Malware Analysis Report

2025-06-16 07:06

Sample ID 240602-bfwk5sea56
Target 8c67c07a076a60ebf808528f6b96620d_JaffaCakes118
SHA256 0e1af61a01702b6db3ccfe139c918dfa21da9a086328ac00e1ef9bfc0869a5eb
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

0e1af61a01702b6db3ccfe139c918dfa21da9a086328ac00e1ef9bfc0869a5eb

Threat Level: No (potentially) malicious behavior was detected

The file 8c67c07a076a60ebf808528f6b96620d_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 01:05

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 01:05

Reported

2024-06-02 01:08

Platform

win7-20240221-en

Max time kernel

141s

Max time network

150s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c67c07a076a60ebf808528f6b96620d_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E2A5D21-207C-11EF-9F07-6E6327E9C5D7} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423452230" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403b733389b4da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e3404daba58207478daffd0828ddaacf0000000002000000000010660000000100002000000086360014776a93552784eb08bc4ede91b9e8773912c9180e7e8d819d44f64ca1000000000e80000000020000200000000845d039cf203eca284558e017c535a52909dded647b307712358577fc45f6ea90000000ec5bab5908c772d6facf1af49b735e518c72266756c04ae75803a7cd09ba0a1e0fa8e9e820b1279fe95d913e671947d74672e3e0e1baff82af39305ce66cc2758f5988f3777b089cb3feb69f60c1244f2384189b8bc6d8e7e6ca76b5a2edb7abce04ef635509ec901260315392d256db394f46baaf2e2bef298044fc36b06337558e49365013e4499b6c1f6efbde9f8b40000000522473a03180d856f1fd4f227a60008a699cd08cb6b2dc89e5a11d185710235002f7dde54a15852a0d8b021fe05a74159984423312c65599654ccf702f60cc4c C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e3404daba58207478daffd0828ddaacf000000000200000000001066000000010000200000005d23e7fa97294c0196e5e1a91143cc7faf55b0f4a95cfffb1c4d352e19d99581000000000e80000000020000200000008a1f6d84da80c049b1eb1e75bb72ffc0ef40d58546dba64c78d8d82de61b014a2000000099a78c2b4c8befc1057c7bea21948daaf90f45a400e2db930e69fbd67aec36244000000054ba0f384bfbc08109fec963aa886cf359fe7c9f7d06e7b3b3963301fad4cc93021a77f81995fbd6854e930191e2cb1691b7ebb92f7ba76ade5b60ac1ec59e28 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c67c07a076a60ebf808528f6b96620d_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.anddev.org udp
US 8.8.8.8:53 api.flattr.com udp
US 8.8.8.8:53 www.recovery-iphone.com udp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
US 104.26.10.251:80 api.flattr.com tcp
US 104.26.10.251:80 api.flattr.com tcp
GB 142.250.187.194:80 pagead2.googlesyndication.com tcp
GB 142.250.187.194:80 pagead2.googlesyndication.com tcp
US 50.87.30.95:80 www.recovery-iphone.com tcp
US 50.87.30.95:80 www.recovery-iphone.com tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
US 8.8.8.8:53 anddev.org udp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
US 8.8.8.8:53 recovery-iphone.com udp
US 50.87.30.95:80 recovery-iphone.com tcp
US 50.87.30.95:80 recovery-iphone.com tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
US 104.26.10.251:443 api.flattr.com tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
US 50.87.30.95:80 recovery-iphone.com tcp
US 50.87.30.95:80 recovery-iphone.com tcp
US 8.8.8.8:53 images.wondershare.com udp
US 8.8.8.8:53 www.cucusoft.com udp
US 8.8.8.8:53 www.softwarebbs.com udp
US 8.8.8.8:53 www.imacsoft.com udp
US 104.26.10.251:443 api.flattr.com tcp
US 104.21.23.97:80 www.imacsoft.com tcp
US 104.21.23.97:80 www.imacsoft.com tcp
US 104.21.23.97:80 www.imacsoft.com tcp
US 13.248.169.48:80 www.softwarebbs.com tcp
US 13.248.169.48:80 www.softwarebbs.com tcp
US 107.180.0.180:80 www.cucusoft.com tcp
US 107.180.0.180:80 www.cucusoft.com tcp
US 104.21.23.97:443 www.imacsoft.com tcp
US 104.21.23.97:443 www.imacsoft.com tcp
US 104.21.23.97:443 www.imacsoft.com tcp
US 104.26.10.251:443 api.flattr.com tcp
US 8.8.8.8:53 www.ipodtocomputercopy.com udp
US 8.8.8.8:53 www.backuptrans.com udp
US 8.8.8.8:53 dvd-video-soft.com udp
US 45.56.78.61:80 www.backuptrans.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 apps.identrust.com udp
US 50.87.30.95:80 recovery-iphone.com tcp
US 50.87.30.95:80 recovery-iphone.com tcp
NL 23.63.101.153:80 apps.identrust.com tcp
NL 23.63.101.153:80 apps.identrust.com tcp
NL 23.63.101.152:80 apps.identrust.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 8.8.8.8:53 www.z0download.com udp
US 8.8.8.8:53 www.video-converter-mac.org udp
US 8.8.8.8:53 coin-hive.com udp
GB 216.58.213.14:80 www.google-analytics.com tcp
GB 216.58.213.14:80 www.google-analytics.com tcp
US 104.21.61.200:443 coin-hive.com tcp
US 104.21.61.200:443 coin-hive.com tcp
US 64.91.249.20:80 www.video-converter-mac.org tcp
US 64.91.249.20:80 www.video-converter-mac.org tcp
US 64.91.249.20:80 www.video-converter-mac.org tcp
US 64.91.249.20:80 www.video-converter-mac.org tcp
US 64.91.249.20:80 www.video-converter-mac.org tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 50.87.73.77:80 www.z0download.com tcp
US 50.87.73.77:80 www.z0download.com tcp
US 50.87.73.77:80 www.z0download.com tcp
US 50.87.73.77:80 www.z0download.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
JP 160.16.125.228:80 anddev.org tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
US 8.8.8.8:53 coinhive.com udp
US 50.87.73.77:443 www.z0download.com tcp
US 172.67.165.117:443 coinhive.com tcp
US 172.67.165.117:443 coinhive.com tcp
US 50.87.73.77:443 www.z0download.com tcp
BE 23.55.97.11:80 x2.c.lencr.org tcp
BE 2.17.107.16:80 images.wondershare.com tcp
BE 2.17.107.16:80 images.wondershare.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 107.180.0.180:80 www.cucusoft.com tcp
US 107.180.0.180:80 www.cucusoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab433A.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA512 1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fec0f7a9c5c29376477f9b3fbeedba0e
SHA1 b982da0137e52b3bcdcbb545361f8b871ad8c31e
SHA256 e16a6f0ce098eaaa2fa3eaef57ee6689ea7b6affdbd06d2b343c3b76bb836fd3
SHA512 d6ecac1f1055a65495130d1c8176ccc872666f21f10d413e570196eaae427669b655c7de569e060313ceece4121ee7c3ffb8cb2b56ee965d30b9df92b890564a

C:\Users\Admin\AppData\Local\Temp\Tar434C.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 d76c6e92b01b7d05de443bf5ab31683b
SHA1 2672aa8fa49c60784cdb5109b9992de0ff779dcc
SHA256 83647c394e407f01fc71020dda4371c6a1131d03ec64ea8c9f08e32444d527a9
SHA512 ef22384c53f42aa4b50eed0f08c3fa08e6f2de2c6be978ac79c2477210f601f9ba758388e9c1583b811c454440c8b7d943d660539bbd461a18c7732f0c540cb5

C:\Users\Admin\AppData\Local\Temp\Cab441E.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar4433.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 02c8b9627ab088c29a3b6d4fe9da9e54
SHA1 56b30a2c606ad8c07fd61d844792284ce6768b12
SHA256 31dceff193b6fd0ccf56a00e7e66315642ede5f5baad4eac9b74f05d866f57ca
SHA512 59ca6855e4591167691f94245ed6c88289665256dd22690e93062030819e6ae85908d293007a6c42ac3b3c58eb41295f0240b5947512e859be629bc316056174

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ff494d57666a2c98bf615ad769cd242
SHA1 3c4ef3943e1455c2a6957ec49fe8f126463eb604
SHA256 58777ce8e2cbd1a48b508c79343fa01baaa26813faad8265851afb19aa40e31b
SHA512 0683feec093a4f566645d1b84a09d85a5028cc963f331984446bdea353793e25964379e9af4ef87b6b5624e7b04326926fa8deae8f2e24e2a2a4755941a79f09

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29533702f6815572b8947be757ae2d0e
SHA1 ef65aa9beb08c354df5cba9e4dea949b9e5a78f9
SHA256 fac1dfe84a6c943e8b6abcf92c59028451fc9917e9b96a5825f714bfead2f183
SHA512 6f0cc8aea6c9d19667b2a2119b2ff625f64fb9fa6e16c67f5c10e4b6e86caad15d5d9842342fbad51f8685eae108d4ecfa4a69ae30a4199cf64c995e06bfda7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fc23b55b4233ae5ab84eaf3a6ddfbffc
SHA1 c08d81cfff0628b855a7bf6654d9f4a1a9975665
SHA256 11cb830406fab2228d094a51e6916a365421d2ac85ab3512b4b13849945aaffe
SHA512 d5c2c5af9d166915b14e9c2adcade6b81e79d96500edd3926344c48878cf31e9408e19d352d338ad8771f8ff73bfe6e98e9e2c8c74312e08fc6d8b796ada0266

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf76c5c3c4c8650401c0dbeec0eedfa7
SHA1 d3c7d9dff3f5aaf9349fcf61514e6646f3ab5ec8
SHA256 9e89dc84e6e0209816bbcc4bf33191296b59cca87471a6c374aaec98d4cad323
SHA512 ba4ebdd3fee9bf161283fa4eed698c1def5c25c3335252e1fef05fb5372bd3e0c54478289f5868319594dd330691cca0876eedd5a7541e8177a6df15cdebc450

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD

MD5 285ec909c4ab0d2d57f5086b225799aa
SHA1 d89e3bd43d5d909b47a18977aa9d5ce36cee184c
SHA256 68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b
SHA512 4cf305b95f94c7a9504c53c7f2dc8068e647a326d95976b7f4d80433b2284506fc5e3bb9a80a4e9a9889540bbf92908dd39ee4eb25f2566fe9ab37b4dc9a7c09

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD

MD5 b8a75ac492b250f75d37c151815e2a0c
SHA1 a259a27ce964ac359b074fac03f98ad03a5d7ed5
SHA256 f016cc5e8df7bfdf33a2a38ac8b2a69dd22c1a65a61042c0b5a2c43ee4d4bcbe
SHA512 7cf37843d6de6841300080fc223bd6c54ebeebfd426525c8f1c31c58756b95d8b2417d6a4959163509355e2b79d21e81f169516a29a1380cc5dcfec384d7506e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87da5f024ea196f7589b0db321d27b51
SHA1 36f0da1c87b0c6784f39e8228ecf0319115b37d9
SHA256 a056f9db05b702546af6527eaa06348f793e49d1eb4e0597106c15ce69f2ff0d
SHA512 c6d63e35570a8314f9ef4a8a7b725b4605f34646edbe1578d814313eb03896aea54f6c0c6aa5ed607ac4f2b5d86e9b5b5e5a6ccd7f5d5ce2d424c27cfad07392

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5 e94607da5a44e54c8b9d46e651052332
SHA1 7abb3eb6caf1bf6a7f3514412da302e8bf99004c
SHA256 59ffac1c6db8a172400af2da6a7c811956d83f205b689405e91345431f334101
SHA512 230809f6f07c7d89fe82d8aed9f9d9421a4a1f7e4746f6e163c59c65e65ed3401be971d01e4853fa153d918bec8c2e649b3cd2d07e797888998866082722bfbc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 5c40e641e342bba75878cc173f86675e
SHA1 728bf0b1627a5af35f7c18e6fc5c6ac4bc2bc0f5
SHA256 8a6f54e9311f9cc9a9ee21ff699b9686cc2e2b5121c0e1fe7457e17fb59c8117
SHA512 930ae2a7d276cbf12dd1e26b3ad35e744898c1274c45472b63f713fe99d4494885c802f7888109240e731f809d341d63e04cc7ab32858653577ee108fc795e12

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 781930520b7f37fd5cf494ca1bd3e214
SHA1 50e141ca1188bc0b1f60e6795be64463c6f1123f
SHA256 bf9d620d19158e7433b1d0a75044b8721a560e94c4d1ab67d53c8a85108ac4bb
SHA512 b88ce4c6351c96a3d257e37ecc542d3bb7da6d0a94b0ea3cc875c125c424fa0f4d58605ac255ce03e9ef6144e00a35e3e572a5f1833a1737392f54e1c6a30161

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf86154cbce92245b9fd422295c0b238
SHA1 60087883075af9a533bdc00d27bfcf9e6ddae24d
SHA256 fd53a04e8b884798b34f2c06b9dc450e3658a30ca5dacc5398a9cc679af49322
SHA512 8d2cf231bf32a82fcf87726a29fdc2098008cff2647a0f0a011c00cc6a06133ff1283114d48fff3c8d9896a7cb7b662ca72be42e4a09fa30eac30a158dbe0574

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 72323c81b82c4828efff57ec76c15944
SHA1 1d16f60771b8ad4972bfd016f4767969e276bccd
SHA256 70291e812b30b39f6105266e9d00f31fb2c329b3b7f4c6dc92f4853f95da8155
SHA512 0d920e31d60720ab26747f9b42a81a052a8ec69899510a2e67098b11e58b6680c3205747db098f04335e8aea9d8122981e01ffdd1fb03e1d170f3cbee116208b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f109e9f679b7e2150b9df75f70b5af07
SHA1 62eac24284ec3a93742e36f1f72f18c9cea7872f
SHA256 7c458b7daa79447f4eaa4b75c99ae1f7d347397905081ca3e3d4f6307c48776e
SHA512 d6504afb788a3957a0aa9553e5b1d4872cbcca8383d20a21e5a281a4f0021cb82f2af8318c8fbe657158c9631bb872c80824a600999c3d8c4b4f38a0cc0fe557

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2805b4beb8733dc838b81cfb1597cd02
SHA1 c2beedffceaafd1ac2d80f60501bd8c048761725
SHA256 2c4a082e4a65682283145d9207d41cf05245a9949ef71640fd63265774ff62a2
SHA512 41f63cda500311f05c2d6ca617a60edd0d6880f2980334375eb6f987517c48e4ce29f9ff2533ba5e71917f6da21ba4c66349f9a5ead19a3e2594910bab03bc97

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 80b9af3041fbfda860e4f813c16908c9
SHA1 8274caa9f33ab2c4166991e63850fa8a1a05c1e6
SHA256 b195f8a279ca2a3d96ce4e1a0865087175a07905b296e7095b9afbfd5774ba3b
SHA512 571d07b9cd45344f0494a6bae18cfa1b5713236c19a2d32793576376dd4b0afd697189dabf64c878ad910364b3731cdab565246a941d75ce17afba9883e1349e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 33adf85eee51dfd1d75d6f722f970b7c
SHA1 d861bf9aee1e76755af0cc1e9abe0c2e848335dd
SHA256 0c0ce7656d5300c8fd1c94c8d2cf5187617813e00db79cffeb37087d1e4978d3
SHA512 bfd64d1c017a94c9627684392d0a830d33f4f9a40df5663054a30bc3641d1aefa7179438abab351f523be66825a416da8088dce2ac94d352e8e9f7e576d4f4c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53e32c4b9d870e248c2012fc6f0888ae
SHA1 d9f512292f45ea969cc006b3a909721112dd5474
SHA256 d65287a40d28ec75c143df2887742290561bbd39b3afbd1159e42de644b02069
SHA512 b355ef5bfc1c4b5bb7cedaaf547a415dca27d46559892d8504f3edea54f00140ad3ad21fde8abb62863c21216304c066b32ca4c6cc81a7232266c0940090ba4c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57b94b50a76bbabf331180e9b328a714
SHA1 0fd8327113bbb79bb92e1020c805d4956eae8dd3
SHA256 afc453f0714ef1dcba754e7af3e4bc3e4d9e2ae9b7a1a17436cc39c7eaa02840
SHA512 89c431661d6e3869db1969503d20a58cb49f34034a34e247e2ad0797edff40587fac2d20818ec0e82aded8e7f930b595a3b52e4f063c79ba99c5feeebb83aa2c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91676b325995a7336867bb2d56e5f586
SHA1 220a06d89cc3cfa063dc8892eed68a7aaf0ace52
SHA256 fb7aa718fa51c933c2b961634c1d1a32b45e83ce9c15a795532802696be7b9aa
SHA512 a75738aeed995e0a528fdaec8b62697d2d2fc9a42af60dccacb98fcd00923e78d71adea2f858a0e3df41f52bb112a37606e6ed422f015d90ecad57aa728260a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f121b554a3282e75a74f87c4757c53de
SHA1 5299bf9225038842b379c58988f3a2057a71de3a
SHA256 25e43cb0e406fc46e4838f5ba435a8bacf361220e44654faa9e6f28ce71bd9d1
SHA512 1bc2f08ca04f7b8e777fa90a02d6d192ad808cccb69a87ade372b3f1e90ff6850ff1429598d716c7e3fedbad4f6525524c2309ae2fb60b610c4f398ebb5586c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6244b42568302dd38ce6a0731b3fb4c
SHA1 e1037b9b67f1b29e697e0410446e4846c2b68bb7
SHA256 e349e2c05c83ffec2c24c32de0011ae922e6419f1fb29fe0f9f8eda4fd36ee85
SHA512 f0f9db975321d5463c22462f4bdae5029327acb2d4302327ff67de59204cb0004aeb2efd9975580e24e70da36edb9ef521ac696822a34159eff4321e5a228e65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 54c5d4abf5b0fc74c6501286129576da
SHA1 6f7af979d030943de755edb309b9a0ab14786b75
SHA256 83d58f59f7453b95d1cbb5085e019a0c09b25727b7d8d09bf146bc27c8a4a215
SHA512 9c49616dd974a8de63015ea5db2d9667a4877765f07488bfc73a3ec61eab72f1142c8c1e5669edf1ad67c5738cb429525be193eb10d1cdd88bda2fe21882d653

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2035079ae509db784a6e54790e030119
SHA1 bb4c525ea6b6044fb8f1de1e7544264b5e684048
SHA256 f3d232fe983491091e0c81940da0449b51024c4365596f58d29cc1f6c937d6db
SHA512 58300ffbe90fbfd5f83458df3a26d12f2ae3a5afd0a345a70143de666f6ba92ff3e2866100ab31c1b83fc9e87a0c7b94b950ea83e70d101d189d098891e99491

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ce55d47ee556b1af2617ef920766435
SHA1 abeb0d6d4f7408d78652d1ac9e85d4e5bfd31e4d
SHA256 29de2a59c8b0ab4432fd5442baf66a5f1765ed9454a0825cc08c8642089e3b20
SHA512 d66105aed108da5ab1092e36d70b7c7294af23e2aee79f537635f342999255832f64eedcd1544b58e6a54f9580a62631aaa81510eb2bbf444c72f64a643b39d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 704dbdb155951164759d9eb456c9bd9e
SHA1 b4d0be22587f97a29a6c3d47cf5552868bd43eb5
SHA256 0302ee19638dd501b491c3c3bce0c7264c77dbc6b98b5b4eb068582b79aa76b4
SHA512 9bf3dfbde196f9e0c37bcd2d5b83c6a0d60455aa71f04f84165246770755426f00780a75c0fcf93036f670ea2108b3f89d431407bdf95616ea3990c3db0b3384

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8105753064f699cffe97a2a3e55f1ad1
SHA1 ab1b47edc8dfd15273875e04daafb1d206c86ade
SHA256 cdb0deabae07cd1042fb191fc6b9bd22e213c11c0efe893c625684671bb555d2
SHA512 147ada8556d3c7caf5458f3dcbf7a6b3578d7ab304d4349ebafb2d2c77bd63a3521d91a82d00f30651242f78a59edb2a101b6d6460829934ee9c5deee1c7c303

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c21389ab3f7da9affd7f423bd009f843
SHA1 fb53609bcbb30fcec1b41fd5024bd866ae3517bf
SHA256 daea4280f770791615c96f9849b58e208d8a99f5c0d5fee26711a6add0e9e2cf
SHA512 e7f31a243aaf857e26b23e5e430af71a44259f5cd967a2e025d5b213de94aa10966fd2ad78606c589409c3403b92b658bc6eabc1996ed8c44ee0be554ff2f4bf

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 01:05

Reported

2024-06-02 01:08

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c67c07a076a60ebf808528f6b96620d_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4940 wrote to memory of 1056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 1056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4940 wrote to memory of 3992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c67c07a076a60ebf808528f6b96620d_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96de446f8,0x7ff96de44708,0x7ff96de44718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2683959140087850562,5276317767666442510,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.anddev.org udp
US 8.8.8.8:53 api.flattr.com udp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
JP 160.16.125.228:80 www.anddev.org tcp
US 104.26.10.251:80 api.flattr.com tcp
US 104.26.10.251:443 api.flattr.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 251.10.26.104.in-addr.arpa udp
US 8.8.8.8:53 228.125.16.160.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 8.8.8.8:53 anddev.org udp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
JP 160.16.125.228:80 anddev.org tcp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
N/A 224.0.0.251:5353 udp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
US 8.8.8.8:53 www.recovery-iphone.com udp
GB 142.250.187.226:80 pagead2.googlesyndication.com tcp
US 50.87.30.95:80 www.recovery-iphone.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 recovery-iphone.com udp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
US 50.87.30.95:80 recovery-iphone.com tcp
US 50.87.30.95:80 recovery-iphone.com tcp
US 8.8.8.8:53 95.30.87.50.in-addr.arpa udp
US 8.8.8.8:53 226.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
US 50.87.30.95:80 recovery-iphone.com tcp
US 8.8.8.8:53 images.wondershare.com udp
BE 2.17.107.26:80 images.wondershare.com tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
US 8.8.8.8:53 26.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 www.cucusoft.com udp
US 107.180.0.180:80 www.cucusoft.com tcp
US 107.180.0.180:80 www.cucusoft.com tcp
US 8.8.8.8:53 www.softwarebbs.com udp
JP 160.16.125.228:80 anddev.org tcp
US 8.8.8.8:53 www.imacsoft.com udp
US 50.87.30.95:80 recovery-iphone.com tcp
US 13.248.169.48:80 www.softwarebbs.com tcp
US 13.248.169.48:80 www.softwarebbs.com tcp
US 13.248.169.48:80 www.softwarebbs.com tcp
US 104.21.23.97:80 www.imacsoft.com tcp
US 104.21.23.97:80 www.imacsoft.com tcp
US 104.21.23.97:80 www.imacsoft.com tcp
US 104.21.23.97:80 www.imacsoft.com tcp
US 8.8.8.8:53 dvd-video-soft.com udp
US 104.21.23.97:443 www.imacsoft.com tcp
US 8.8.8.8:53 www.ipodtocomputercopy.com udp
US 104.21.23.97:443 www.imacsoft.com tcp
US 104.21.23.97:443 www.imacsoft.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 www.backuptrans.com udp
NL 23.63.101.153:80 apps.identrust.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 8.8.8.8:53 97.23.21.104.in-addr.arpa udp
US 8.8.8.8:53 61.78.56.45.in-addr.arpa udp
US 8.8.8.8:53 153.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 45.56.78.61:443 www.backuptrans.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 45.56.78.61:80 www.backuptrans.com tcp
US 8.8.8.8:53 www.z0download.com udp
US 45.56.78.61:443 www.backuptrans.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 50.87.73.77:80 www.z0download.com tcp
US 45.56.78.61:443 www.backuptrans.com tcp
US 50.87.73.77:80 www.z0download.com tcp
US 8.8.8.8:53 77.73.87.50.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:80 www.z0download.com tcp
US 8.8.8.8:53 www.video-converter-mac.org udp
US 50.87.73.77:443 www.z0download.com tcp
US 50.87.73.77:443 www.z0download.com tcp
US 64.91.249.20:80 www.video-converter-mac.org tcp
US 64.91.249.20:80 www.video-converter-mac.org tcp
US 8.8.8.8:53 z0download.com udp
US 64.91.249.20:80 www.video-converter-mac.org tcp
US 8.8.8.8:53 20.249.91.64.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 64.91.249.20:80 www.video-converter-mac.org tcp
US 64.91.249.20:80 www.video-converter-mac.org tcp
JP 160.16.125.228:80 anddev.org tcp
GB 216.58.213.14:80 www.google-analytics.com tcp
JP 160.16.125.228:80 anddev.org tcp
JP 160.16.125.228:80 anddev.org tcp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

\??\pipe\LOCAL\crashpad_4940_LEHXIZGQSJMRLASL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 655c666014ee5afe9984301014ab8fde
SHA1 dc80fab8763b5b56e51505214e5c99acf382da6b
SHA256 ce47abf1a03852c5ca4d1821be04bccdb96068cbae4d0cd90490b29bf7055f44
SHA512 43f880ceee56b24a88f92e56658f62b195a2aa28f2e8d8b2f38df7aeb326f94f489504c93612bacb00dcc24700e76bef8e70c7b11c4318a3054236758a8d62fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 903ebccb05dfdc4ca5fa6c69e7a3b070
SHA1 6a08f1dcf9010cd3dacd5775e34b7e8073eaf687
SHA256 884ecbfb7ba2680979f66831dd89d94e66cd4685cf27d7e468c71454000bdd1d
SHA512 9a0add78c829cbc6cef5238718d3497b7fb3222ff29af933b3a3786ff30eefb1688fe16ddb8a3ad565c78458abf1af2d6d637f020ba02e387d25a31545f67244

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8ac9f2ca432178c0bb1db1aa824c0b91
SHA1 b9dde632e07fc6e7105b46525f19566e2f9bfcdb
SHA256 0d4a36878ecfe72b11321803d79c5e84b0e2d4c9af560a4184d25a3ff18b4283
SHA512 db93ba759451b8f1430d3838f60702839155b302aba764f74df9c79df4a88749d64888b3d9b770c616728c0c3632f94387d9d833515dd56c6489894567c34f5d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bc2e2655c048c674ad97e142a22c4726
SHA1 615e735bf8aec124a59c77527ab38bd5f183dca5
SHA256 1d092da968d0a581e43d61f03db8a99613f291b23d36d568d5daf7d379f5f543
SHA512 f19fb777633947d0a167fd57e7b0806e99b23c772d6560619650a640325d574443932563a92f0aa3fbbde5d454cefc3779115d035b2ab530638e590cd8d6b240

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0cf5ddf2674e6d50e9604fc1f364e37f
SHA1 328d94d60b1af249957164bb6c1d31f3a7554e8b
SHA256 f876a4d2bd5d3ca00b3f5770f631e49e45d61fe13c54730dd497664e4d5ecb07
SHA512 c18597103577cdf2ccadb9ed560c5420cfb491f3fe43883c30c2072e01e656bc240e8387d841905dd2b7ee78504d764150e24d154fbee504bfea4b8ec847ff91

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a596.TMP

MD5 4c6c89f38b0efdb642c4f8d8576139c4
SHA1 b84b13dc4564f47419027ac8562d7e2e572dab97
SHA256 a1c7bbf5db06c707ea25e5121a9b3059ad03210c08fa5b46006088a9dc022f1f
SHA512 2c3fcaa7fd1a8dda5fe4cb791d09d6c78710245e8bb685bda4d7a91f3694c10edfc400ce46071275ba7d3b717ea206be45dc4da33a99151595ad5ff49301fc6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8722caf9d688daec0aa61d3764a4c76f
SHA1 29c5910d31b1f88c8f9f580ea132daf037af66e0
SHA256 445523b8afb278b019882ac11cd060c2128d920e1fd78c7790e956a43a743401
SHA512 c1247ab8980c6f283496ec4349280e29d54a3ed3c8c64af7ba274ea94857e7e3ff80cb57239bd630b0d4f59732c455f8eb84e8482e5398a1a9e6632d19abbbb9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 25152b1a5c839835c2af4764bae6b546
SHA1 0152f8ab845fcb8686fdb71906e0b790db4a58e1
SHA256 1e23a90703b0fec2c4778178ae831adf19b61cb0d810c503f2220133cb801983
SHA512 71da9e889a2a608721def577174a94df9fc7704741432e449a246990a2c251dc1d7e4668fca2f1b4be2a4477dbc62717d90b30d9f6539ee5e921efd91116b78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 4e63ba653de9c65c0eec3517efd85188
SHA1 1dc81a4640396c0aed7bf83bf0bc9d7164a55c46
SHA256 c7e8b103e8d8ab31805a9f6a244472f8e856a6ff0d786800683fb5a633f651a1
SHA512 f9196e22a20395e2c7984ce3d22b44ab731d052941625f2f12a550a7bac2642b71b81c7f91bfeaf36f2d2d5e7482706be028c1e9e21b3fe600600daa28bfd322

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 0e4211bd81fe950d351a572bb1f91b25
SHA1 9855fa8174583b70995126c461b6b519dfe36ced
SHA256 6f2b0780b5e9e7ce74bf8a285160abdd94b99c8168e711543e7d4c85db7dd9bb
SHA512 3a16d9af64e5c7db3b2efe95f6b736cb3dbb6555575ffcc7cb3631b3bcaa3969ee581ac68a32b9475c2783dda81ab1a56131cf3c8e2e6a8603726d420c096326