHA256 90f14788a9d239185da4bbb71264439f89a323e6513038aca7de4e476f6c9b81
SHA512 8c65affef4c8ec23028c2a00d3644f7a763b1346e7c89c5f13401e12b8d6c485dc3487da94e8647adb6fcab8de3e1a7f920e18bf08b01d5954adc934fc37a01a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 684479f5f030cdfd1aa11b36b1fe52bb
SHA1 b67961aff106a2faa880db6a9a39aa64de234668
SHA256 a956a1b6b93370d41f69b2a092f032f5b074c67598e8ba819679a2aeec5ec15a
SHA512 5e45905c1ae5669ea48f1062cb552f660616220120ab166a8a4c839fa3db5432f41e90b3edbcae074815c3adcdd9753c89632267b89a168b29fdf6410b61a25d

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 14:31

Reported

2024-05-10 14:33

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

145s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f965367145ca56811eca11302776e6c_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1636 wrote to memory of 4836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 4836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 4060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 4060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f965367145ca56811eca11302776e6c_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe410b46f8,0x7ffe410b4708,0x7ffe410b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9313202642959051043,5843021105931778455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,9313202642959051043,5843021105931778455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,9313202642959051043,5843021105931778455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9313202642959051043,5843021105931778455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9313202642959051043,5843021105931778455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9313202642959051043,5843021105931778455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9313202642959051043,5843021105931778455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9313202642959051043,5843021105931778455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogblog.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.201.110:443 apis.google.com tcp
GB 216.58.201.106:443 ajax.googleapis.com tcp
GB 142.250.200.9:443 www.blogger.com tcp
GB 142.250.200.9:443 www.blogger.com tcp
GB 142.250.200.9:445 www.blogger.com tcp
GB 142.250.200.9:443 www.blogger.com udp
US 8.8.8.8:53 www.linkwithin.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 9.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 216.58.201.110:443 apis.google.com udp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.200.9:443 resources.blogblog.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
GB 142.250.200.9:443 resources.blogblog.com tcp
US 8.8.8.8:53 s-passets-ec.pinimg.com udp
GB 142.250.187.225:80 3.bp.blogspot.com tcp
GB 142.250.187.225:80 3.bp.blogspot.com tcp
GB 142.250.187.225:80 3.bp.blogspot.com tcp
GB 142.250.187.225:80 3.bp.blogspot.com tcp
GB 142.250.187.225:80 3.bp.blogspot.com tcp
GB 142.250.187.225:80 3.bp.blogspot.com tcp
GB 142.250.187.225:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
BE 151.101.8.84:443 s-passets-ec.pinimg.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 storage.myfreecopyright.com udp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
GB 142.250.187.225:80 2.bp.blogspot.com tcp
US 3.5.8.106:80 storage.myfreecopyright.com tcp
US 8.8.8.8:53 developers.google.com udp
GB 216.58.212.238:80 developers.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 225.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 238.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 106.8.5.3.in-addr.arpa udp
US 8.8.8.8:53 84.8.101.151.in-addr.arpa udp
IE 209.85.203.84:443 accounts.google.com tcp
IE 209.85.203.84:443 accounts.google.com tcp
US 8.8.8.8:53 storage.myfreecopyright.com.s3-us-west-2.amazonaws.com udp
GB 216.58.212.238:443 developers.google.com tcp
US 52.218.216.33:80 storage.myfreecopyright.com.s3-us-west-2.amazonaws.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
IE 209.85.203.84:443 accounts.google.com udp
GB 142.250.179.227:443 ssl.gstatic.com tcp
GB 142.250.200.9:443 resources.blogblog.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.187.225:443 2.bp.blogspot.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.187.225:443 2.bp.blogspot.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 84.203.85.209.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 33.216.218.52.in-addr.arpa udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.blogblog.com udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
GB 142.250.200.33:445 lh6.googleusercontent.com tcp
US 8.8.8.8:53 lh6.googleusercontent.com udp
GB 142.250.200.33:139 lh6.googleusercontent.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 img1.blogblog.com udp
GB 142.250.200.9:445 img1.blogblog.com tcp
US 8.8.8.8:53 img1.blogblog.com udp
GB 142.250.200.9:139 img1.blogblog.com tcp
IE 209.85.203.84:443 accounts.google.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.187.225:445 2.bp.blogspot.com tcp
GB 142.250.187.225:139 2.bp.blogspot.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.200.33:445 lh3.googleusercontent.com tcp
GB 142.250.200.33:139 lh3.googleusercontent.com tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 142.250.187.225:445 4.bp.blogspot.com tcp
GB 142.250.187.225:139 4.bp.blogspot.com tcp
IE 209.85.203.84:443 accounts.google.com udp
GB 142.250.180.2:445 pagead2.googlesyndication.com tcp
GB 142.250.180.2:139 pagead2.googlesyndication.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_1636_TQZTWDAOBYZXIMSW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 24878c405989cba26aa5699fb2b39874
SHA1 e0b66551053ae0fee8dc10f4bf61a7c452d39132
SHA256 0d2328cbf458d9f9447e77ba25fb0235ee829ecd49396b7f9d9efe1145dab10b
SHA512 b141b0ef4e8332865a2a233883df1c59b2c42bc6df91ed50740456ac473e86db7a4509b140f6bd141dd5fe681db0df8e942ec4e4b86578543f338e99a07bd69b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e31e720-d31e-45e9-8b11-4d156401e50f.tmp

MD5 b4e5c6b9c0e294b95e32d9fc5687864a
SHA1 e6c6f4b0ef87d37c72150ab77c2a11ed1a359121
SHA256 9f368fa2f3f5d43c434c9da88bada9ce23d83056f1b1ea96959d088cff113c4d
SHA512 2c13c420ca919559054801fb0952f17d73594fa491cc9ada9bc34aee2343a478b83fb5a36570a277ac6d5db146f54f31721da7e794e1cf146548d6907576079c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5482181c44900f04c92bd71156cad71d
SHA1 4417ce96a71bd236f0c1836480fd9aae2ad5781d
SHA256 918c9ea24b814ca159777cf6d76cda3b8433db2e7408ec3506dedfdc06f712ba
SHA512 8e18dd3a0ebaa6f3197517e5e8ea40dd33264c97c5aaf29382c41237a2b61a8f9b3d3d313d30c7bd7c9532e766ddb693521c0bc323f3a0a6bc499a86dfd2e220

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8d6dc7ae63443fa93f8415a5cbbe8e1f
SHA1 64b8c789ed3c038f2c3b4bd1a2a4c51dee539cce
SHA256 feffde634bf71976f322e0b7ea84ab94be46e5177409e2cf33ed830a24fabd8c
SHA512 f3056573a2d50dfaf7bc64cf9244ed340988e6183448ac2ffd7c5928beb290bd882bb51fefcbc65b39a7e0fcb0c10ca0e5063f8f4179e9dd5fcfe18dc4045f95

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 91b0c68054aeae65cfe3c062b79b69ec
SHA1 b5dabb356295161af0aaaa991c2cd7041848c6d4
SHA256 c21f1024381c91480a3fff21147b1f3292bf00c5df7bdc5d73fcc00b789da66d
SHA512 f19193f4accd7e19ffcae8876b692a993c9dd5e8d3cfdae085ed0a19e5585366aa182143d4ff4d35c36567c82e8be5018df4d78408d39959e3e70206dbb4ec67

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8f6cd75d0254515d2f717b90e6e643e9
SHA1 be7268f9e3f326255d16ecc47539e7b1a100e054
SHA256 b9b2f0c3be8802beafcc6587c78be073556ede9d9435b2285f0229260a9ed3b9
SHA512 d6e53e0d7da839e0bb18dd967809811e6c132e926dda7a1a82c8ab05e8da3908e825be53e9508c2c1690de97a01ea31afc40fe11f5440a7d4c8cad66a3a8abc0