Malware Analysis Report

2025-08-05 16:01

Sample ID 240526-msbbhsfd7y
Target 7537e4873304128fc17548e6868ff87e_JaffaCakes118
SHA256 312884627785209aa10001edcaa65bc30b4e6f4acc51a99e0c85249ee5d0bb95
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

312884627785209aa10001edcaa65bc30b4e6f4acc51a99e0c85249ee5d0bb95

Threat Level: No (potentially) malicious behavior was detected

The file 7537e4873304128fc17548e6868ff87e_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-26 10:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 10:43

Reported

2024-05-26 10:45

Platform

win7-20240508-en

Max time kernel

142s

Max time network

143s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7537e4873304128fc17548e6868ff87e_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000041fbc5ba8b49832510edb170f8bf84c8c99f200a879074833aa52f647106ed30000000000e8000000002000020000000a11b4aff75ed97d933b74aed6c102864e769d3341cefab102e75212ba9776f2e20000000e098df1a19ba3331da1752833986f7d3fcb5ef5098304da5392fb910cd9c153d40000000dc0e6330b7634a4737d9766893ed737c6827aa25580aff3002ec3ce9c6b3f87b98decbee8896e28a7dfdc12455791858b69a1f6b4a90658fac08ba65f0c6520f C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000aa0246d0fea87ebf702a0b7106b724a81b943085026f28f08d8acbc66f5bae31000000000e8000000002000020000000c28cba3aa3fd887c00cb5322945bf94b25450cd3adc38474bc42cb82951b60ba90000000aa717326f165e236f27e9f78569e7255cc3de53ef0721161b64076a303e2fdc9c5124b7c3d707cfd0b3a7262755f9e8dbbf6716af002e543bafa3bd5d8e80ed42605cbcb8426c8252af747b6f72159300137bfcfbc3cd588b142164c207c1637930147a321ab8575e0c3958bc4b149daa7950f3f0db5f3474c4d71511263e3e05b552b1bd956643a9756c3ed7d1ce99340000000cba2b7af36a17c2fc57a7086687af5967fe539bf2bf379cfc58dbbe040fa2b7ea9539444910429b1bdcc12257489dd56bf507939d074a77038b6549fae7c841a C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFE96071-1B4C-11EF-8B04-EAF6CDD7B231} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e6ed9459afda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422882059" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7537e4873304128fc17548e6868ff87e_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 databloggerpage.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 dl.dropbox.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 i.imgur.com udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 bloggercomment.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 piadas-idiotas.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 static.minilua.com udp
US 8.8.8.8:53 pobre.blog.br udp
US 8.8.8.8:53 www.dinamitou.com udp
US 8.8.8.8:53 img94.imageshack.us udp
US 8.8.8.8:53 img26.imageshack.us udp
US 8.8.8.8:53 www.minganei.com.br udp
US 8.8.8.8:53 img23.imageshack.us udp
US 8.8.8.8:53 palhassada.com.br udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 www.gordobobo.com.br udp
US 8.8.8.8:53 www.uazaa.com.br udp
US 8.8.8.8:53 www.surfandonanet.com.br udp
US 8.8.8.8:53 www.linkirado.net udp
US 8.8.8.8:53 www.eucurti.com udp
US 8.8.8.8:53 www.ocioso.com.br udp
US 8.8.8.8:53 epicblogs.com.br udp
US 8.8.8.8:53 www.meuslinks.com udp
US 8.8.8.8:53 www.folgadao.com udp
US 8.8.8.8:53 pr.s12.com.br udp
US 13.248.169.48:80 yourjavascript.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
US 38.99.77.17:80 img23.imageshack.us tcp
US 13.248.169.48:80 yourjavascript.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
US 38.99.77.17:80 img23.imageshack.us tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
US 38.99.77.16:80 img23.imageshack.us tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
US 38.99.77.16:80 img23.imageshack.us tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 38.99.77.16:80 img23.imageshack.us tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 38.99.77.16:80 img23.imageshack.us tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.200.10:443 ajax.googleapis.com tcp
GB 142.250.200.10:443 ajax.googleapis.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
NL 192.229.233.25:80 platform.twitter.com tcp
NL 192.229.233.25:80 platform.twitter.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
CZ 46.8.8.100:80 databloggerpage.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
DE 178.238.233.182:80 www.linkirado.net tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
US 104.21.67.117:80 piadas-idiotas.com tcp
DE 178.238.233.182:80 www.linkirado.net tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
US 104.21.67.117:80 piadas-idiotas.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
CZ 46.8.8.100:80 databloggerpage.com tcp
GB 172.217.16.225:443 lh5.googleusercontent.com tcp
GB 172.217.16.225:443 lh5.googleusercontent.com tcp
US 104.21.51.101:80 static.minilua.com tcp
US 104.21.51.101:80 static.minilua.com tcp
GB 185.185.85.130:80 www.dinamitou.com tcp
GB 185.185.85.130:80 www.dinamitou.com tcp
US 104.21.3.29:80 pr.s12.com.br tcp
US 104.21.3.29:80 pr.s12.com.br tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 52.86.6.113:80 www.eucurti.com tcp
US 52.86.6.113:80 www.eucurti.com tcp
US 54.209.32.212:80 www.meuslinks.com tcp
US 54.209.32.212:80 www.meuslinks.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
US 8.8.8.8:53 minilua.net udp
US 104.21.3.29:443 pr.s12.com.br tcp
US 104.21.3.29:443 pr.s12.com.br tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 104.18.22.114:443 minilua.net tcp
US 104.18.22.114:443 minilua.net tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 199.232.192.193:443 i.imgur.com tcp
US 199.232.192.193:443 i.imgur.com tcp
US 199.232.192.193:443 i.imgur.com tcp
BR 45.152.44.151:80 bloggercomment.com tcp
BR 45.152.44.151:80 bloggercomment.com tcp
US 199.232.192.193:443 i.imgur.com tcp
US 199.232.192.193:443 i.imgur.com tcp
US 199.232.192.193:443 i.imgur.com tcp
BR 149.18.50.137:80 www.ocioso.com.br tcp
BR 149.18.50.137:80 www.ocioso.com.br tcp
US 8.8.8.8:53 www.hugedomains.com udp
US 104.26.6.37:443 www.hugedomains.com tcp
US 104.26.6.37:443 www.hugedomains.com tcp
US 8.8.8.8:53 www.surfandonanet.com.br udp
BR 45.152.44.151:443 bloggercomment.com tcp
US 104.21.67.117:443 piadas-idiotas.com tcp
US 8.8.8.8:53 ww82.databloggerpage.com udp
US 199.59.243.225:80 ww82.databloggerpage.com tcp
US 199.59.243.225:80 ww82.databloggerpage.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Tar33C1.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Local\Temp\Cab33AE.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 3e0820c6d61bacc891645558e6f110b3
SHA1 cea615785d29761f55490cdce4913bc34658eac1
SHA256 3d42ebd70f570235b4d602d1d681d3efb2aa2a7023619cf9a18a42f83296cf05
SHA512 ce9ccb732224b57aa22488749e2cd4e5bf1c632a249836ebe2d0b2ea5cdb20ad6dd540aa32d1b4e474e3eb0a681315b580b27fb5f5a06a89025c3d4c601d0730

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 80e8399bdb18ad91133665f9712c1bcb
SHA1 801ce3714577bf55e38c0bd2ebc9aa53148bea9e
SHA256 c7d5b8c1e6ee72e8920350bb8ed93c403efca148ed164a59146ba3dbfaced705
SHA512 1e8f6a2c01620606b1d4bafa89208a88cd68a8ea46ac7c69b6b1c733d434de10d576520efd4f44e94df0a2c82d0a220a2c04ae17ac9f7e48f338e4fca3514333

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 beba3522cd7eb77a09fe36abcb252a4f
SHA1 220cb347af597d4f8aacacff27eb0ce64207e99b
SHA256 63c5ec564440d74f3c2c2a161a66a22dbf30b03659f3309419a359ee1f8c0d4e
SHA512 35eb19b0e1061370a951b1ca3f66288c6ed1732ce7c94fc663eb3959383e0f5d8fc28b3ab1cb9f5f3cb75a314c3d1a0a62694f51490760ea88e8772916f49774

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 543280e62f37664192905b6b47e1062f
SHA1 d1bb293501588e783f1d5cd44a1f0709f3425341
SHA256 3c387e7ab5190cb09312a1bea0698b49dad86590f09dd0edccda848cec0d6372
SHA512 67d8617500f5463e0b54554e91a11d43bc7cf3e6e42e2f365a3bf68cf0be02cd949b4dc84916f4e033b0a47f72ba990a243697cc2934f06125bc9ecf762bd386

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

MD5 b24487d3cac0df10c0a39e7f97eba6fb
SHA1 fd44d86a254b7a314c53ad4d3ce2de47c90743ba
SHA256 2f39ad0af77d2292a5e1e12dc5710e00a592c7fc50fde13918db01361fd686de
SHA512 6628583445f44d039cba5e5bddfcb7386f27be360c17b7625b7bb57ce8eaa4995ea0f8acdbaee7011a45c8511fae6d7338f776703c5ee1ec452c0e2fe97c4ac2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 47152c7aab7a9dab7c49e335ce934b83
SHA1 1319c058faa6dc899ca23508caee9e0b46a969b3
SHA256 2fbae91fc0a73afbe388719be079094aee40dc2dd64e1ebf07936ced18748d25
SHA512 213b00c5c98db57399413d4d962f88d12edb86af2b3473936293b4093fe6b40e94bec7709f5a4e583a290c27141f0c11690340bbf2b16976763cfade66221526

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_E7AFBAB1045CF53D322BC26D3E9BEB05

MD5 98422c7b547ec22e2fda5654c3e1f900
SHA1 3b2a6a5fffb626dfdd4460ab87108d0d45175985
SHA256 e5d0d219ae2ee99bc5e009ff4be1a7c98c6ccb8ae22edb9a93b00dd0a0815359
SHA512 76537c311e967cdad399506b84c9178f2655cb32fb754563b203a81a204739cfa5ebdd7daa5a8af3245c3dcab2f61ab0a7aaeebfcff8550182a7b59d47b0f166

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 173cc42ceb54efb7d3ef239e6165eb9e
SHA1 6f5eb439c66b246628c07e609bbb234be454da26
SHA256 527d31d4f8122e35df38656c6c1a7f320727bff37bd2474b9e5d9ba178fd3f62
SHA512 6a30e00840112638ccca0d6176ce644f11f2146b78a56f1b5315e48bf632c3049366e09ef4de1d5cd80b9510c8da94306f4c9f21ad1ab145fb330adf0d531b54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e3c400e2b9c51ab6c0623da1c292b3e
SHA1 65679a45ef8c602edff69682413c15f07a400815
SHA256 e03a816dbe24ef88f0e0450d99b4fffa9e9436f1218cc1be43f5fdd7559240dd
SHA512 659251a7d2506729da95cdb99ec39e50206b664714660b6508f76a2a51621d216aaae51aad2c0de150fa3c898ea08e42aebfc5fd387edf668259d1705d68d069

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0bf9466a954c4d5e1e398a8d78fb1838
SHA1 d66a5afa6a8e38ec996366e47d3be40fb7b716c5
SHA256 6fc5828c3a2cacfc0f9f05f0d12ee81573cdea583e737aeff9a3a9984d153392
SHA512 370cb23bae6a3922b9d2c829f74891f546e65b8e192705f5240f24720085ac79a2dfb0c7a24c5737bd2648d0bc2495623f10c42c59148dceca2a6c7e84797c76

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7e2227d1cda24289eeb5bdc4bd073db6
SHA1 95410d2bb66e8ffbd2273e62e8a9c8d6cfca9f21
SHA256 f6ef5900cb25797cc56a96cac6c4aff776b773afe8b844c2b4c21c1c723b50d7
SHA512 57e13cd24e139932063d234b32768d7ccfb92bc22d84d7019b5b52aa2b755847c196037a1652198f81a9c2cfbfdaf69c1297bc1e346b460bcdafccae45edaee6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 f1515fba5e7afd51f15371385ea32d6b
SHA1 4fe323efd8f44094535fc58de93407a13c4c5d3c
SHA256 368c0a2d489999e28a76e047fe75c66da822baa063e3abae46a8592d773f4c05
SHA512 974ec27b155f9613c2501cf7457a51a60453fa8a58f231a41b880debe708f4615dedd873ca032e034b2f4686b3d26f58f36a6d5afa9020f615da09a153afed78

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 b54ee3141b59659af5e3f171445c5ece
SHA1 a63857f696eca4e315360dbbfeb2b3f83421b359
SHA256 f1b98092b580635f43d37e747b963bd80f39efbbe414633290c1be160c5ace1f
SHA512 66c1232d177c4352291f2edfbd051b40d6164c7cb7f87bc6a07408df90d53a90d67ef4f235f9ad99ab6dd3ab78cfdfaa5e5fb55b52939c3174e44cd8c4b7480b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5 dca8fe4e25e478fcc79dc8d4d124cc39
SHA1 910ca595694b225075188c08d5be2bbd1e0886c4
SHA256 c17bab91c7e7271ebcf3c57e0ac1706559ebd7c0001bf541418eac8eff7794bf
SHA512 030f1b4db8d23feb708cda2252fc77de4fd3ff6bea882f4aa158ae6f37c4a22e53f922a11504b34f431f1edf8d6bfea211419df183aed24136d70de76aac7ec7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5 a8046906cdd469aa04bff3259ff7696d
SHA1 225233c19d54adcb10554e5ad2b7bc27ef7d864b
SHA256 38eadc984ee1998e13bd6168a14673144d1d3757d52cd3e34791361340aa1910
SHA512 85b051e6e7b815e15d9314c359dbe816430b61d1cd99e0900baeae195761a0a9ebec2f0d8cd4838c9f10c06f3bc32ac8f285584dd04054719281f4e6c41957d3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f13e41e67fdb0030d660ee2e60e8486
SHA1 2be7a6e880ade7a0ab3199fcd7799bb305103c38
SHA256 2d6413c8718ae4e9ed32423682e4813d945dcaca613051627f7f5bc2b61ae7ba
SHA512 82151d08cd791ff6be0b977ab30ff0b494c608ca577ca4f40b7fbb9ae2699c38acc4ba1295161f2d14663d23811d978dfc23397bc32ae0179e14e0d1645a7f50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1338827f35274b0d30fe52ff38e9489c
SHA1 2dcd524bb0210f76e762a266d5b6d1644bae22c4
SHA256 ab1c38da80257c97ade08da4b32abb599c2967a47ab1528e47f752098daa6149
SHA512 cdcf2dd6db241d3e5f8f34b1e18a128f26a52f4456931a5b02c789539140848a7e3a2e7bed5e0de07b4460762f3df2934bde9ee469cf7861c795c7027bb24ff1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cfb4f0e12cc6b8c55c181232cfb601a7
SHA1 1d1d9d2f3c7ad62cb09adc23939661f5ef2aec30
SHA256 42ea611a2ee7329b5be50c3b62766a1fa685a55e8b162db18d482c6ef65e409d
SHA512 bbb4eb90cc883c221b4fc1ef3b6f65b400e8a5788ef39ac2de53084f61e2b086b531d56bd2d3703c833cfb9ed94917c2c7381cf340f8e35b9d3570b6da759ffe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 616be01f51a820d0982ab8f9f34c7ed5
SHA1 09683619c1a07fcd49e518997638d9943a1cb925
SHA256 a959b5314f05802bd12a983440fa3547350c67a66ee71aa10f00521d4e4bd3f3
SHA512 3611d996e6033b208f9733031662b5f0bf21c3dc103cfc61ff0e79c6cd680ba3ef1920e211c29770d85543b7622357b3d334892d3be7312d35d06af35c7c3179

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 10bca12b171c1c3757a9144d41fee23c
SHA1 907ffcffd879c06c3c4145c4e508bc935a8d2abc
SHA256 cf38f0f284664cc62863889bdf6b97149a366c37b71915dc9e90ff02e4e65170
SHA512 1561b2f6e8f89cb1725505920d5c1c185bbb098966cb06c60e4613ca29987720408d2e90c4499ea5728b294af0d67c89f1b39267277e0b79bef0fef76f2753f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ceff72f8c038ecb63f268f6503f6f57
SHA1 df6fb3835628146c585d828bad4bc416a6656ded
SHA256 4cd84bee7b77c072a906f2ce072e4ed963c9230c1d72322abdc7a46e0664f3e1
SHA512 4f8edeb1891d958e89c9212dab82be81b61f7fb94adf6c4cf66c83e147e76ba070fbce217ecd489036adbe78c5b651d4e01d450faa89d499e4c6fd055fb546ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d4c60b960f039f7d48785ceeb6e3b48b
SHA1 07e2cca6fde0e90462818cbd61dcaced1579d5c8
SHA256 7d17c3cd0b7dd72fc8386606deeb3383bbc63c2ba7db4b9f59ddf4cee684663c
SHA512 094e12807cd4b04cfba544e6397cee975e9640926661222311cc33f8fcc6fcb842fcd9e6b763dbd8a2264770688db418d2f07888c3d107f40c7ab1583c9c93be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d56e76cebc53aa86b899f196e531251a
SHA1 c9e00bb6d18522134ed2e0228d87461821614a32
SHA256 78a6cb1e5018f60dcaa0ec778b239cf372d993379e52342fa47aea1928ac34a8
SHA512 67f4885b3fe0f869b8e02f84b66008f812e2b0f4d01a578f1750877b55712196384e959c5fb62fd0fc5c4ce9b0f68a6e257ea118266c03eb0424692ff3a94155

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9f36cfb0134fb1b43152d5dfa785f8d0
SHA1 cb482e804d6406b90fe6a9192b3fd77929843f7f
SHA256 4f9cc78b477b62cd98dcd96bfab6a17ebf5e00a7139df98f77daf3df17979d13
SHA512 0e423741e82b19cec6bfd0825ae6befc75c4cd39f715e2cf9b7a3a09f707e71a0bf5e495576ba49abd94f9136c5f68cee140132ea9fc781a79fd0b8b318b27a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b8087577463babe5deb7fac2aeda508
SHA1 961dcb962bbf2a87bc27be6d1c53184040359800
SHA256 c147d8d51fa528519a5142bfadf9a59f5aaf483ee30e5d5c5c37c52a6b7e7cde
SHA512 567d9029b7f14e6681c25683e53c5ba6eb35f1232d592e400093d09caeea152ab5e8c1f253f81e20c09a292324a59781a51101335112b6568d8fd13ab98bc8df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4c8530f6c415c0940ca0c4f99a051655
SHA1 485ab4720a531fe0fb909ddc8c369999d08dd9e8
SHA256 9c129717d578b9dd8986df86fd92488b3d0b7979ad8d5924c4974193241a008a
SHA512 6a3f2ae759757d84f3fee8fa474e10b4791e3d4e1704fddbe7e0f47f2ceca4e6a19edf00a68a830830aa4ab77676a1ffda593fd9739463ff38134ebd0ff8c43d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dd295954565cf6b82d37405fb343faa5
SHA1 a3de46b5ed2bd53c4754174e7d4b093867edc952
SHA256 c0c6b3f1e888379d2816ac8e53de62ad2792c382260b023d2d3f5380c42f8017
SHA512 0d0dae9950ff6ae3436ca5b309a77589aee00bf97396c471a0f719bdc8a8e5b82dbdbe3f7d2b6209fb48a1b517e5c51ec1fc976928fb7b7485a3d3571da9165e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d59bf97ad88c4bce13bc044fd33c06e7
SHA1 e34b914fc37fc7a1dadaa9971930e052c9e2befe
SHA256 da3367e44cd1b07284d01f9d528a0960ff70dac455a2906b6b0abaacfd89d436
SHA512 96e365fef5814cb13745f26c8641c0097cb559d7799462a277dda7d15cf202f4b33aafecae9a1e06434bc97b42738d0dff01bd545a0cabfaa344ac37a4ccbfe6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca5abdc62bee095d496417c06d70eb72
SHA1 71d5c3af9c7b7318d13a10431263a9078741049d
SHA256 d6cd823156c6f1fa8c6508c025fd54f48e372fa122da98c0b0446d6191db2e52
SHA512 656d8a11e72b3a066ca2caf21d4e051359e145ea0484acb40528859aa37fdbcc03f2b080d85a5cf068972922423b22784013a932f8aa39bb6c91965bc4803522

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79625e017358fcfc43414d04dd8c9e28
SHA1 1052af6469928cea044b656def7368d819fd3ad4
SHA256 c73d36bc4986dc098f8eaacb5c08afc4d9ff5356eaa68b7c657b80a80642a7d0
SHA512 d39f3fb6d407cf5be04855aa62186e1c61ce2ec21f53ea335dacbcacab3d0955e2a77a9ea42eb17c926042ef133896e1c1203fa176d7e442281207819e7ef51e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f0d83bf72a722b6efce1d4bc7060c74
SHA1 6c7a0a9d3a884e36c400c7979e95c4ba44043147
SHA256 d70b23e1fe843767a2ca0c5adea8d372b6be554baba3608d2a1eb57362fbbc82
SHA512 89b3212683014cb02dc49ea64ed7dcd368f6d0efdb6e99e69e7649d8f42ed23c4a45ec30c17bc56f87f29f4e1d441e4662be77ffd416e2f33fb857d5b458195c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7193ed751dc164c2e32e20414e7ce227
SHA1 5aa06ca417eb4d07beed8953008085b860bba307
SHA256 2605ef3a6d2fca94816d3b3481040d28a870f9ad241360fb01f9d5bbf5ab4ea1
SHA512 c8aef522da71370165b59e87578bda25734f444eeb79c7c491330f21286b1d77e64de8939d7f0324b39808a8cf99048044c1176783812a53baf66b1ae3934012

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 73cf7441fe26dcdafa8014613ee0c933
SHA1 dd3eb8da38abcab4442822c80e2ae82d1cd16a8f
SHA256 0b3f2e465cf400eddd3ccd23ec937cde010bde7c01cd7ea9495b745ea0d8d76d
SHA512 731ca384548c4d72d85dbe64c037755273057ee10cd402b28ef47f8069bc6e8fd3bf4ea1813ba6e2cebbf16584ea37e1faf0dd5ca59be4cfcf96ac4837ffca22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5381c53c6eeb284ec1f1e0b3adf23208
SHA1 bb6783a60a63294dd74ee56c40978f6604f68b9e
SHA256 cfa8edfb9f46ffe3fbec776cc23126b66e584e0291017e75897af41158bac8a1
SHA512 db7bb35f826e48e83b2ca5c015e0f2d169f69104bb966f372b3a03fd9ed91c182f665bad405d36c2d4ba627506397dafbce705fb4081bf22bfaffad3ceecb7ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 548218480d5f0f6fb3e852905c09d99a
SHA1 d765ca40767dd917d202890014cefa6904514b35
SHA256 e76c84257ad47bcc505999f19cb590e964a6a318e96e4a52c18b49e88df5cd83
SHA512 c219b2bb705a2e7089904bcbb3c02a7cca039e70ca8703212d3b4039fdaacca84848071cda5fae8edad2a9c0459166550674dae03f74bcb63024b19491744b62

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63decffe52a31c8919321ab7f2d7ae9a
SHA1 dbbee5cf6f39110568e99faaa298819e74f26693
SHA256 5298ec3b33e90d50c8bd63bf64c3c2731db64516993add477e7c29e25e6e7edc
SHA512 496d0bc38bd9defe131eec60df0bccff058024b06b4a8ed83f8d88f42c8f1f2a966139d257ee53909344aa761e57b0c6bd07d59bbffb2dda0dd2f98260cb5f17

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a1c5a9566a2a62a239e0dd76f406cc6
SHA1 04eed9178a0c4a801918b1ebb02047bf06d6078e
SHA256 69456f76d01e580a77a9c4e0eb8b6510993080bb3900f59678499c4cc71832f6
SHA512 7982fed8c71b1d3b5fdf49dc075f7d705c0c78d00246f6f44577945b1de9f0d2dc98c1db80da479ca756d9975f5b9a43db4b33588af50ea404f2e6de9af5dd0f

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 10:43

Reported

2024-05-26 10:45

Platform

win10v2004-20240426-en

Max time kernel

145s

Max time network

141s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7537e4873304128fc17548e6868ff87e_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1100 wrote to memory of 800 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 800 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 4544 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2884 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2884 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1100 wrote to memory of 2344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7537e4873304128fc17548e6868ff87e_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c93a46f8,0x7ff8c93a4708,0x7ff8c93a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,15367667350022637280,710133044664443406,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2788 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 dl.dropbox.com udp
US 8.8.8.8:53 databloggerpage.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.200.14:443 apis.google.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
CZ 46.8.8.100:80 databloggerpage.com tcp
GB 142.250.187.202:443 ajax.googleapis.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 15.64.125.162.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 100.8.8.46.in-addr.arpa udp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
GB 199.232.56.157:80 platform.twitter.com tcp
US 8.8.8.8:53 bloggercomment.com udp
BR 45.152.44.151:80 bloggercomment.com tcp
BR 45.152.44.151:80 bloggercomment.com tcp
BR 45.152.44.151:443 bloggercomment.com tcp
US 8.8.8.8:53 157.56.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 fontpis.blogspot.com udp
GB 142.250.200.1:443 fontpis.blogspot.com tcp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 yourjavascript.com udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 www.meuslinks.com udp
US 8.8.8.8:53 ww82.databloggerpage.com udp
US 13.248.169.48:80 yourjavascript.com tcp
US 199.59.243.225:80 ww82.databloggerpage.com tcp
US 199.59.243.225:80 ww82.databloggerpage.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 151.44.152.45.in-addr.arpa udp
US 8.8.8.8:53 1.200.250.142.in-addr.arpa udp
US 34.205.242.146:80 www.meuslinks.com tcp
US 8.8.8.8:53 www.google.com udp
FR 216.58.215.36:443 www.google.com tcp
US 8.8.8.8:53 www.adsensecustomsearchads.com udp
GB 142.250.187.238:443 www.adsensecustomsearchads.com tcp
US 8.8.8.8:53 partner.googleadservices.com udp
GB 142.250.178.2:443 partner.googleadservices.com tcp
GB 142.250.187.238:443 www.adsensecustomsearchads.com udp
US 8.8.8.8:53 afs.googleusercontent.com udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 225.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 146.242.205.34.in-addr.arpa udp
US 8.8.8.8:53 36.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
GB 172.217.16.225:443 afs.googleusercontent.com tcp
GB 172.217.16.225:443 afs.googleusercontent.com tcp
NL 23.62.61.194:443 www.bing.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

\??\pipe\LOCAL\crashpad_1100_WZCDDHUCBIGGVILG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 70ffbf4378d8ba60adf136af782d8e13
SHA1 7740bc64c4f25273a1e494c46547a182b4ac7f57
SHA256 75bf005c2fd16a89bbc316d080a3a18fb185d519c3d7b156734ac3c871f6e98c
SHA512 82f61bf052fd443e47d892b7c636671dcac78e8be049d43dd0e37cab0471c350b9b8ff14e48c537cf799678522e75f7e92dccd190ca35a3e3c7d0b92f7d52727

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 13d9dc251debfe4fa7a03597641d60f4
SHA1 2dc1c624e4e469f1cc36de04f7aee547f50bd61e
SHA256 4eeab45f311a09761cd7d9dc708d8afa7398bcf5d7bd7fa2bfdc952c5731e2b2
SHA512 0a2947bbaa4807e3cfb5b38a001c509f741134a8542e5c0805394af25f1685c989be1d8db5c4f9cecca6d97d66b2eecac641b621b591528aa85c08fe485c3823

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 557d4c784d42f5831215db048f01e63c
SHA1 908af981c0dd52b8b4e60846b440103b8c00444f
SHA256 93b5b91219db32bf1a8a1e3227c397b337f691b40d23fa7d41eed83444b09cae
SHA512 858122331cf5ede38f02fe0ddc3ee0178767de4a834e254a95b75eadaafae4b1261817746d88ec92f6859e7dc0a91405298c1eb131a38aa8a6a1a02c9dc25402

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 81d855f84aedf28db4fcad5b29decc55
SHA1 a67cfe0b217e5a524c5574dcf9f2b03ffab07365
SHA256 164967879214ac3a682a559d15b7257b42e74f3b321b0826fdda2fdb015d8b2b
SHA512 f2075205e83c456cb8982ec950b020701985f33228ecf8d20c760d8ccd04be3a187d0990368f557e04229148df1471ff30772ab7cec43a62c4e95c12dfecd887

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 dafb98aecab4ace2f312c557ae5e9b53
SHA1 01eb03b218fb060c1ad7e3f6c69a39d8c0bc3344
SHA256 aca5d0c24e47f9a2bdc6bf9d42e5a3a1e5992518058d006f31af01da3ca359a2
SHA512 1e9a5f07d3b3cf535428af59faa474e07fc6fcc87255caf9a27b2543cdfa29aae0b06c66046b776812e19ed3933020fa1db893d3105db0d7014abcba622f5541