Malware Analysis Report

2024-10-19 02:45

Sample ID 240826-evrghsvaqb
Target c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118
SHA256 870951fa43558a4b54f40acf047fee94d726440baba12510ec129ee2bf4ffea6
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

870951fa43558a4b54f40acf047fee94d726440baba12510ec129ee2bf4ffea6

Threat Level: Known bad

The file c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

System Location Discovery: System Language Discovery

Browser Information Discovery

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-26 04:15

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-26 04:15

Reported

2024-08-26 04:18

Platform

win7-20240704-en

Max time kernel

145s

Max time network

146s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000a7fb460cbdbb3d31ffb6766d790af135bab1003c472ab29d2026da3a87a030f7000000000e800000000200002000000075a945a86ca03f8bf44288430e72fc641d5c00305b4d0ce1af96539f01c165749000000013c9429fa20ad5e31b5a737368b96712ac5fbde2e59dd5acd4995a64d069a3e864165daf0cd2e538aeab8104b057180015a7e70fe0ab4a2ed689f7df1375fa908fe96995a7d4f85ae6c4a565de953ffcf57abcfb56d625e39df7882070a1d66f8791a8711a2b2e9fd277d52fca1fcf95ac48e806dd46285dbd659c3a17b7ae830104bf1640e96f49946d11a13b38850d4000000011647131aa4ec1dbab3c03a4d3270a8fcf83cc136a53c3741867f61a617ca87c328c413651a3a54e48018197ca69ad9f6cfb1d6d57fd21f897ee01d7331cb578 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407f55c16ef7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000b257a95f85ffd614f86f21517cead59fff471bb0d94b3abde0bc392b2043b7eb000000000e80000000020000200000002777285cd8a5f1d37b766ebca39c5fa7aaafea226ef6e09472dcfd024778eb2320000000cc8a4911b98665b73726a7803db4fe495a2dde6f1d5f88d992944db319f7c08440000000cf223150c7d0175baddb134ab316f19b56282a6446664d824714d377479b8cb714e6944611173600933073c0c548bdb904ac40437043ab03aa56140a516740e0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7249A81-6361-11EF-85CF-667598992E52} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430807629" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 bloggerxtutorials.googlecode.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 i155.photobucket.com udp
US 8.8.8.8:53 www.auto-ping.com udp
US 8.8.8.8:53 xslt.alexa.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 apis.google.com udp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 172.217.20.202:80 ajax.googleapis.com tcp
FR 172.217.20.202:80 ajax.googleapis.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.75.234:80 fonts.googleapis.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.75.234:80 fonts.googleapis.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
IE 172.253.116.82:443 bloggerxtutorials.googlecode.com tcp
IE 172.253.116.82:443 bloggerxtutorials.googlecode.com tcp
FR 142.250.179.105:80 resources.blogblog.com tcp
FR 142.250.179.105:80 resources.blogblog.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.178.129:443 lh6.googleusercontent.com tcp
FR 142.250.178.129:443 lh6.googleusercontent.com tcp
GB 216.137.44.17:80 i155.photobucket.com tcp
GB 216.137.44.17:80 i155.photobucket.com tcp
DE 94.130.218.80:80 www.auto-ping.com tcp
DE 94.130.218.80:80 www.auto-ping.com tcp
GB 216.137.44.17:443 i155.photobucket.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 142.250.178.131:80 fonts.gstatic.com tcp
FR 142.250.178.131:80 fonts.gstatic.com tcp
US 8.8.8.8:53 accounts.google.com udp
IE 74.125.193.84:443 accounts.google.com tcp
IE 74.125.193.84:443 accounts.google.com tcp
US 8.8.8.8:53 www.google.com udp
FR 142.250.179.68:443 www.google.com tcp
FR 142.250.179.68:443 www.google.com tcp
US 8.8.8.8:53 www.statcounter.com udp
US 104.20.94.138:80 www.statcounter.com tcp
US 104.20.94.138:80 www.statcounter.com tcp
US 8.8.8.8:53 c.statcounter.com udp
US 8.8.8.8:53 s10.histats.com udp
US 172.66.132.118:80 s10.histats.com tcp
US 172.66.132.118:80 s10.histats.com tcp
US 104.20.95.138:443 c.statcounter.com tcp
US 104.20.95.138:443 c.statcounter.com tcp
US 8.8.8.8:53 s4.histats.com udp
CA 149.56.240.128:443 s4.histats.com tcp
CA 149.56.240.128:443 s4.histats.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 88.221.134.89:80 r11.o.lencr.org tcp
GB 88.221.134.89:80 r11.o.lencr.org tcp
US 172.66.132.118:443 s10.histats.com tcp
US 104.20.95.138:443 c.statcounter.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 92.123.143.234:80 crl.microsoft.com tcp
CA 149.56.240.128:443 s4.histats.com tcp
CA 149.56.240.128:443 s4.histats.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 36c28093e15de662f68d1625fa5b6d8e
SHA1 0f8ebfce30e800b697dd2f7f1fbfacb0c1569303
SHA256 0d0095b8f059db90c99cb23ab6dc6fe897ad7ed04f5e5cc8488971fe151fe89a
SHA512 cfa24a1f4b615cacf7d8782a51c4528967f5ec4c73f0d7a5d74620d5b42118e31321b862a178a090ef16a869a6b5c1dfbc3503cba8b16d1d0fcb4f4c1746c2c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 45af86c3a4aa2ff3557974b71ddb7acb
SHA1 3608ac374f7730ef16524b1629f22d369da46308
SHA256 1adf9f1fccebeb189d66235d8d95b9d3f0462a28012b5b04e990c47ab1eccf0b
SHA512 3e5039ebbb6bca1e19dfdd9fec0ad36aaacbb2a10ccd6fc3a447ad87f5ae23ba91d831173d514a54daa6a9211e9a41a91d617e12553c7a93062221f2bfb25ce2

C:\Users\Admin\AppData\Local\Temp\CabE3DC.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarE41D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63470410425b091dfa13086207507ede
SHA1 466409cfa07208b3626b7947453ab1575ad5684e
SHA256 51317d1e446cd19a03c3282de5513513ba5a08f8057aa2e76cbf7294c28e8259
SHA512 a97e3f33b3c3a612ee8e6ef421e83f16db6eeb5dd76d7aec71ea0ed67fc93eb9e0cf9f0fa7af783de5a13ff8156c4d2db85bf5360cc5d6d99a6806b7bf26c912

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e7bd8fee5e6a338b7f92c3fa2a5f8d8f
SHA1 10c37e45fccb38cdd0c5c5a2676405188cbe222b
SHA256 19b68b046dc80af6edf8ca94975fd9f2563f825f02a3c3a4fee25dce48a18d32
SHA512 a26d0019e609ba1454097ac9cf690c3121258a8e8f85ea85ca41a9da72a55b4ecc9b0b6af77147a2c93d130e09c72c77f1efef8c3522959176d1eb7371b22a3d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 219517ab74876f263f36f8244b82ac07
SHA1 16cee57af582ebf0b024d18e7f653520447350a7
SHA256 e96e9a29cf8ab49daafcca89ac220509ff00cb1092b9d2e2cbbfb6ec24b9d11e
SHA512 870c4a29efc6f3013588dcaee7372a9e6b1f1c3468a8e0d5e5422b862b6283093bd64563aa138d070ae88bbe0aad2ce638c284b722fe852589dac85f070acdb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 35317ef296dc8f72aeda44313ba5f4fb
SHA1 a708ed1768b2adad62de52e0c9bc0ddf39fa373e
SHA256 e5afe68c7c793ca929a269386e3fdc2f9da62e3a332331dcdfac940268f1e028
SHA512 430e6e695530f1d07556b1cb34df0acf5a23442700b4d2f3dd74fb8c841f438a37e954cda9f11d7ced5940dd32946e40ff8d457242aadca9abe07eb77d52a54a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 49e8c3c6e59556aff9e9f4ff32950c10
SHA1 38fad9f8ab9477af56492b97033b1bc5d83363fc
SHA256 a8124264e92ab8b2f3703dc915108c8aff8b3c9c8eb5e5e0447222f2ad3d6a69
SHA512 7a275b5d60b24d6797271b85f68567b37fa86c1e5f2cf54b66f2137ad0cc025558644860dfeb2eaec4e4c4237dd89286661d73af9981852f8c12a70c3191f28a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c40e62ac61c8e9ebfe56eefbf0c08575
SHA1 cd717bfb64a92f674940172ff113789596890f96
SHA256 d8a833f08a60bd155641a7006ec14ad7c64848992a0afb4737378be8dcaebb50
SHA512 af799538468b90c6aa38fc0cfe50d150bd7f83dc352768e6314a584a8e9c50e17d3bb33d4d60d39a7814f818ff52d55e2439f9211f563033308063b05f7bf4cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 68afa95886b597d492ab37eb31255b55
SHA1 0b10f23f866c313bd91aa42f555755fd62631478
SHA256 ced8585d18ec433b0fd1b530bce69c9d188c85fcd529a5fa981b6374dcca95a5
SHA512 a7d2dfc2d584f250bab75dfc536ba4d0c936931faf25ed0f806cf2070254ca9608e39d945e3ed15c42c89a869b2d57d1fb1e000a2c2250e3f39e2e1cda482800

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11a14c643b943ca62faa9aff18bdbdf0
SHA1 6d857ef285c905e765521bda66cf56002d40307a
SHA256 0138a11b48f20bd58b4303ee0409a4cfdfe5b455b22fa65963e6325c1b06def9
SHA512 447d15b2e070f5f12932f59c0ffea732eac1b5e1c2c0c685985fb5c151cb11c2852ca712c6aaeeebc7f6a8be63154bb284480e4276b1070ab7472bf4278593f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cbf957db761b3712720566fae3d117ac
SHA1 6e9ba30087c7989b3aa6bda42bbe037843013e99
SHA256 9b0929712584fe8a673790833c7f7445cc39dd7188e6d9655b70d1bcf3f71754
SHA512 9d5f47c46d3d7531c22cb6779f0f7d1c42c28b3ddd63b55e796260a56afcc4277a8f8880e112aceae1bbd2e610509828b0ddf804322fb4447257fbab0cf82948

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ece40f8aeb0329b5c74101777df28ec
SHA1 2a92b2bf3d824bf68e9884e21249d513b5f955d4
SHA256 96af486e274f33df3bebd971f2cb96cf51b9a8a8851ae9da626fc6ff2fbbd489
SHA512 74c8ef2c1610381ce53b5885654d899a0eec85d093f707bc8d88458d4b87a4f6cf1592e3e073d30c647068823080835115ebd8ad133e10949ec129d395035dfa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 17ca6477073bc9f3736cedbc745075fc
SHA1 18e940c8f577c7758574f87af050c6392e1ec381
SHA256 cde7839b4e1a2c78d05a8f87f8860316be6ea01b5c20264306eaa82909b60573
SHA512 92139446e98720647dca09fe26fecf5b261ae79a3c7f94ce0a05509c5e229ce2a0a7d3a74901a6402589a6eee58f385913f64f1d237666ad8070fcedfef51ce6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a1c7d5277ff74f9689b0bdc703bdcd1f
SHA1 52f00d01e6fd427242620f994b35b12f284324e7
SHA256 9648f7cac8d12e2b166c3707efd40f72d5da44d6f9394e77bed41c66e60de6f6
SHA512 75203d6f901dda65599fa7b26b620de0acdbd69da6bf6242e6c0376336155ebc8e7ae0416e620010ced72a0cc68706f2f29634966d8449f7942bf54e4625bb5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f4aa2a0e3d395ce4f7c14d5ee2c7bbca
SHA1 0bff1bea0739fbdff7b8b915edebaa5b30f289f5
SHA256 722c0fca33d41e8ef5644ca075982d19db4bf3b16390bc5778739367dc97e727
SHA512 c03f794518e81649b919521f46d0627dd6316db28aa1c02203db0ed2c9f21e0011bbfe7c5fc4c5f306956f25e53bd222d76046eae512fd764b633219425fe546

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 50f2a7fc0f1b43005f1436bd783f9f20
SHA1 ad40369eee4efe45e086e4b27e2ec9ffba332969
SHA256 01d61a4f623786cb6c177d6b5feb718c5c45f61771d6575b0b54da6f769580eb
SHA512 3c07f2925e9bb06074a7de88fc3500b4dad7176e66d8795f1930d198923f97a20bce8ee75c623e3d9a4be61a46f1986a12eb142ed6956d754ee66450550945ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fce65cbe3ee9ec91c484f5d4e3e83f69
SHA1 42c95775d92c6489fc3824502ee29c1fb0b9b81e
SHA256 dc333d08f60fe1d6a9450dd172e40e1f3aef8fbc1308f73c76ce834fc001c49e
SHA512 f557bb5e7f5d3dad8908a616565bd52c3ee2ae2f9159596184f210195a8de1fa93a39b79f9dee75ebc3252c7266f79555018aee86bdffc47f21eeb8a0d1deb33

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e7a715cf896995724b4b42578cd3fdc1
SHA1 72f0468a7a3b5e988baa5126ffc02a7a7a95e75f
SHA256 38eaa03639aeda528e290dab198c6c68a76b91db1edc85ebc70f7b5e21cf2a9d
SHA512 d565a2bfcbe7afa6d93f9ebf1e0e890bc539b7a8166f3fbfbff5f73bc399fb33d43cd880e28846f7898b17a7e46c1e9e0d3aadb4f43345bab9b343681fc58416

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7206e75cef0a4211763eccaee3900f12
SHA1 3558ca2df9306fddd52f5653e626eba5378077a8
SHA256 7a9fba9d5b3f7a90b95d1162e67620b5faf64dcbf3523f9496735383d1c15954
SHA512 5fdd783d699f7ea05a90b9443a35cb9c10f3d2aba408f5c75df0941c94afb04196e284dc66423e798fa5a5397d03fcc4b7b5a5e3f4998761167d9f40a79c2b7c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6aca363c1aaf2b23890ea410318d32d7
SHA1 29975daf990424a7da1a8d412eae22bbe0c4b40b
SHA256 5f825bdcc199887c95639d499cb7c143ac58e87d4c147f899d167e8c1f9b066b
SHA512 b8e3d81fde0023b7fdb541bc332aebc923481506cc37176867e1863c69e29d39a3a13d81e6c0b5137d9b5048cc8ebb7149b6268f4a389d2b8be51b579e1f1e9a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eacf4d46e359a8695b38b3b6025a55b4
SHA1 787627bdb728e9df17c39ccf98789ab79010cff7
SHA256 a5a49f04a1a6deca6de9ec7ae4f7f52310f77392bd0de748ca7f5e326db7015c
SHA512 5cb6000a1944d651224beeef579b376724dfbd34f158c85f3ccc460f655213d6ea143c585c67c44659e9b966a079f67365d67fc8ab60d6db74840139344b284f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d884bc204a1398ee7c2d6556028ae2f3
SHA1 0c02a3068436b9907a8a355253a0b08860fbad4e
SHA256 ff2528e8458901dec21ffc298ed32f3c95eed1d776cd3a9fed43ba258c1e47dd
SHA512 cc12936b5f7c2891df5236f0f58715cd486b972c17309df06283f9b31eb13df4d6361f25435b9b81f84f30118e414e2aa09da214cdcd2c7bead485826391f745

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a044ab2fb9883a0d1cffed4794d4f022
SHA1 e8ff58f898d35848d988f23849728c957f05f060
SHA256 e71f7a8e5a827ff8452fc004177dbffe6b9ea99b1b432cacbf08e29995f89635
SHA512 e882eee0f2e4cc9d3f4fb28a5f08642babe663d6fbb01289b0c252f7508221d29a839b0adc96ff310bdadf92385af9aa88227ff87f486aa6410782e4a16a0268

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c9ceb89ea5878ea14dd151c033c05c4e
SHA1 93086de858b332404144d0e798595fc21c789f82
SHA256 578e707b4872a71eeb42007c9c8327300947d1d2cb41d4ecc718d17d5f74e2cb
SHA512 b63687115529dcb473c6f7c36fd077cd0090ca8dd9dd4fa3960d384a15cc851647e1138a8f589cc5e63cb4dd0b6c7d0d71013c5b529f2cf770d3681c27d5cf28

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b777698c8c59c8449a8da214f37e52c4
SHA1 56a5bc802b148f6bcf111c1361d5390fd347c07d
SHA256 47c6933ce9b546ffc69c73bc049520086b13f6387212cebecb01e2c5d688cf60
SHA512 42b72fa8a6d6ec3857610233f255bad18fc5825c4c491175abc6ac15f47152964aaec3f521c02cbfc4a27dd727aeef8697fbaa722e75612b3f55efd14a38a59b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 06e66b97d8a906cc86878523a3e196e2
SHA1 9a86b7f164218cf929751a08bc9a9ffd6f2c3e98
SHA256 25424db130bbc16f9d377aaa0790e6e658ee1a3a53e792920c972338e9bafe1c
SHA512 f40188e172dd681d650f5d743620b731549e4ede7d775548b8a3751134deca17f2e31f301f76d641b871e0b59689b8a2e77c585c5aabcaa6969e64091d6c1bb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4fb56afee2c47f7bd0962970e5cfc92d
SHA1 6cebc933147ba9d8564f9827272635a85bc82f71
SHA256 4a28f633d759baf23bc92e16ddb7f2b0ac6705b26a7cadd3146fba51767306f6
SHA512 6820c59c3f54e8236b9c259161e537e2f8333547864a0c161cf0504f39835b46942b26b21ccf5286ab6ee0330408018bfa492222f048ca8d71ee5aff0493f681

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc03253fe2fb6fac66a2a5954dccb00b
SHA1 7d0de256f4e441a0f43c6575126d5baa1921e380
SHA256 df3e2440c5cff053b3ea7d29ac4ba88736d6754251feafea691e09ebb60445bf
SHA512 eed6c5c57c19c097f8613a41a1291eed03dfd8afc645c60444a91c00258bfbd05c4f44039009cb568e30b4ec7889a8069d70ac930297a7d4ec045d1e16748693

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 2c1ef9cd2151ad68bcc10dc4d332bda3
SHA1 2e8b8bf5b229c568beaad277d11bd4804ad8418c
SHA256 01e071b60bdc106fd941ddd4b7846b493c8ade9ec4a0a19794ac65ea443f3345
SHA512 fbe2e342049fa45f395508026a8a30f47b60e8605cb758b890a6947b162bb1c5a05c232d2c0ca961f1c41fcb2c984d099ca9ab7feaff9627fc9d2499e30ab03c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1fc3e0adf7eedb140308007ff716896e
SHA1 109477a232dce673fce3bb612f8a7ff90127e89e
SHA256 7def0b9f285a3f1d3536b6c3b7cf0e8e499eda6d045102e97de91ca2e7fb5909
SHA512 8ee39f8fe2c94b0ec6b8c4917af4ede836cb39f8c9bc405f4e6433ce1b390bea69b6a2bb1e157563c89d8e31de6dd5f686131bad007cad7a82cd2dbf5ea6b4a1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08a0270e0e441452202d8f529743fbce
SHA1 dc42f85367b781e8ab2a44d2f73e0ddbd1a6c4ea
SHA256 07ababfc57af743ec04a0694d506c29a07ce91889e6bb23e6eeeaae2c1f58efb
SHA512 4669ed0139f577e1fab88468e2f18887974c01f56328a48fd417b74637cd75b1862ab5e5cda61f477b3ad5a395a2ef88f94809509f545332dc0d8b1574c44da6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 98cfa4b1027f15fb5fc869864f928ccc
SHA1 03fc7b039d7713e6dd2c4bbd024154a83b0c79d7
SHA256 f29de22e4fb942b80e13e77932ce0feeb1b1218ea67062036853fe3587a46d5f
SHA512 36bc3759205dd4af59a8ce6dd27cd716e0f1eb38a5a5afd22a2a0966023eb2d78454803698ee8ffa8d4170efcf6db70e1f65f14757ab3b381c1f1a86ecaf4abd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 008cc4407fda2d4686ca064b5d395b4d
SHA1 a7f64a61b88050b94de8bf159df3431a0a658303
SHA256 758246cc98e3fd3e6a6e1b20c8d688f882619d50982b90d36adf7cc0ec8abd7f
SHA512 5fe33ad43dbb865b8c0af8f9490168c521e1ed3b5d054ee7031fac339a5cc4bc7fb58edbf68e0756cd036b017b5bd9bd7023a284199f0bca34e01f6ae0fa7129

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 32903bc0a6a3878951729f2c4ef927f7
SHA1 5ababe2d83587dbc1f62a9a3b5a31a74a9f92aed
SHA256 102d017ee58363c302d46dff9c7629178ef855c3925da3eb672fa407634342e6
SHA512 c8ed172bbc84917aa681dd880811fba330d956dece6a466f632e89229a656e739633deca521ff415a575374255e93bffb390500f55c7f5c899a47ad3cdb8dd85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4eb0b55470bcab19c9538e1644b3435f
SHA1 8044f676a57a71b4affab94a4f00c89d7e82a66b
SHA256 f274b830325412f97f92aebcad9167492fd9e622813c418ab19385b0d1676b19
SHA512 31cca65f90a44f309554619864510726c5dbbd105d440360984e2e73fc4279f5564b49c19985176b8648e12d2ad93c84b93ee7f63bb379018fa9651a316735b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 42fe1365393e9390e4479f570004d490
SHA1 6857e3f3510d9ae00a350ff65e7a6a621e17ce3e
SHA256 2cfc116fac5ec511d762efc518f120667f6bf03f169a71f36f41d71bd0685a90
SHA512 b313f50c07e31fdf0f93cdbe5a322e845a7ffa5eb6ed99daa52a5ba10364f3fd5d52d09e7c0118392f55c1ec446b74cef8b43a8958582041d587561c817b7b11

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e557cc1587f340e37ae71aee0e39d23
SHA1 ccb11cbffe20b1082ba3c0bf99a001681e64e9ec
SHA256 5369af0f66e18c69f1a2aabda7ff7c85afebf00eb7a1f26d2d4019ca72570ba0
SHA512 04607c49e30e0dde6b255d5b459d9f9fe3feb017bb272c08f41cc06a2838c8c4a4a1f9c05b3295baaa735786bbafc46594c232cd7398516c041f6f6fbb04eaca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1355c2bf2d83083084696ac6b46835fc
SHA1 7e6d3aa5d6520a8ae4cadb11fe4b5a048f703eaf
SHA256 a3dd9d973428d23590712f51deef7bc13cbdc391067b17a335e71fef6b3ced4e
SHA512 c220eb71dadd2781bc25ed250d54aa1f808d76aac893740f185634e7fb26d058b2a07bcda0f34b1d4a5fea49bc396810f8f1a168b4e4a7ee62d8a454de0760e8

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-26 04:15

Reported

2024-08-26 04:18

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

141s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3400 wrote to memory of 4436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 4436 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 1176 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 1176 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3400 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c243b52bb7b64bb61cb3dbe6a2589603_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc8c046f8,0x7ffdc8c04708,0x7ffdc8c04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4292078988339578191,5365531058836750769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2816 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 bloggerxtutorials.googlecode.com udp
FR 142.250.75.234:80 ajax.googleapis.com tcp
FR 142.250.75.234:80 ajax.googleapis.com tcp
IE 172.253.116.82:443 bloggerxtutorials.googlecode.com tcp
FR 142.250.179.105:443 www.blogger.com tcp
FR 142.250.178.131:80 fonts.gstatic.com tcp
FR 142.250.179.105:443 www.blogger.com udp
US 8.8.8.8:53 www.linkwithin.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 xslt.alexa.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 apis.google.com udp
FR 142.250.178.131:80 fonts.gstatic.com tcp
FR 142.250.178.131:80 fonts.gstatic.com tcp
FR 142.250.178.142:443 apis.google.com tcp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
FR 142.250.179.97:80 2.bp.blogspot.com tcp
FR 142.250.179.97:80 2.bp.blogspot.com tcp
FR 142.250.179.97:80 2.bp.blogspot.com tcp
FR 142.250.179.97:80 2.bp.blogspot.com tcp
FR 142.250.179.97:80 2.bp.blogspot.com tcp
FR 142.250.179.97:80 2.bp.blogspot.com tcp
US 76.223.54.146:80 yourjavascript.com tcp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 234.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 105.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 82.116.253.172.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 131.178.250.142.in-addr.arpa udp
FR 142.250.179.105:80 img2.blogblog.com tcp
FR 142.250.179.97:80 2.bp.blogspot.com tcp
FR 142.250.179.97:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 accounts.google.com udp
FR 142.250.178.129:443 lh6.googleusercontent.com tcp
FR 142.250.178.129:443 lh6.googleusercontent.com tcp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 i155.photobucket.com udp
US 8.8.8.8:53 www.auto-ping.com udp
IE 74.125.193.84:443 accounts.google.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
GB 216.137.44.125:80 i155.photobucket.com tcp
DE 94.130.218.80:80 www.auto-ping.com tcp
US 8.8.8.8:53 www.statcounter.com udp
US 8.8.8.8:53 www.blogger.com udp
US 104.20.94.138:80 www.statcounter.com tcp
FR 142.250.179.105:445 www.blogger.com tcp
GB 216.137.44.125:443 i155.photobucket.com tcp
US 8.8.8.8:53 c.statcounter.com udp
US 8.8.8.8:53 s10.histats.com udp
US 104.20.94.138:443 c.statcounter.com tcp
US 172.66.132.118:80 s10.histats.com tcp
FR 142.250.178.142:443 apis.google.com udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 97.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 129.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 146.54.223.76.in-addr.arpa udp
US 8.8.8.8:53 125.44.137.216.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 84.193.125.74.in-addr.arpa udp
US 8.8.8.8:53 80.218.130.94.in-addr.arpa udp
US 8.8.8.8:53 118.132.66.172.in-addr.arpa udp
US 8.8.8.8:53 138.94.20.104.in-addr.arpa udp
US 8.8.8.8:53 6.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 s4.histats.com udp
CA 54.39.128.117:443 s4.histats.com tcp
US 8.8.8.8:53 www.google.com udp
FR 142.250.179.68:443 www.google.com tcp
FR 142.250.179.105:443 www.blogger.com udp
US 172.66.132.118:443 s10.histats.com tcp
US 8.8.8.8:53 117.128.39.54.in-addr.arpa udp
US 8.8.8.8:53 68.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 bloggerxtutorials.blogspot.com udp
FR 142.250.75.225:80 bloggerxtutorials.blogspot.com tcp
US 8.8.8.8:53 225.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

\??\pipe\LOCAL\crashpad_3400_LNXANMXAGHEZWIAA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9a84258bf8283a51676f51abe5c84bdc
SHA1 a7e506ffae44566c14076fe9643a85756fe587b5
SHA256 3412a84c73b10890b03d4d340925d85ab96244d63f036dcaf355fb907688c351
SHA512 076478600aaed6db4c00d54d81a96954144eb315aac74eab9f93749e100323db5ede259165953ff540bca017fb8e61f53e929b018dea2ed75b1105571676b664

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f1537b13c525982775ed91fb11ab110a
SHA1 08957c3ec940c08d2bf0cbf93bbe950501b725a6
SHA256 7572ce5272bb6f4d32d1e16b582a9c84bf983372f7f2333c2916632591a5907e
SHA512 43037b7f2bf27bf3e02c1c510c639bc244d17d277c0035379cd9f5745010d3e7344c8c8429e534a57efbafbc8d48bc4bf35fd799de1e8a6ae32f31ebbf607364

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 14c7e10896af594b8374f62fad6eb5e2
SHA1 f50a0776d47b8a32d677dd7a43bcbc6b12621d33
SHA256 89877bbdc0cc810b9f14da625dca4b5c032735094a881d906a28670ec74ba534
SHA512 2e7551b25d9bf2fe8ba6f7eba9761ee77d12e7e4bad2aff50bffc870b72165452cb899e3fe0bd157499dab4900d1615d61abfdd77743024ae5ce38b017c15df1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 4207281cebba251c786ef72dd5274b7b
SHA1 9dcaf472b6bc8a153a16e6118d9877841338dafe
SHA256 c7c12916d0cafa64d3dae32b50089dc180cd6cb221319c45cd1a7377342db94b
SHA512 c7dc96479ca5ed57cd27773348d79f881ae751ca61073deb8dc65c8ad235957f311acbb07d9caed76455888ac6fc1dd6f5a54c292a59a2a6f9d48784dce934dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 507241ed9634586e31c69a9ce505dc36
SHA1 67b887846358f2516e7731e195b0d1cfecbeb595
SHA256 44d069354d9f2c0d7df586d49438a449e68aa302c026b05edbbaf653e3fc21da
SHA512 b0816f8177652f8ae421a4670353132f9e441db17130a5641a9cc46ae1a4a951cd24f69bdc25ed23e8d8afa1e7d4d211e4f8748ba9391d3f99272582435ddd4c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 394e8d1519b22af34791ed740eaf1ad4
SHA1 9ac9d461090eaebd3600cd3a7a3d6a9e801cf84f
SHA256 9539df58858f0ed97c84b2537c926ac6ec3f1e0dcda1babfb97297844c75aea8
SHA512 e3eb03049092fd07258c5c45fb7ecb9f7194759a6d5eb1334133c754f031230eebf5fe6ec3cac9d73eff0c7329d15cc701154472c174bf70068fdd47896e7490