Malware Analysis Report

2025-08-05 15:52

Sample ID 240529-kaej4shb89
Target 8016e4914230eda85ad232b320ec42ab_JaffaCakes118
SHA256 6555f693a627f7ba390b7b9dcf1532e7a5a52b073cac452fa0c4e7046ad5a377
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

6555f693a627f7ba390b7b9dcf1532e7a5a52b073cac452fa0c4e7046ad5a377

Threat Level: No (potentially) malicious behavior was detected

The file 8016e4914230eda85ad232b320ec42ab_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-29 08:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 08:23

Reported

2024-05-29 08:26

Platform

win7-20240508-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8016e4914230eda85ad232b320ec42ab_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a7b093a1b1da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003b48ead8b80d07881d11f0f17e0664bb773c7c2740e5a2b15cddfd0daa709e74000000000e8000000002000020000000782b6862e8d51566a2ecb88ef5c592fb6450fcb4d488faeb220d71ca75880b0f900000001d88c26a9c33d9bfa4005b7a303a6fbaaba3bb4129b7aff575eefec4ce87718e33535eb2a407c6e24f3a0a75a439a8a1b5ab4cc2562cdd537cca74382c5414f141aba6005151a7cac33f90fe40ea89df407e4ca1dc3003a5d9f6605dff1d8a37c121b56c3c42527a6422507391659872e2405da5e2034f0260887ea9b74c488ebc0792722d790b729cfc05c9f891a3cf40000000ec1a7a2e9ba3df874860748b204677f359f45253181c52067034edb03514ccc1f14221ff1d179d23ec90ebd3c4e21be699c16153f0d2f1521156087b29116ab7 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423132882" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000dcfaaa10b92fe54c50ad91021f5c9144b83050474dcaf8598c8e0b6253d96a9c000000000e800000000200002000000077c79033b5480eef23faa213c5958be8933114c7c2cc7aa525213d8b05ab92f520000000c9f4ed2af1965e0f404064a2a5d2a2ad29b10c88943132ee3de63a1477f4c06e40000000d460f97ce3f44e24068601de7ac43d7eecdf3b351cb268d638d117a48fe3b3053526c99c76f0f44b3c32575e7a62759b0797ad4544a08d6f69b318597938bb49 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE1679A1-1D94-11EF-8B04-EAF6CDD7B231} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8016e4914230eda85ad232b320ec42ab_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 static.addtoany.com udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 resources.blogblog.com udp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 216.58.214.170:443 ajax.googleapis.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 216.58.214.170:443 ajax.googleapis.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
PL 93.184.220.66:80 platform.twitter.com tcp
PL 93.184.220.66:80 platform.twitter.com tcp
US 104.22.70.197:80 static.addtoany.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
US 104.22.70.197:80 static.addtoany.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
US 104.22.70.197:443 static.addtoany.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.153:80 apps.identrust.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
FR 172.217.20.193:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 jqueryapi.info udp
US 8.8.8.8:53 themes.googleusercontent.com udp
US 45.56.79.23:80 jqueryapi.info tcp
US 45.56.79.23:80 jqueryapi.info tcp
FR 142.250.178.129:80 themes.googleusercontent.com tcp
FR 142.250.178.129:80 themes.googleusercontent.com tcp
FR 142.250.178.129:80 themes.googleusercontent.com tcp
FR 142.250.178.129:80 themes.googleusercontent.com tcp
FR 142.250.178.129:80 themes.googleusercontent.com tcp
US 8.8.8.8:53 fashionworldhunt.blogspot.com udp
FR 142.250.179.73:80 resources.blogblog.com tcp
FR 142.250.178.129:80 fashionworldhunt.blogspot.com tcp
FR 142.250.178.129:80 fashionworldhunt.blogspot.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
US 8.8.8.8:53 accounts.google.com udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 developers.google.com udp
FR 216.58.214.78:80 developers.google.com tcp
FR 216.58.214.78:80 developers.google.com tcp
US 104.22.70.197:443 static.addtoany.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
FR 142.250.75.227:443 ssl.gstatic.com tcp
FR 142.250.75.227:443 ssl.gstatic.com tcp
FR 216.58.214.78:443 developers.google.com tcp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
FR 172.217.20.196:443 www.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7d0e1918d20b804dc6f6ace30f4b08cd
SHA1 e20c870b443431b2c73c5c3bf27cf78e0d247b9e
SHA256 4e8e92bcf61e18f9d7a77b759814af6bdda11813a8cc2a3c2fda02f687de4a3c
SHA512 a6560fe5ab088cc7391b63e957cf3ff76bef4a272594a4893bdacee7789a3c043aef2c9403ae25a8783fa9e1075c17744be501f773041519c58adc1c8294e63a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 b9a6ce2d8d958f97f33e4c90383555b0
SHA1 1dfc439a009c45eb482547d65aeee88675679279
SHA256 35c92a56b5f0f8520f27ee9b8d093c80deeb4f7599dbedfa8619559986db3c03
SHA512 0395ce6722e8663e946c8ab45bf6b28dde3d77c42ce893dd5d9174bb1c2c287b5ec4cb165ab2c606c13b39a72af14ea2d1b63bd3f21b766f8969b6d18db920f3

C:\Users\Admin\AppData\Local\Temp\Cab343C.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 3c52e5396ed0db2586f87d734ee5c994
SHA1 57be3f1c7c064116473bfbfb269c7395297663ab
SHA256 825d770403f59e8d05a546f55bf05ca9ce6cd59180ec93b8a473edcbf74f45d0
SHA512 84a1361cac22c612428920accda6bd6accee16eede2c76df95e35e7733a55496a1422390bcb27c08a8bb96b342ec0352812b2eee1e6c64b51534e33ab4ae05ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 c23cbff4d4507c0737aa2f29110954dc
SHA1 3c1bd1ae83249f163b4038f0dc46911529cb65a4
SHA256 b9242fa7784261ae70c794554cfa0e87a6187dbcc2e9a9a2630c2e724dd5af87
SHA512 efbd71517681738812a406d4572b991e5729c0c2937a44f17dc23bddc30101dc3a02e06250d3413de09ed94291d71692907e242dc2445e1e6d71c36164744cc6

C:\Users\Admin\AppData\Local\Temp\Tar346E.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 0be53ed9f74eda5c1ee10fe4708c7772
SHA1 7d5cdd838bd6712c26c0fc49c5ed0c514cb1ee94
SHA256 ac35f8f87a7477280b5d768790ec7ac95f6997be1d150708bac52756033e05a4
SHA512 64e89ac1995ae382ee7edca30140f4d39f25258a95d55620b8e954617dba5d19262666a947236a8b2636419a7b0bc820027603c1b01d6d987c9b40a19fb171c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_02C4C6ED250727F9B08935C0A9565568

MD5 b9c0b141cd7aeb9be5455fb7a46f68e7
SHA1 0cb88a0f979a3610de54c999b74f86e5d4e140f5
SHA256 77c93c0c92ace37a876778d68fc68aa222627c1a8f57d921b3b46710945df624
SHA512 b9d7134093b8b078a684dc3dd3270f9722d94c02852f32576f7ed081aefd232c8b131b0dacabb114202bb238b98f6b44a15a35bfb4eeb37b114ade3a4659383f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 315ae24f1eef51a66c7175acb2947490
SHA1 dda91165789d79731194cf741ff3715f90ac6c0b
SHA256 08c4f5874ec3d7c771eded0f47e1b80bd61a66fb80797d62b65c19050d3a7df2
SHA512 b313adcb411e3497181f20bd67aed5aea652d90153fc321c2889fbe9addb438c4025c2a0c3175d4b5fad89e2ff8e02dc899af70a645dad841bf38755f8715568

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_02C4C6ED250727F9B08935C0A9565568

MD5 ab717c7b6b80f3c0b144b959aae3d0e4
SHA1 578fb3f595898df0d21f22704fed7e75fa780c65
SHA256 c935ad854ace02c1c74ec48648a46b5b40d8d5877bf44ab8909356e2bfe965af
SHA512 60e579023b4b77f4a652a53e96c1a30968d3a54ed5e92316d18c90603ee7a469a9da544dc55c6d6198c9065ee6b89242e47ee1ad1d9b5785677fd9e2be4c7ff9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f4c24be16d393c6de67307f70b058436
SHA1 55d90fd9e4045f7a4684f40618e0387a00697a51
SHA256 b24b2880daf4c16739f32fa9a27c9eaa50310902fb92509abd27bc2f0dc563a2
SHA512 0340a27312fb6b0a49e92442928909d3a39a1c82c0d65553b09db67cc9bd72739a99d779f7824a86853e2eb6498f0a341302ee2ad9411be1c3c4ec0e2b604511

C:\Users\Admin\AppData\Local\Temp\Tar3581.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\plusone[1].js

MD5 fb86282646c76d835cd2e6c49b8625f7
SHA1 d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0
SHA256 638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109
SHA512 07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\W04U1A52.js

MD5 67e216a27dda24bdcb086c2385b0cb99
SHA1 17141c80f5d32bec3691c5ab24741d8b7dd5f0c6
SHA256 9dc433b2142d3ba0803fcffa53f19d34da26996d20c829df6d694bc887325dd7
SHA512 802319543dc64cb011bc2684004e878a842b73aa55e4da1141ccb8650cbf42fabbf2b46c730760bbfcc7a140e11700244b9f5da78bafe9fca7ec7825c12b4255

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\cb=gapi[4].js

MD5 4d1bd282f5a3799d4e2880cf69af9269
SHA1 2ede61be138a7beaa7d6214aa278479dce258adb
SHA256 5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693
SHA512 615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d81f41bc1c3bef11f9b5e4fb8192ead4
SHA1 0fcffca5f06c55bf7db886f39e0ef8cdbd13e48b
SHA256 81d897a74efcd784d355adb316738132be3c5dffb69b2c4b4922216c3f061ffa
SHA512 7b5717fae303c4421d7f8145a596bbf3530389da76fcab259e54def575cf5ccdb544dffb8f9681b3f1514ca2804c88ea69f8cca86e2b7a71077350540a8bae9a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53bcb712ecef24b7d156179f0b53e68d
SHA1 39168a4cab643a9b7dcd34579ca528a9a4c79765
SHA256 f38953d2d38b073b8921b18b481b19cabe022a56f96588a5187fa9f621b38e60
SHA512 884b312f94e0b7beb675f9e7ec0677d6691cfcfacde5523d6c308a1fa2e37bb1f9195f35416993e75ec78d1c39f6e7c67fd2281e11116f00f16fb8fe60e96953

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e34168a9c173f0066264622f7804d9dd
SHA1 9975fa8f71fe891d463865dc2f5b2f6be78bc16d
SHA256 4db81f0ac4be16ec006cd0fd2858674ed465adac383789d62846cb2458500cae
SHA512 04a99e2a39593d71ebd91354164721f251b12a1a5b4c7307ba924f811238941a227138b0c1e61b794bafd21f36c262691f215b63463a14d0968913911e098f51

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e76e6d5002cea094b9fd85cdaa602f4
SHA1 69d09f6452a35a2c5b7f91a7787bdf09b5db6eed
SHA256 0e1527c67f348f735a19978187a6b53a1721eec5fb8a579d671f5671c5fc0583
SHA512 40eccb8854c2d38ddcaef59edbb910a6248b1f8fb74a4c46a6cf89c34cb963492b9b1e5c56b1d13cb7901158334d1ca1490577872d437d2cad5e8179bdfa41e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db66f72c5e0f60b7eb3e515052c8139a
SHA1 5d8f64066d5df32b43a5caf14521ba0d357f4702
SHA256 a74f2674479f998fed020fb2ece4216c67cdddfd363493efaebb95b4f6374609
SHA512 253fd9c99384ce8e37f04899adafa55a6ae7e7296e9a07366d294eb3b365dd8a1a614a4d63e2230eff4e6ed848681d44f7f8ebb3efb7a7ecbf9eee08b0e6b490

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f9dae96e001aebcf8a8b016b0b26202a
SHA1 01865b271a698679b4b6ec1dbe8e9a875971efbf
SHA256 acd339c3969ff130b9d94e5c227136a8ec641f5950a0668c2663680dde58b90f
SHA512 1aa1ab014e73eaef25a972cb93d4dea308ea2667f65b80a5dad5a7868afd442e576c72482c52f1c8b80090b57e1b2c66e702db2062a31f36f7ddd517ae388be4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 50630dc524237c620e3da9bb493f9a62
SHA1 5dd9d758d360bb90e953331508bc8562fbe4b439
SHA256 dadf1f098d7f1b92b55450b1c698fed001375b484f597033e1a3ecd5ca7bbbf3
SHA512 8b7be787a2c6cabb8228049325529eef584b923c670a50e62f0ac658dea1ac017d9da6a364f861aa11635bfc1d5b57bf796a269fcea1c75227bce7ddca629334

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fa78643725703e9eced46c6d8e927472
SHA1 c49c80f6cbf3b3f4c573616b01abbeb2235afcaf
SHA256 f98326925faa3d2a8ced11708edc5b186ba4a41ba6286ddf5cbfcab0adc2122a
SHA512 18272a9e5322215c112f02f72d2060c1fe584d9e4b81fa5bfeae3c73c97f5c59586f22708c2bf894518d4dfe29a1cd11fae0854901ab8855e2dec999122d08b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f71c1c1307ca1d2cac9948d319290ed
SHA1 b4d905a124db2b8e432df6976e0b8b814d618ec5
SHA256 79b7e442ab7a99037e4c9e7bed7dbae44ae1669d50f3982744ffde38450c3944
SHA512 1ccf4427f9d98954129fe39b86136d92b0684511bf418d7d902629b02c21a1748d059bee3702aedeffb1a22c6d5a406fb96c620bb2261b2b4152fba79d7b24df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 16bb8a57cdb0a7aba91578fc59c6a4b2
SHA1 116e97e1ee4bc86102902a157d729b1480b7e0be
SHA256 61efaa6a8e482a97ffbb5b7d254baff08199cc47adf3522c42ece8afcfbf6a22
SHA512 d8b90d3e3aaa27189cc3968c73928a1ca23ebe90c3ee5ad14379d8850dd88fc7c0ddbecf43ae0f946687b92b8f9b6def286a89406a86db80b7ba57aa9d201afe

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\rpc_shindig_random[1].js

MD5 23a7ab8d8ba33d255e61be9fc36b1d16
SHA1 042d8431d552c81f4e504644ac88adce7bf2b76f
SHA256 127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5
SHA512 e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8SD872Q\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7346497c2c03a358c53a1637ce9f6b9c
SHA1 c59105badc824e69bc8997b6381cce1335a5a5a1
SHA256 561b38b3a4e56e87895a539e0adf42c6b837ef75762f753f7c83d257a2776617
SHA512 6c54b56377cc7d53adfdda33c3c0df9e07c73fe4c5a9da105775b541f2295bbef7699545f30cc71cb732b4426ec5d5862c089f64cfe1903d5aa5385abb896d42

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dd24dc6480b70d219aa50fe10d2bc078
SHA1 1fcfae667738d9833374a909b785a889dc1a2396
SHA256 1cca6dfe255e1d66ec3d38452087e1ac48bf1f0cc7c72b51f95f53bf951ebc12
SHA512 7e08c7d2886b29292499de31aae2678dd277ea710cf9f082bf1ed743a34e2849a35bc9387afbe1ef40e335ecc3f5077531c62ac3d94950a705b35ae178b850ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7a0b70ed24a220abc00f965cd578aaa5
SHA1 25d5e24962863899e3e559250a2ae40da89b63c6
SHA256 b53859e2465b996ce3a63052d2cdaec3081e5502222d06f84fda26344c052691
SHA512 ed6ff7901328a5d81230db02c5f860b73d79ef1fe458994c3f8f1dee78cbef11cb1839e32e95c313ff0e7b1e57affbb4cb90ab3666e122b832de7391d78afc21

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f801570e404fe1d9565cc31c19eddd4
SHA1 6db390f84677d08dfd4eea229681b10867d01716
SHA256 54b3f9cc0a86a1150ffae8f889273cca5ead4029ce7ce73937f5475ea80d15a9
SHA512 87bb9073faa11a83606961c8811a89c84b6b9d8108821b8a1db3e2cbd075eed1ea5397e69ee774e0c7ac9ef9d8abbf8d7d9c2ef9f2e9d27410d487795deef07f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d61e755518c9bf378fbf197f665bd7f
SHA1 29ed40426178116081802ecbc30cc8dbe22299f4
SHA256 3d222cd1229555f8253333f55caf6940288ba85bcbe00db66bf3cb7a46a2213a
SHA512 84339a0bbe1010e898a916865e5d40fee961e648324be485ab71d95476ee085045b7bcbf3ce7fc10351e834cddac20c6943c9f1de01a82461a17a44aa903b789

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 530697b9b394c44a02db1195ecee856d
SHA1 bd36d9f1ac1eb04a1f8daa49f637f1106ed7666d
SHA256 0192056320a47fd5d70d31abeb6291ec772288830c86679a918d014a5ffdd2c0
SHA512 d251efcece459f3378cbafe33e86ef3262c5398974436b8e37459a7624d79427e4ca5e684178ab65b0e64983088769f582bc0ac6fe739121fdba0c8bb9ba64f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 49a219bbd64b5929ca431091da70f8cc
SHA1 79d67be984e8db6effec592274c0db4773c53906
SHA256 e380b5588040c20a11a0440bfb81a1e7a716b84e733541a7af252558e8fc79ea
SHA512 ca4bcad711ccddc0254588f18b26da191d1c5fa956d7b5a322567e538e5aaa601e1a86985c60af1f3796df11e0ab6a90e552c868b7af49d6d1caefce2816ef28

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ed4d9542ae5d07fc004b0bf44ba95214
SHA1 5fbb085aba506a17f10a51027315780eaffa6343
SHA256 4486fa675f79c85a3106703835e5f87d4ac481446dbb00cb90aa41f6d7f826e9
SHA512 f81533c087242a1f6d7c01af2cb2d99f9e52e0c349a4796e2e668efaecc14e5ad672497e1207df702a2850d785f208b8fbc11f82932aacda2a7263b69597d47f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 43b1503ada55383a9557e2f29c36a09f
SHA1 2919d1a6b2a391087927d0cca6c8e7ea65861754
SHA256 b136accf0f94ea08094829e49b67e8264d5baad9695090415486852e1b9b9e49
SHA512 acda9017e59209e1ed099fe56c63582b5351f645f182c7886d63ea87c25085ca7ea99b078ba2d543a5f907e6c1c59c413b8cc24e232a1732e67f5bb1b4e4e00d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e92ed872e81839bb49dd7c41a2431713
SHA1 f6d389b3118b23e9e48f8bb5b63066c60f2c5dce
SHA256 48b1579cd3d82fd8171576866af0934b3f24ecb685603758d997ae8406011fd0
SHA512 635cb58730e6780e8ce26e1bd165c8f8df4763568d41f10bdc17e3fc03e4df6b76f212e4a5d3ab6f5fc8f69d64daef7d3b234e5976af03b33c4dba08e9e7c012

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 08:23

Reported

2024-05-29 08:26

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8016e4914230eda85ad232b320ec42ab_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1648 wrote to memory of 1064 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 1064 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1648 wrote to memory of 2392 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8016e4914230eda85ad232b320ec42ab_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff95ffe46f8,0x7ff95ffe4708,0x7ff95ffe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11307317853569583637,8356040441624429862,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5292 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.179.98:445 pagead2.googlesyndication.com tcp
FR 142.250.179.73:443 www.blogger.com tcp
FR 216.58.214.170:443 ajax.googleapis.com tcp
FR 142.250.179.73:443 www.blogger.com udp
FR 142.250.178.142:443 apis.google.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 themes.googleusercontent.com udp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 142.250.178.129:80 themes.googleusercontent.com tcp
FR 142.250.178.129:80 themes.googleusercontent.com tcp
FR 142.250.178.129:80 themes.googleusercontent.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 73.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 170.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 193.20.217.172.in-addr.arpa udp
FR 142.250.179.73:80 www.blogger.com tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 static.addtoany.com udp
US 8.8.8.8:53 resources.blogblog.com udp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 jqueryapi.info udp
NL 192.229.233.25:80 platform.twitter.com tcp
US 8.8.8.8:53 fashionworldhunt.blogspot.com udp
US 172.67.39.148:80 static.addtoany.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
US 45.56.79.23:80 jqueryapi.info tcp
FR 142.250.178.129:80 fashionworldhunt.blogspot.com tcp
US 172.67.39.148:443 static.addtoany.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.153:80 apps.identrust.com tcp
FR 142.250.75.226:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
US 172.67.39.148:443 static.addtoany.com tcp
US 8.8.8.8:53 129.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 148.39.67.172.in-addr.arpa udp
US 8.8.8.8:53 23.79.56.45.in-addr.arpa udp
US 8.8.8.8:53 25.233.229.192.in-addr.arpa udp
US 8.8.8.8:53 153.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
FR 142.250.179.73:443 resources.blogblog.com udp
US 8.8.8.8:53 196.20.217.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 connect.facebook.net udp
NL 192.229.233.25:443 platform.twitter.com tcp
GB 163.70.151.21:445 connect.facebook.net tcp
US 8.8.8.8:53 developers.google.com udp
NL 142.250.27.84:443 accounts.google.com udp
FR 216.58.214.78:80 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 syndication.twitter.com udp
FR 142.250.75.227:443 ssl.gstatic.com tcp
FR 216.58.214.78:443 developers.google.com tcp
US 104.244.42.72:443 syndication.twitter.com tcp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 78.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 72.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 227.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.151.21:139 connect.facebook.net tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
FR 142.250.179.73:443 resources.blogblog.com udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

\??\pipe\LOCAL\crashpad_1648_MPQCCGWRYXCLIHKL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c35eaabedbd0a0e708b3f38cae0e3a46
SHA1 49badb325b33b87ab0872b79266cd41b215d0c18
SHA256 5af0b4f164d030ff2b57bfd4c59dbc0b618bc07e28cda07c0645849b42428c47
SHA512 8c5481a07115d2d3655ea004bea8a77a3b9b4263bfc3d7d6f007be6b11a19b156c32a6b8dd09dfdbbb63bd38366ad27623727af3b8fed3722a5b99c28dd1ca0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e753fd8c67ae002449b0ee341c232086
SHA1 3724e244980a27b9a014edd41734ae26b4ddfe85
SHA256 1721695d66e88218349c6b132c90274700ec9be64d54884b9daf9089bc61bff1
SHA512 578bdaae009bb74dc0db6a0c0204c728bd790199544c7564287a7eac6f013575ca329681c73b44028c55cf4aa515fb3fe895b5e2f72f58e648e0717afec30e75

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 238d376e191654df0437872b5b8f586c
SHA1 ea78b79a23bac009c4e3580346a04c031851581f
SHA256 077cb19dc4b3037175584926840b7482c52d61339b967f8842d7802c5de09808
SHA512 bb03d23b8f2fa3f0bf62b156de08337e8300f11c5330a363ccd31fef4e1c82fe95c591d1360ab80b020f876b2ef5f726b473e7424c24650601639645b651e19f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 66e96b183e14a2eeecba4a708945f749
SHA1 ac2072e3ebc6667ec8b58a1e7d9274b28f6a9255
SHA256 c87c7c2798fc5c6a0136de0da17302c67cfa2b5e91f74fbc5dd9d7c4d872282c
SHA512 b5ddaca0baacaaf5b705c1c66b801f6c0c9a2aa3456dbb67860381eeb47f7bf8519671c60bdf8955eff3069578697199c942f7b1d9c6aba6d9ac7cdd50292e7e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4408beb48d68b1311033cd3bf9b2031b
SHA1 d90d2b9bb958a284dbd8c96e312cec773af4fd30
SHA256 98aec8d5085e991b37174a18073dda3b8a619105b9452376c2e41c0ce9e574ac
SHA512 d690ef81388314eb3789edc08d343fc5be7353cc0e4f23ee9dfa1ebf216b7271a4e55a0faf1087b302c49a319aac228a1a271946d86bad30dcda418419f0a685

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b2807b4c259b58cb842f246a291f257d
SHA1 41c8fd310fd53964b7c5603971336815975ad9ed
SHA256 3548e8f6620cc1073a22b8c3491cf9f8ceb79a3a1afd087a0fb447c220141c0c
SHA512 d327dc07d71d1776687e4b5f6beacbcd58329bf983b51f710c299b03960dcde60199c2192b18ad52a97c60fbb782f53707a579364a0a826d3d83de814f2be2e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b844.TMP

MD5 4caac684883a6821c3dcbb9f9e271199
SHA1 665e397a8aa4b41239fd9f59e8b6693a01c5c920
SHA256 75318e9a72d4e99fd388d003cde1aa36e3b607bb753389760365057af6251f5f
SHA512 a53c802e89d8fdb7e309901ae22eaa8053f93262fdba46b81d060fd16ed6ced7a6bbe3191df1e21a8ed241cd19ae4907b0861ad00df663ff01cfa8ff9aedb889

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 eab87449082ea5af1552926e90df0a9e
SHA1 25ba6d5b016f2906dce83a1fb6d32008e1c72dd7
SHA256 4f76e1534e290caa27973339493aa075d514646a2302f6343324f3ff37dc3912
SHA512 8eb555ea3ac2568a0b903914e77f40530b7feecca4d0b4d93f80e69516f09a9fdc5aad4207fadc22764ef7e3088a9f20732bf12adcd15bf5ca71eddc3087e555

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ff696e0317990eb07d323e6f1d55bd3e
SHA1 7bf0abb95429b4565ecbec6a4cbc29c92878d8b8
SHA256 d3192a651803deb89dcc7aa6be0386c34299ab4af1ecb9f40ee1d2a74f0b2513
SHA512 7c4c4b68554d6bfffe0283effbf20d2835e40e0939d017752ab1622fc207aa64397ad0f5c38fd7ff3905be9eeb8d079c7597be8e4220c002cdc320167928ee65

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 94de80cd2a86ec1d48573fc7817d9377
SHA1 2feda314550f0557b912278dd5ef6b95fa21839c
SHA256 409697d24cfecbb39527cec7def0e955c01fcd962c6f33fec27e1e522a347900
SHA512 5cf4a6b876a3a6595207bf606d2589710fcc7d846a0a1f95ea9d1f3213b7d9fe682c8ab7f7906d5fbe762cf1d2f1a3135f0f726b6a541e1e12c525c72c710089

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

MD5 0fe383a7ddb9bbaefc3105b3297f5583
SHA1 f80c9d789f251909c7560bd91a9e1b9a10c26362
SHA256 d7ad4aad4e48174c30ef21fc32c9380659d2c99a5c39680e10ed9752139d8683
SHA512 31de1f59377bc76e5d602d02273867ce750bbbccb7edc8f2803c0188002ecae6752ac3ec31c2108e64b0d871b01e6a8a06711969dc68bd9823303def0e7c1ee4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 18b0e9aad578dc5602aad8ecaead1127
SHA1 0264f20352d355ae3fd307f13a142d0b04886517
SHA256 7c74a10a2a6f2058ab833618187b45489351e6a3c23bfe547a0f1b20f368d26c
SHA512 42242320c704368dd26bd942b6a620771e2c529f930cdcf796e98ccceab1291f9d52d25cfd160ba4159b2078de363c083e235d107b5409ab43c4312453ed3e0c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d0b5ed4cb7b04e64a0129e4b8d4cc096
SHA1 7caa8dd3b1b9fc857a1ad189573486e6112c7ef9
SHA256 84d748692ff3548abffdcaec7184d9ff1ede928f0c322f169a0e6a47cac7d457
SHA512 0ba4a47e628530d6a1f1a3872c1679116f9ee0f92137b44d0407496f57f8237a81a98fdd5fe10a45721a85a138124e23edfea2c9ee126267e4d89981b31c6552

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 0f505bb5e0d6fc04e20c1e8598cb77fb
SHA1 e7d3154e3ad5e3f4ec63545a7d9b71b22591b450
SHA256 50a7161451964f8a35cd4e7411e239715587f3dfa0966f58c8d6265dc8238e9f
SHA512 f715053843264db268c0def53b65019f06e9f600c5bc6b8bda7d5e49e512ba79394a12c578c77a99ca8359448272b8ca15a4b9f9dae0168646ba3a617545fa93