Malware Analysis Report

2025-08-05 16:07

Sample ID 240526-edsm9adg9x
Target 743dd119d4021aff03391c17c7b5187d_JaffaCakes118
SHA256 c65502c937e81a3d493d8c999d3c77099230328773f346323d95b6ad36b46a07
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

c65502c937e81a3d493d8c999d3c77099230328773f346323d95b6ad36b46a07

Threat Level: No (potentially) malicious behavior was detected

The file 743dd119d4021aff03391c17c7b5187d_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-26 03:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 03:49

Reported

2024-05-26 03:52

Platform

win7-20240221-en

Max time kernel

130s

Max time network

144s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\743dd119d4021aff03391c17c7b5187d_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422857260" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f847b4b2d4a9347a7a4028c92b8509000000000020000000000106600000001000020000000e53723e7c8b839c0343546a9d063c5677fab729d954ab86254ed439668bdd206000000000e80000000020000200000000f6dac8042eb9b2b482c7c48384e2bfc2e81576ed865cb6f244feac5f2342c0220000000419fd5c36c1551777a1bcfa9414adbe7417ef2e65a18eff6b91f5acb73888d084000000090f24af95498a4fa9962cb5e62d7e4a4bd94d030f32b3151e6806d9afcb305a5861c947784bb5e8e6451b25384437899facbd9c05041d1874bbe0a601c03703d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e08852da1fafda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01F8EC91-1B13-11EF-82E1-DE62917EBCA6} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f847b4b2d4a9347a7a4028c92b8509000000000020000000000106600000001000020000000250c3cd7dfd166dd26665a76c13112c6e145becc260cddd4addef72b7d3ffd44000000000e800000000200002000000034cb02cbf235c21be9d09ad1a1fc0a59f471fc69f3d1d2e72e17a55c40b55eda9000000021695b09545450e64e51e4f1f35cb616dc44c2654cbf227efc0cf56899552e74d8c29aef62555d8e9a213f31e4bdd08a507dcf27470f4a1f3749fc32d9bf94d1f638f2c4600e916ef16e1f3c930c70104c576f72cd5e0f88df34c8b60abdf05a900d922c4fd242153b49c538fb88499c1210761323372ecf00ba8e45c0804abff63477abe374a90abe7f375876b7239d4000000028dbde481e15eb2514bc086b6a0e0fbc40d83a657c03fc4e68ac9b443d74eda99fd2a24b5fc85c06dfe257c72ed4230b85b6629375cedc8636fe895b2a7ee662 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\743dd119d4021aff03391c17c7b5187d_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 translate.google.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 hienzo.googlecode.com udp
US 8.8.8.8:53 s04.flagcounter.com udp
US 8.8.8.8:53 www.quick-counter.net udp
US 8.8.8.8:53 www.mypagerank.net udp
US 8.8.8.8:53 xslt.alexa.com udp
US 8.8.8.8:53 tateluproject.googlecode.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 dl.dropboxusercontent.com udp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.200.42:80 ajax.googleapis.com tcp
GB 142.250.200.42:80 ajax.googleapis.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 104.18.10.207:80 maxcdn.bootstrapcdn.com tcp
US 104.18.10.207:80 maxcdn.bootstrapcdn.com tcp
GB 163.70.151.21:80 connect.facebook.net tcp
GB 163.70.151.21:80 connect.facebook.net tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 172.217.16.238:443 apis.google.com tcp
US 76.223.67.189:80 www.quick-counter.net tcp
GB 142.250.187.238:80 translate.google.com tcp
GB 142.250.187.238:80 translate.google.com tcp
US 76.223.67.189:80 www.quick-counter.net tcp
US 104.21.12.69:80 www.mypagerank.net tcp
US 104.21.12.69:80 www.mypagerank.net tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
BE 173.194.76.82:80 tateluproject.googlecode.com tcp
BE 173.194.76.82:80 tateluproject.googlecode.com tcp
GB 162.125.64.15:443 dl.dropboxusercontent.com tcp
GB 162.125.64.15:443 dl.dropboxusercontent.com tcp
BE 173.194.76.82:80 tateluproject.googlecode.com tcp
BE 173.194.76.82:80 tateluproject.googlecode.com tcp
US 206.221.176.133:80 s04.flagcounter.com tcp
US 206.221.176.133:80 s04.flagcounter.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
GB 142.250.187.238:443 translate.google.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:443 2.bp.blogspot.com tcp
GB 142.250.180.1:443 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
US 8.8.8.8:53 accounts.google.com udp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
US 8.8.8.8:53 translate.googleapis.com udp
GB 172.217.169.42:443 translate.googleapis.com tcp
GB 172.217.169.42:443 translate.googleapis.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 s10.histats.com udp
US 104.20.19.71:80 s10.histats.com tcp
US 104.20.19.71:80 s10.histats.com tcp
US 8.8.8.8:53 s4.histats.com udp
US 8.8.8.8:53 widgets.amung.us udp
GB 172.217.16.238:443 apis.google.com tcp
GB 172.217.16.238:443 apis.google.com tcp
CA 54.39.128.162:443 s4.histats.com tcp
CA 54.39.128.162:443 s4.histats.com tcp
US 172.67.8.141:80 widgets.amung.us tcp
US 172.67.8.141:80 widgets.amung.us tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 developers.google.com udp
GB 163.70.151.35:443 www.facebook.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 104.20.19.71:443 s10.histats.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.153:80 apps.identrust.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
CA 54.39.128.162:443 s4.histats.com tcp
CA 54.39.128.162:443 s4.histats.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 dd3850d9ce5a33ba453ba4d1dfb4ba51
SHA1 df05b044dd14e7d009aad0398686bbfd6fff1491
SHA256 e9e041a83d7f3dbd6adfeda50b7ff9d3fd1abfcfb4fc5906d481c33db7072b85
SHA512 ec27ccc61d0133a76a612d5ddde2c6193f96302e17f66a75da8e1ad18ee871fe6b307e535317726449dc724331d4f48376d03201ad8d9dc2985aa0420d45b8e4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\Local\Temp\Cab1354.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar1474.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UA1HZF3D\platform_gapi.iframes.style.common[1].js

MD5 7ef4bc18139bcdbdd14c5b58b0955a67
SHA1 afe44fd9a877f81a3c36f571c0fc934324c6cbd7
SHA256 192bc707852c5986f930528442d88a79e5bcf4513aacc2b722a3c5e964501838
SHA512 6c2920e80e4d5059588a32f75bc2b5dcc19f8d68224c0935d74f9fbf49476ca5b1ce43c279768f3d36871dfcec39f36db3fcad559c2f93cc540154cdbb04dec2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JB8Q1DZR\cb=gapi[1].js

MD5 4d1bd282f5a3799d4e2880cf69af9269
SHA1 2ede61be138a7beaa7d6214aa278479dce258adb
SHA256 5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693
SHA512 615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\2621646369-cmtfp[1].css

MD5 9f212334462c2e699353dc8988690a19
SHA1 2e25d1abe33ec5ebf10e0a6b055e38c9671802a2
SHA256 2529a8451bea93302e41dc0fad03f7550094f4ef5ec4f3800f28c2639d5e2789
SHA512 58e906a50f8b654e79b242f1323dcb08773937f723d01caca4f675ce2091eb20caf2fce23a7a15443fa4a6643716662304d83b95ac7b7b64d588168b47ce9407

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\322573858-cmt[1].js

MD5 167d9aa881dd5ba4ee338e71edb8ef09
SHA1 724925dfb33aea75abc65e6a8e0d578b2d240fb2
SHA256 5d00549b7f377c70eb184edecacc98280166d1eec3b40f87278b5a4fb3d8df21
SHA512 bef39ebc3de124b1314a91a539676bce58e673b48439d98c783182043355ad6d46e22cf89e25007ce91c3aaab9fc517ec133dc711d9e0baee3b6f1eb80397800

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\xHRcRG3hME5JV_pg-ZaAYPpNCN98PmTYbPbc_ZBXdcY[1].js

MD5 40dc1ffdce51e05add36d47c158ed1c6
SHA1 b64e93a4cffa71455658994e39cf5b973b7ea181
SHA256 c4745c446de1304e4957fa60f9968060fa4d08df7c3e64d86cf6dcfd905775c6
SHA512 4f8ec769f3d551c497f59088c423cfb1274fecba3ff873ca7f81ebaf891f1e492014e5b34356cfdbf32e24be1ed64b988881b6f2946c5e1f2fffb4fe8011df0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5e8f9f771d90d70e461f25acc8c74ef4
SHA1 6aaf1ec9863dfca66f90e0979f1da4528adece6c
SHA256 ddfae3d6f176b4bcd0c4f7df53b72cbffd3fd238c90e1ec3cf1b055a64ca57f7
SHA512 94f262a487ba45f1a91ac62ee483db3c2f76bfb92bdb494c0aa9d5a86690a9aa50371c0f8040d9b447a15cac27123f6ae6f4d68a9b85b3b163a8c5edf9aee5aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f7c83776bfe038c98fd7c0eb3b36b4c6
SHA1 f9933751775ce4b2f816fac58f3dca8288956622
SHA256 d059f346f10e8982199a790490a81f109d5de37a665630df676a218b12de5f97
SHA512 0e470174398b23ea5cc74ec510b37cb8b9e10add23067c8f395de91f495f679befcad5247a3735ac2fb9c436a79a7a6e48b41fc14c3848e1a1d375fc502af7db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bfa3f46b5340e2c609ac93995876893f
SHA1 10ba02d61c0cce138b642b881c5c8190dba4fac4
SHA256 77f5f347e2fcc19d1acf1115e778bbfedcfbe6f3ae74bbc8265e1edd04ebc74d
SHA512 44c490c331ffa7fca50a62987e24a1de448d81e114e0457f62022db64c6e083d438f02b9c7810b0c2b1970ad68a4b7e5a0a6ea1b1c29121e75cd9b3ca7ad286b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2cf6d2c778539642db4b652725677539
SHA1 042d8662e1506b32c55e7ea7ce6f4c98535c41c3
SHA256 895c0013c898be25e61463f229b8799ba6563fd4e50e85640aa052940e6b2b7c
SHA512 7e295f34ba1f2082de786ef7b724db70038c5316f301246abed2ca898064f94343432c3223e9319738ce9050afd7ade88d9caabf4430ff745cd5b0481bcbb614

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6623bad8da08559b349979a78c434014
SHA1 33c677b76a4685c2e2602ebc1140466becb703bb
SHA256 0dd36dc4667f39d84f8394f9825e367c35e3b6ba2b4b009c2c815411319bd279
SHA512 07fab26cf1830bb2c16cf8aa47202a83777a07fc4d20f51bf8763760d1daa717e7af4bc0468d66e0b05d53f99d9ab343dc3c8e08c5e355d8ad60a4049b2dde09

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afe65f2f35dc199fb5ffd07bf9201d8c
SHA1 4dfe873ad9e1dfdc58a1bd0387280245ca0008de
SHA256 32d37f712e3bf83d5bba9f6b6f14d6a3bd979a1ff8eda15311362b1f30fab8b0
SHA512 50a600ffb439817ca98d645732b17d23d862db1a19bd4c51de685edeefa29fe5091338ba7fed118c05e3f62942b5dd94a69cd3d3a08573525d4e73206d3b667d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e34b7fcbe1e15fce0acd9aaf9e9fa3bc
SHA1 cb6f6ad8e06c4f14fbb1f51c51c3fc44372cb3fb
SHA256 fce3be561de7ada7c8f53a4dc018672fa86b3ce725a771df0ddfcd824a65f86d
SHA512 b0bbe73f6e1df76083f94805b1c596db139efe83e88c20b0b9fd385ea16cb16606e46e26e7f658efb53f5e43a7cdc39fb5eca79ce3ab9bdb5801358258b22b2b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a4f35ccaa12f83a405c748f73397ffc
SHA1 6ae412886d3e34546cd6142026a12ac220dc00e3
SHA256 88cc3f6e21677fcc480a5928e8ef4ca2f7871ccc93fdbfc9081ec80f4f3707e8
SHA512 c78124049f4141aaa44326727540bd9dbdc84fe8c1c54a0f70f4ba0642935f66f61b55351d3557f3c43cccbde05c28444eda42b9571d6d4c69c0668e41febf20

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 89c8e24fbac6e56c4a724d9b1d71b93b
SHA1 d8bf02aeb927ebcca8f8208e422a5884e0f61823
SHA256 b66f9188fa11d60e0d743d494e1c850e0c022b73dd4c925de687e8b7dc516081
SHA512 5e39393d9fb9863ca7d28a86d7450c0c1fcdc91dc112eb972e2fb0f8777130e85377547472231ccb275e83a591447babebe222d18b6701578b406c42d8e6368d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7e5910e6534774385b0b779a60234a15
SHA1 9ace83313a639e389d64e8ba16d88f9f5c0e3788
SHA256 0a9687c27c5ed3ebc0526c617953189fc43c4ce0ad325c14c9faa2d3d6ff5996
SHA512 a624d6e0e547742310ccc0744923e38f701361127885d016024194eb1f250571d0ef6e97583091f570cf0e0e408566d34c42701beceb2db8f483ddd493e978ad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ae77ab268cb536fbee4da8246a33c18
SHA1 baafba32963739b2dd1dce31ce4a6355367e2855
SHA256 a3af53f62eee017cb851001ce81ee04220e1bd7b234a3087fe1da8ac9ea66f70
SHA512 7a5a67f4ba85de109919bfbf7821060b5b2c71f29450e8b3389c778ae2b1f7d485e4240a304c634a2634a9fe470d129dfedb6c789bb5a4afb5a1ca46c3bc7704

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ee25c141a63c5b06f7da49e35ab0051e
SHA1 9562f299c6cabfadb054cf6b905ceb9f392aa434
SHA256 03b3feb5b01a494352bdf247a2b775f5e8bd4dff913a3befc4c6f202f0a1751d
SHA512 77ed45d72058c95dcd1efcae8ead2044d4577eaf851f9b9a5b857fe1e269c4e8f13445c0d9b83f668c62fe38654eac8a5d3074d6eb92e887c297554d670c0ce9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d125d6f6b5222de73af1de59b5e4cc0
SHA1 021c7e31a4409764b82453970039290793b9b2f3
SHA256 ca0cda6bb7171f562f43815d51656121fcaedff301a1454c34137d81245f844e
SHA512 d7f75e2ff10f25e61222184d293aec0197e0d835c5e2ad4bb3e488307bb0d2ca713b38c871c550cf81c586580c60930f7d2411857868737c9d4935d5249efff8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 dfa6c0229d3434a573b9d97a9ffdb2cf
SHA1 69a6c5d5f69a90ed60c1951b69d5cc57f4ebc46d
SHA256 83497f220a09f8d7018e5fcca3bdb961eae50b19f005753e273dac71518a235a
SHA512 50fd11173ea87e7b36e5d5d107a4b6df577e3ab5c34a25e9121f5c8b200962bb990bac5be26c7562a1702c6f196512a3ffca7748c65423547905b8b274cb9891

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 922e09a14e07ba1338112316ea3a9034
SHA1 28f4faf30bb54af2ea3e4170907fce2bfd92e6b9
SHA256 e87830a4b64bc8bfa2167e1cc5f5bb289be0f6b2b53e7b62e855456c6d560e91
SHA512 e42fcb302f78346e89b95d5ba7fb2e77cf4cfe4df74420262c03e9db22ffd85ad3667cd60595f481678718e89db2f2f120c9baceb31030a11a6b73cb4e999e7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ead2182cf4aea4a28e75f77a5bbe839f
SHA1 9644de3a57c853d53f185476e2d4d299b4a494df
SHA256 cff069b3f815696de7d5ea5f323cc1dd67b3e6203930633068519a2b43ec934c
SHA512 8868865bb9dee8c5819439610b295746a17d7aea5b06d52f161e1ebc7a7dbd9a18945dd7b015ea6a942fdff717508712d9a6b415f7f18e26f417990314299e44

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d4ee85da9cddac068f5395458f7639d8
SHA1 1bea25700470f82928a65c6eb91b1b581b9993d3
SHA256 2fa1c2509b16fcbff2f89488b29b8585c58088d5de2e9695f87ab041645e1ebd
SHA512 d009dca3b043dc45cee343929d6296cb39a846d66b01e62176f3596f8da0c9e943520239492ff3cde82b85f0c9cf8b4a69dd5c8f09786473f73c5595dc8b9c41

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 088de930901c967ba750803fa9e45534
SHA1 8044e29dd5252c626152cfe107e4b222a52a2d9e
SHA256 888d2998f7acfb2e5f196e5056a91f77c2f1ed7977893b3efbc0cec183d7f7c4
SHA512 c751cc7bbb2a59dd67a854c5334063b02c9ed389bf74ea9544645abf68d31834c17cb186efec7ababf9fca6e41057c7a01dafcd80cbbd0defbad34f2ab62fa33

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 a4707f5fd8b92321919ef6adb5ab0cf9
SHA1 94de6ce622e9525b24b4d099e7feea1f91b44bfc
SHA256 af4d25f3faf75dd63a22288c999ff3cddf6694e5250d882d0595374bebbf2396
SHA512 139f722c014ddff5c432d877f676717210dd2d270a9e02693685757734b2f40f2873926e4f5a2940dc8445cb082e8d3e71933435954b344df430584e2c86334a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3be208628e205818113bddd57ec8f3b5
SHA1 63a245d6047366dd7f747e8c8fd3b728dbf77198
SHA256 f9a9d1655f43064d005602372b096cea53e4a601f2dcadbbf8e4b6bf2b40ee39
SHA512 54ad2186afdab0252553b90a99b04b96be7fe418ed9539f037622c2ded0e052130ffd7068edfad4d0f99c86259605ad11eddef596a45f4f3c3deeef43e21e40e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d106c4fe3b964967eb353c7f2f025c2b
SHA1 1fa878d3efd5641a2d1c62959db0ff3b6d43c3d6
SHA256 87e083d39dd2833081c00e1c7372d24db7dc0b4a20262c75a1d32a3f87ce19fb
SHA512 b2822d11171ab91640fae1cf57f245b613fee93ccb9bf2ee15ec0caf36dc8358f7f16b9474670e4b34a5970558b5e04d9a7ee2c83f9ddb0b1a698f2da56b131e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 418ec1581ca6e8adbe240d1ce90acb20
SHA1 524ea45de82909e051f8626631ae1c7a02a07eef
SHA256 e332c889115973b2b28a835a89ec5eedad3f8b33fd43e01ea6ddc533a3893836
SHA512 e16e561b05074a24d9b64bbb52a1c5362d43c0a8a2a741f1ba263dc166960e62e31881f4518fc0519531cb7178ba4148e0a6ed6a89d4fc3492ccebc4b43207f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e164d6a0b827de2003c2dea4363cf4d
SHA1 718f86e109a79756a7980a04a6742c956db081a4
SHA256 6a65313a0b3906cea35a282fa66a72a02ae3dfb46bb0b8364762d919c3c6ddb6
SHA512 fb394260136a15b772cfb23a999982e35a48226386e9e76a6aaf3564c36b898d2fd8a99055e6e2ed2d28cd5be0d5742e61df497504abfc935c65289a0575fafb

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UA1HZF3D\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JB8Q1DZR\rpc_shindig_random[1].js

MD5 23a7ab8d8ba33d255e61be9fc36b1d16
SHA1 042d8431d552c81f4e504644ac88adce7bf2b76f
SHA256 127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5
SHA512 e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 03:49

Reported

2024-05-26 03:52

Platform

win10v2004-20240426-en

Max time kernel

145s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\743dd119d4021aff03391c17c7b5187d_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 1920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 1920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 4924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\743dd119d4021aff03391c17c7b5187d_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3fa246f8,0x7ffd3fa24708,0x7ffd3fa24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1038681436122284858,4845696630443938800,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1038681436122284858,4845696630443938800,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1038681436122284858,4845696630443938800,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1038681436122284858,4845696630443938800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1038681436122284858,4845696630443938800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1038681436122284858,4845696630443938800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1038681436122284858,4845696630443938800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1038681436122284858,4845696630443938800,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1038681436122284858,4845696630443938800,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6092 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 8.8.8.8:53 connect.facebook.net udp
GB 142.250.178.9:443 www.blogger.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
GB 142.250.178.9:445 www.blogger.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 163.70.151.21:80 connect.facebook.net tcp
US 104.18.11.207:80 maxcdn.bootstrapcdn.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 216.58.201.106:80 ajax.googleapis.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 translate.google.com udp
GB 142.250.187.238:80 translate.google.com tcp
US 8.8.8.8:53 hienzo.googlecode.com udp
BE 173.194.76.82:80 hienzo.googlecode.com tcp
GB 142.250.187.238:443 translate.google.com tcp
US 8.8.8.8:53 27.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 207.11.18.104.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 xslt.alexa.com udp
US 8.8.8.8:53 tateluproject.googlecode.com udp
US 8.8.8.8:53 feedjit.com udp
BE 173.194.76.82:80 tateluproject.googlecode.com tcp
US 8.8.8.8:53 dl.dropboxusercontent.com udp
GB 162.125.64.15:443 dl.dropboxusercontent.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.180.1:443 3.bp.blogspot.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 s04.flagcounter.com udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 82.76.194.173.in-addr.arpa udp
US 8.8.8.8:53 15.64.125.162.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 206.221.176.133:80 s04.flagcounter.com tcp
US 8.8.8.8:53 www.quick-counter.net udp
US 76.223.67.189:80 www.quick-counter.net tcp
US 8.8.8.8:53 www.mypagerank.net udp
US 172.67.193.187:80 www.mypagerank.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 133.176.221.206.in-addr.arpa udp
US 8.8.8.8:53 189.67.223.76.in-addr.arpa udp
US 8.8.8.8:53 187.193.67.172.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 cdn.popcash.net udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 143.244.38.136:445 cdn.popcash.net tcp
US 8.8.8.8:53 cdn.popcash.net udp
US 8.8.8.8:53 platform.linkedin.com udp
GB 172.217.16.238:443 apis.google.com udp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
US 152.199.22.144:445 platform.linkedin.com tcp
US 8.8.8.8:53 platform.linkedin.com udp
US 152.199.22.144:139 platform.linkedin.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 translate.googleapis.com udp
GB 172.217.16.234:443 translate.googleapis.com tcp
US 8.8.8.8:53 accounts.google.com udp
BE 74.125.206.84:443 accounts.google.com tcp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 84.206.125.74.in-addr.arpa udp
GB 172.217.16.225:445 lh6.googleusercontent.com tcp
GB 163.70.147.35:445 www.facebook.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.178.9:443 resources.blogblog.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
GB 172.217.16.225:139 lh6.googleusercontent.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 translate-pa.googleapis.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 172.217.16.225:445 lh3.googleusercontent.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 172.217.16.225:139 lh3.googleusercontent.com tcp
GB 172.217.16.234:443 translate-pa.googleapis.com udp
US 8.8.8.8:53 images.dmca.com udp
GB 143.244.38.136:445 images.dmca.com tcp
US 8.8.8.8:53 images.dmca.com udp
BE 173.194.76.82:80 tateluproject.googlecode.com tcp
US 8.8.8.8:53 s10.histats.com udp
US 104.20.19.71:80 s10.histats.com tcp
GB 142.250.178.2:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 s4.histats.com udp
BE 173.194.76.82:80 tateluproject.googlecode.com tcp
CA 54.39.156.32:443 s4.histats.com tcp
US 8.8.8.8:53 widgets.amung.us udp
US 8.8.8.8:53 dl.dropboxusercontent.com udp
GB 172.217.16.238:443 apis.google.com udp
US 104.22.75.171:80 widgets.amung.us tcp
GB 162.125.64.15:443 dl.dropboxusercontent.com tcp
US 8.8.8.8:53 71.19.20.104.in-addr.arpa udp
US 8.8.8.8:53 32.156.39.54.in-addr.arpa udp
US 8.8.8.8:53 developers.google.com udp
BE 74.125.206.84:443 accounts.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
US 104.20.19.71:443 s10.histats.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 www.blogger.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
NL 23.63.101.152:80 apps.identrust.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
GB 142.250.178.9:443 www.blogger.com udp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 t.dtscout.com udp
DE 141.101.120.11:443 t.dtscout.com tcp
GB 216.58.201.110:443 developers.google.com udp
US 8.8.8.8:53 171.75.22.104.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 152.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 11.120.101.141.in-addr.arpa udp
GB 142.250.179.226:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 platform.twitter.com udp
PL 93.184.220.66:445 platform.twitter.com tcp
US 8.8.8.8:53 platform.twitter.com udp
PL 93.184.220.66:139 platform.twitter.com tcp
US 8.8.8.8:53 e.dtscout.com udp
DE 141.101.120.11:445 e.dtscout.com tcp
DE 141.101.120.10:445 e.dtscout.com tcp
US 8.8.8.8:53 e.dtscout.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

\??\pipe\LOCAL\crashpad_1988_WGURNNEPUDMRJGRI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8e7abc7ce965ef08d657bf24ba53e12d
SHA1 447e29f4ce65c58c23569cde8c70fba714fb129a
SHA256 73e305d7234c4b53567663179bf3f15a457cc8a011038ece645944b06cbf4622
SHA512 e6099b6f9f4ba1fe67e027eacba4e6d001c18097bc96e0fe93d691f7d80c87aae3772ce007b2849d16fc23dcfe062b024acd7e3e4c23538d592637e6c9b6b3ea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6b5f0dea2152bd848b3b03069ae420ca
SHA1 ff0a9908008ad813f3b032eba6ea728b3fc4a12b
SHA256 11043bb388acfc009e3a835cbe47d27de0fa0fc554c75c75112616b496460ff3
SHA512 61a197618babb1dabba131e8aef43738040103c71705330dbc4be8a2fa1502701360fb14a9eaed049125810f5935efe53eb6b870a73739d5fd20887d74043cf2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e0f99e5fe375a7192804673ee8b5272a
SHA1 e28161bf46ff60999d55f4fd368f570bd0902467
SHA256 88c90e558db1713ba8b85f1aa1c8c8809256f2f37699fd41f89a001402261363
SHA512 88cf405beffb8a01f1668799dd3e475977cbc92639f1d2e44ac5135b8edfcd4d24b55994f53b5714a06b38adf7d0ac96b65db4318fcb5d8cfc84e2a7f855aa18

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 18f76a92fa2f91862199f8f092cd0509
SHA1 f768748ab92b36444363f53a8628bab8e0f2f7c9
SHA256 31a1860f9a1ceccd9ea09d1a579e1ffb76877ef5d27a57fe004ccb41eabe81e4
SHA512 f775ddf3b5355473f85316b127249d2ceddb0fd89fd9979fccc20723262ab6e1b032648a7f4c238815c3202b4c63ecded4dfee60b437554477435886755b5f38

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c004.TMP

MD5 90c43c6700d9b0b46321e5da7cc78999
SHA1 3e220687dff85eca0466e7b76b276a1904f76a6a
SHA256 6fffe21fe724b0c6020a4cdc52462c7652721c4685735061eda8d22baba701d4
SHA512 553920974bb41b9ec8256a42a3670ca2b0b41314d90394fa9e3d16b6143f4ed8932d30f030992001d1b884a197ae411658259faf4a979478e05b69bc550d9481

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7c1adaf59126cbc6e76b984d1a1cdca0
SHA1 a1756b35c6f09042d20a65823217115ed7ed771a
SHA256 7038cd39eabf069971c8aff5f5be6eb591714d7dc892c05bf28e321bb517b8bb
SHA512 a918393d970e4c1eee2421abaf6b0034f02841bec5aad02dd6ee63f9a00ade95cece65188ec62a33bb2ab127b7417347e7f32f26bbe4a68e128a8dff0a00912d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ae9c19bf2873e04c1a967f8dbc488682
SHA1 5edb0c6ad64bb6a5c639b100471cd37698281602
SHA256 2f479d79e01a05a588a680918ec901ee2976a94010e797ef7e176f049d588bb7
SHA512 1bf26bf2bd9cc03b46e0dfe1132781a2e7568a56822372544e13d1553c1f52e3d70f4835c5a3c2ba400e67b9b9f937aa1f71f07ad62fe7a41a35db269c0eb824

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 34eca2994eb5c4d245c24bc3b2f58502
SHA1 45170381c5e4df160feb2be8fb9cceb493b5732b
SHA256 eae4f41987b143e6abeaf33fb4b61448ad365bd4e9a8da95631ae35393bddc26
SHA512 57e00ec43905dabb76abae616dd5c169f81aa308b5e413e3f7b8aead301ac2996b2b20a8a370fb3bbb45c83e017b89457b700c588b4a85f9e42a6731db7f451f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05c21b50b2df7c6f554fecfa41a8f3ff
SHA1 fdb19cfeb6431ed01b04b696d8ac67ef6f8bf14e
SHA256 167ecdddddfac1fb336552f97b2ef91c250b474be590f807a86bb830c4e8b222
SHA512 10d971e53ae37c22f12b27c79ff7b2758cdb614fb1c666aa3e0a7b2cb101dd6c23e0754bb3689cd132a8652d21ffc2abc199c53f26437314cb36391c1183a211

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d27509b08c289ae5825ad8ee0801442c
SHA1 0740eba5d3e563eabbcf9e2fdf07c5b2256f0535
SHA256 4dce93a1550e447b5c596ca41e75c0c71393edde564a2b259b5201f3794722b3
SHA512 11ff25c6bf3cfc58d86b118aed8e97d16a25b3c0c93e54e96d5938b98855a76315415c0e7066c3d67d2bcaf0e6367e6ee93e13ecfefcf389e361de1e871cc1c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 6c9948bfc0c6e802562fabea518d91ae
SHA1 85ddf3aa4c35c72b9d79c509cbcf6d8c3f2a2514
SHA256 00cca2d5d9c5aca0423da729e2d62feea260dfdd72675c6941361cd4443ae031
SHA512 fcac668b7cce0528d5d3535bcaefb52282d63cad180cf1a0096bade978420585b5931e827c459ec41853acd2084f4d06e710f563c230032a59ab5063544ac2ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 5e194456b07286fffa4ad3e3661528e2
SHA1 31aab033a5101587cb4e9d78c6bbf2a7f6c8ae80
SHA256 85e934e49d19e13e9d8ebd5e39a7d4a2dcf7639965003e9bfbffce79e038137a
SHA512 632653bdf87433117e77f70b11ba88637e70c249178e620a71611cfc3d4e3edae9cac2b1bb4d9f1c7f862b7c5011eb3d05a8fe7468a27d59f2b2de52863b604a