Malware Analysis Report

2024-10-23 17:23

Sample ID 240826-vapp7avajg
Target c36ba95556dbf734fc3599d316a52737_JaffaCakes118
SHA256 946769ca74f2ef38bdd495a0a88d18a325cc91ab39979c00b8bd29f16b684f26
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

946769ca74f2ef38bdd495a0a88d18a325cc91ab39979c00b8bd29f16b684f26

Threat Level: Known bad

The file c36ba95556dbf734fc3599d316a52737_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

Browser Information Discovery

System Location Discovery: System Language Discovery

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-26 16:47

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-26 16:47

Reported

2024-08-26 16:49

Platform

win7-20240708-en

Max time kernel

132s

Max time network

135s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c36ba95556dbf734fc3599d316a52737_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000187fb6b6a254cd2041d88d8f8d92b602f1eb32cedfb3073d883e6a1b04d4b019000000000e80000000020000200000002fc681f26baf5fd384e82d4e4d0a286fa2188a6262e8fa11988173b21d81ab4e20000000d3536952feacfb9728a904d16eabf5764d746bf97444c1ad1996bc8eea179044400000006c49af34ab0ceecc84b06659bc3a44eff14d3e844ab07f02c735c60ed994172fb40f62c64655e5cd1f08d9c11f1947a855943d06aa3f15e0e004f6c8470f1fc7 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430852709" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08c34d9d7f7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD872D31-63CA-11EF-B9AB-7EBFE1D0DDB4} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000a32439819d861b0a0bb10a30f4b0ff4e9d32d8afc9af7b84f22683d6e1a09ea1000000000e8000000002000020000000c1fdffe5ca283a418eb91ab0ce69d33733230400d168f39f5375161fc613599c900000006d9219ff9f59b36ab41306315b622929072d7d681831a9734ac8d176a1c7434041fd0a3181c622f7d4ca2a2929ec49a69699f0dc5997bbd8ca5b5fc5ea169638d1234af793c42f926d259966ef1e9830ede309354495e05fedeb2fa215ffeaf1bac944cff169c563ef4aa34c40dd773930c2722836bd7880b21d481921ba12a69cc93b084a52a9fd87f2b8f20d096b0b400000005bcfdf2dc86a13b0a8bbc73113ad33cf10867959ab41a8806252ab13b5030722148dcad22fd75fd5d22e0b413b00af87a4378e936b6ff924fbe81687352a3884 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c36ba95556dbf734fc3599d316a52737_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 pazos-blogger.googlecode.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 dl.dropbox.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 games.mochiads.com udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 www.juegosflasheros.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 ads37459.hotwords.com udp
FR 142.250.179.105:443 img2.blogblog.com tcp
FR 142.250.75.234:80 fonts.googleapis.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
IE 172.253.116.82:80 pazos-blogger.googlecode.com tcp
FR 142.250.179.74:443 ajax.googleapis.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.179.105:443 img2.blogblog.com tcp
IE 172.253.116.82:80 pazos-blogger.googlecode.com tcp
FR 142.250.75.226:80 pagead2.googlesyndication.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
FR 142.250.75.234:80 fonts.googleapis.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
FR 142.250.178.142:443 apis.google.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.74:80 ajax.googleapis.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.179.74:80 ajax.googleapis.com tcp
FR 142.250.75.226:80 pagead2.googlesyndication.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.105:443 img2.blogblog.com tcp
FR 142.250.179.105:443 img2.blogblog.com tcp
FR 142.250.179.105:443 img2.blogblog.com tcp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.179.105:80 img2.blogblog.com tcp
FR 142.250.179.105:80 img2.blogblog.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
US 172.67.146.51:80 www.juegosflasheros.com tcp
US 172.67.146.51:80 www.juegosflasheros.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
US 172.67.146.51:443 www.juegosflasheros.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.178.131:80 fonts.gstatic.com tcp
FR 142.250.178.131:80 fonts.gstatic.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.16.170.49:80 crl.microsoft.com tcp
US 8.8.8.8:53 dementor200.disqus.com udp
US 8.8.8.8:53 www.facebook.com udp
US 199.232.192.134:80 dementor200.disqus.com tcp
US 199.232.192.134:80 dementor200.disqus.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
GB 157.240.221.35:80 www.facebook.com tcp
GB 157.240.221.35:80 www.facebook.com tcp
US 199.232.192.134:443 dementor200.disqus.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 a.disquscdn.com udp
US 199.232.194.49:443 a.disquscdn.com tcp
US 199.232.194.49:443 a.disquscdn.com tcp
US 199.232.194.49:443 a.disquscdn.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
FR 172.217.18.194:443 ep1.adtrafficquality.google tcp
FR 172.217.18.194:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 o.pki.goog udp
FR 216.58.214.163:80 o.pki.goog tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
FR 142.250.179.97:443 ep2.adtrafficquality.google tcp
FR 142.250.179.97:443 ep2.adtrafficquality.google tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
FR 142.250.178.129:443 tpc.googlesyndication.com tcp
FR 142.250.178.129:443 tpc.googlesyndication.com tcp
FR 216.58.214.163:80 o.pki.goog tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 eecdf0a7dcf35d061d4f6ef3a799307f
SHA1 9204d28a1720eb5f94c303ed96a0b9330cceb647
SHA256 37e52308a382dfa7a2233b3a708175fe7945ed6c90605ec50c7171971c06f923
SHA512 370a6a75c2328eb5c37ba8817c145b571108644edb28ea84e8fc6a759006161cffad3db4f21d6d00b492894d1ea7f07653aeaa325f6f7eb74ea48e96aee8ca65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 b19bcc03239123f14b7fad0edb883c62
SHA1 1e87e087dbd1d3d850b738d42f69054decaf64fc
SHA256 7c11e10a757a4926e2bd43a4aff9dbaaea7fa75acae1ee9a14b7e509fb767449
SHA512 958ca9830a90a0d578a97db30360220c30b86a0cf4b1740354a9ca46036f1c4a0785021dd7eac7ba7abce086707cda8d8ba94cdd12d991768e7808ccee40d1db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 d7afba617606e9217a35e41e9e288f12
SHA1 29b0e6bf635385f540e5ea509a6cddc22517d795
SHA256 6c43470ca0390f67331cdd29d4476c6d16cb92a63a796dea8b06ff5892ec41ce
SHA512 0a21437c9c7bbb3d66e9da3ccd5cdf93016921de1bcab55c25098f03cab1b37d47288d0228cfc0031b0c0395a521abe50dbbac7a507490c1106d224346c48a72

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 7883de59b9cc640731e220940d64b5a8
SHA1 15d9836911fbb203db1a3ec18bb81b857930fa61
SHA256 ee790fd332b45ba80d407fcf02ec0ecbdb4ad6216d2cbe95dd91efadc43d7a0c
SHA512 b3f53aca3aeb5133590db1ecde13547a913f44a69b2e86b6ac91c6edf9736b712629c53b7fbb71b35b81704a372baa69cfebd317721a38511dd48ae1bd05d5c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 48725a84cee50c77b1ed0a4161ec0e02
SHA1 ba378c50fba092c6d5c0eaedb86afaec4fba3cbd
SHA256 24de2d69180d41bf20ea01772ce98f0b9dd380c651dfc6b199ae0a67db2eda3b
SHA512 2b9e1c57705eb3daa1c4d9ca8e6fab87866c0cc44a84e15fd7e1f5cf4ae259cf359e2ad011c66f51d996e3db35b265e977d209f8030d0295bdf3a9452f201f5a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_147AB4536A182B9FCE88E194D59F3B22

MD5 7246ff8f33bf7dce7f440608182b449f
SHA1 86e3216f6c56fbba416c54de00e845e224ef2b24
SHA256 ce50e9b8c264049f73ef81ce8e7e371cd431301a7f5ca559d2ee6971db3a3f4f
SHA512 a220b62b8066fd1e5a244f191cf4f70595c925e22cb46570cb162998d4081071fc21432ccda9e36332927596fe88304ef107842d0e8ca1fc904188d345e4fc14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_9CE832D646FBAFC5C4ACFC523FDD84AD

MD5 3565d3104fa920a897ae5ae49dfbc5bc
SHA1 4704720303efd716199f5a53390a13549fc054f8
SHA256 e59be9994e30908914b4579c7625d33ab7473e0625c7f1db2c31782cd65c2e09
SHA512 e37a07d3cc4f9f66973f3f0cd9c1e119cd7ca42746045b6a2f0cdde3615a711a47a2423378f1dcfa6d6f620037b86b56a07a73eddf5a6b4d2f064f24efeb52f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_147AB4536A182B9FCE88E194D59F3B22

MD5 1c33733bba48dc1da9b3b72aa0d51872
SHA1 4cf2d3db81647006bb5f53aa30b9db7bcaf0d655
SHA256 88c15dbd932201db0eb1903827bcc264ed9abc80bcf323f4c49080ffcacc58b0
SHA512 3336ea7634bf22b2989549b621596496308446595d0e3b291902767883d901106aa5ed405789047b83c5ab97ffa05db2afe0d987593cae37c5a90c9e1b680988

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HTBGGANG\platform_gapi.iframes.style.common[1].js

MD5 aada98a5b22ec7188655c2c17a083c57
SHA1 7c3c2fb8744e7412d8097e28f588788d91b9cd9b
SHA256 f2f09baa213dd3dd95edb5a30c7764e4a44d9a79c0831f90b1ad8ebedec9dab8
SHA512 a780aa3b9e36f61be8240487e75c19a96fe26d54abf9006680a00af9d1d394e81e517f0bbbc13edff3a7190679260ecd56fd5cdd7c2d2f416ab8982c3277b953

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3H1FOMV1\cb=gapi[1].js

MD5 cb98a2420cd89f7b7b25807f75543061
SHA1 b9bc2a7430debbe52bce03aa3c7916bedfd12e44
SHA256 bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4
SHA512 49ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e

C:\Users\Admin\AppData\Local\Temp\Cab6875.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar6991.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3e59aa689aec29c4304a00599c6dae6
SHA1 c2d63beb1ffbaa4b278ba7a4e93569092864856d
SHA256 f5e3016cbcc72b2c4dfb6a15bd6ec101494b086e7d1638d0aea8f89c0783f82b
SHA512 aacd87b196ad8d38cb5b33880062d81e45a4294448dcd3a7a3b5135fb2ed4a203f48add9d2b49d00c8818ab4e1845e752d4bc1941094a3c3fae72e0c9b27d940

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 c4c1cee804cce6083dadb66696fbff05
SHA1 b18ec78961bcec2a1bf945c0ae60980c13bc8098
SHA256 3fb3a9dbb7e8fac731442875bcb2de79fed981c26cff2bfec962cb787d37d553
SHA512 d1a0c034391d8937c0316a843dee920a41fba8b5423a2e9431799e4567828b68e4fd6a1d9713c6d05ccee22e9d84f8c0b267ffbd57feccc1a2d578f44fe840e3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a5d6c7646f9daea558f88559f449f84b
SHA1 bba5aa8c6597bf44e31fc81bd39266dda95ecb89
SHA256 150222638177bff1c476568b87f2f7f9b21d95701d3c49db107d70d2fb7d119c
SHA512 6e7fc7d2b7a23f2d18193757ee3abdfa82f6da1fc801d5252ea5b942202a7ac161bc1538e64469d358f3d75bee092ddc8773690d29082ceda7c5814a1f66c750

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

MD5 c5dfb849ca051355ee2dba1ac33eb028
SHA1 d69b561148f01c77c54578c10926df5b856976ad
SHA256 cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA512 88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

MD5 2c10983433b061310ecff6435646807a
SHA1 2689eb6b46ed36ccd419a64fff56d98178ce4338
SHA256 ff2b867b3895c0944fe31cdb0981bf666a154da0634f90fcaae1735c1192000f
SHA512 16ace6e4fc462b3e0bf1399d38986f4a7c3d96e4fb0c1db51cadc7ebb0f88ce5a1db5cd898936e5ff41e2b47c847bf6c43a4fd673a78703e31366e9ddc5a49af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7fa12f1fa0d02ae9539bf4c32c83158e
SHA1 a320d5833ddc6665f8aee4f52ae02d3aa079097e
SHA256 2161f63d4ce892a48ee0bad2f4dcaeef706566ed042ddb333e1db96ae32c0fb6
SHA512 77d74d464e9b5528a3ae6875ad952bc43a33f36a056f443c615d1acba25f6e48d1d8dcff88d065d9c94ea2ef613bd7f3cd44eb49de639d201ae004e316fb203b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab43825c7ec200ef39630fff62c22c40
SHA1 0709a234bfa8a0e6553dabb03b0411ac1af2b2de
SHA256 f4bbc414b23b97ba9d36194f19eabeb049e7f15a7716085367a1019726d47b66
SHA512 707913fc786c6da6fb14ad573566a0977d16b5227e73701a26d6632953d3efaff391e06503443b0fdd2a324a9aaf96a9c0485f0a9939b9e75aafb6c7a6a37b3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf10b8c4379855241234634b37b093f7
SHA1 478cb705923cd9532117737ad78cbed77f750198
SHA256 8ec4b47bc1b12998844c722adbc0fcaee10702018e87066e730c6f7e5fe35318
SHA512 69dc8d076f942e78541f94cb4af0275159e2ca53ba18900abdc203dccf986d85c1346da8b52a67d9e1483e400f2a01e9a09f35487226cb64ad69412e2e7e32a0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 766dcd1442a6096a4800e8eee8f42cbe
SHA1 8b30d34767117e353031578d76b463d5d00fd4c1
SHA256 59f8c4b450a4394f9551527e6128d529df110030be8496754f4312a5a214f98d
SHA512 e977a5ca1da4e4353d616d934eb6067859ee2440b14affb35a498ef2b222c8c6be2d2ba1c071478c85f0d45fecc6d0c3d3103fcfb1fa141021e73c047d24c5b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5f832e96b1fa9e81f14c3e123067110f
SHA1 cf035761ef01fdb75a56d7a75c51c3c99e0ff834
SHA256 ea62fc3602f6829155ad77638d4c7694c3a045006522e6f88bd9f6aa4d3a7c4a
SHA512 272d73d328a561de4f74c673647a8a6a505a73c03b84383af91392c07b3273f142944ca63bd66c9308fe1e66dd675e3e6279c5b5997ad140a35a3fbae9fcfbd6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aae82a43324814bd90bd2eaa7942c11c
SHA1 962c5d30a8f8ef3263d85723aaebae4a67485580
SHA256 3124a352c761e4d31091f75036ddc49c9a4dbbe0d8e3f83561bbb433828e1ca4
SHA512 680dbb2babf5adf1206435dbf8e857cbbeb198169dd5ff6d98c2cae9857b2304d09208473808fef4a2cf118f6fff49deb3edec90f0e2b691517d706b271d2e59

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 bab23cb97640b8a67bab93b3e5c9dcec
SHA1 8e3cb4e613b038c240f1e0aa6461045d60442c21
SHA256 7b6206bc5efcd16052697cb72b748cd6043e8768dda54dcd6be5562b464abd20
SHA512 3cec383417085039d65b8048699869d8d157ccf0e30bd2b1eb3515ba7fca00dca4878a916ae9c1dd4c62f9e2baf589f72c73c14fbbf0b90d2f589ce9234bb003

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dea4b8b3701f2cdb0a7fa14ff010c479
SHA1 f0e90d74d4e3dd23cd31133a6b03153f7e16180b
SHA256 cedc7aa57dc01e05f34aa4a690c5262c2442dde7334fa6017ba242236fa358c0
SHA512 01f298e97b43f4620db89433a3e672b291dc845b13b0ad8eb03a320dad5a66a989acc3c8dd0a0b61810ea16463f122181f58b816665b60ddb21a8c2b6c80fab0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5679fdbecfdca6bab0e44dbd24cb106a
SHA1 8df5730e7887bbdf8abd8f5f773da714b6c45cf7
SHA256 33e61ca304b0ac84d16c2caa8e99e521d0520f158ff7aaeeeffba3e80f3c99d0
SHA512 fc591145e8b89684e16d9182271e5a9bfa71e23bf5ef733ec1b211974fc84e273e91656d7be9bfa21bd0e43113f8df766515fa03e29d4665440f8eadee5fe161

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8dbdffb9447aa98c584008dc1d7b4b25
SHA1 d1d2d54f0283b68e826eb30f5b339f62a2ef9250
SHA256 f32eed38e950379235d7ed7c14e2af23087dc06933ee71136260457c7aa108b7
SHA512 feca3ff5e33d3bf14db962aef799477f2cc76ab4c99d39a2250d7f1431c626645894baf4f76e20d7be8c6ffe71235fd9e402d16823c0e81f04f90525e406b6f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e469907f7a74b146f152727d5865bce
SHA1 bb0bbe904c15104ac8b5a520be2be82dea4d2884
SHA256 6f36a7f8db01a8a3dcefdc1a7b6adb9c667898acad54020a6fa00b0c518f2cad
SHA512 1611cb236b76b16df8e660427cdd647ca69a2fc3d8993385935e992e5502b10b93bc17482ae7283e489f9b8585a55940a658925122783e5c65d201c040562524

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 423e823304e2528f23ee6c5653e4d73c
SHA1 bf9edfb1a18fea70d3eacbd0313b105dd45da6cb
SHA256 2b8c9e3ba84b4b463b6f055ecefe5bea72e545595b1ec1561dc8913aab8ed55e
SHA512 ce2b87b98b88c0f396c7f95cbae1cf69779e8e1dc03ec1bd820aaee5b6b1699e6c46875e29ea07279a3a098c05e918236db62b5a930c3fa9fffad439000d048a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 24147c94d0b175f5eb17d9d214c8adcc
SHA1 6fb946df641719ed49a59269d7b4343c2f613db2
SHA256 7c9036ac4ad4ebf440d56133e18beb9ea7436d7e352084da608849674fa469bd
SHA512 dde600534095881d8ed08160a25bf7ca0fa90bc19e90ed3a97a5519aebd8702b49c529cda13afe1ad39e19e17382a8beb103000a75ed972250d318d043339057

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a38340135dd9dcf9ba057738464c7e18
SHA1 58123ed8ed8491b4c129501b2e2dd5ca3fcd6622
SHA256 03dc578ec083402cf1a2a613a344acf217abcf06b82e5f6e804a0b29041ede73
SHA512 de10e90f6db2ff56cedb3fccddf8fc1f82bc1512ceda12461d4eca63db2418fc9012e4b2cfc51f203a2b8ccd26cdb9eda8fb53bfa13d2a0ce7a7e78a7054dd7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51c472b64df98a3e3f2d5ffd9cce2c0e
SHA1 355300b15625d2cd63f8c134ea2431d29b032b99
SHA256 f73f3bc7cad18f7da472b26b87c6c95b02282127b260860e5268e858f057ad85
SHA512 b86ce38ccd040807fb27427e4fcba03ee8b6c99013a0db57d3e39020a9eca0cb44501756bde33d8cf985eebd11e77732bfb05c4a2cc1859c6fd8b05037042f49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e5f0122b57008be9a62a6daf340a53b
SHA1 f1951fe855fcb6e2cb03345f3a4e1abba4551e84
SHA256 d123a14211fc43769e8abad51d466e23a2c881c136190fdd8b2fd6aa0e0ed8ba
SHA512 db803433b55b702db5c6be6cc0d48445cc839501405f1d424d984b7aa138c2d4a87f6a0b1465f6a7cf37f5ff141e0a8de9695ff60c6816d26f2558502efeed0a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d7b052aff0ec9e13c749eab61a924a23
SHA1 c3a27392e6ae667bbff190a8370c67cb4604fde2
SHA256 3d0df24def9cedfb318a7011c723f04b7d6a3759e1b5645b615d2ce2bca25670
SHA512 b8c230c2dbce466e6e2c4a1fe3f2c65f359ee788e4872ff2e2bff2e8571d0c794fe214eef898e6ae89e34bd846357a7ad5d86fb9628d077a16432ffc679581fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6be9b2f62363f050239de779141950d
SHA1 d0809005c74fac22fe993e6486df1a03346ed11d
SHA256 1a26c512ca739bff02c800e700e01613ae2ce5fc6aac6b4bcab8740312a90853
SHA512 68ffbbf6198ad5841bfbd39fba9e95c374a3449426435453087cf8a50114941e916d7e78ad5ec311ab02af9df80f8f667b2e315b78fe236a73eeeed0e5292676

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a5eaeb61a173cee2d821f9e29ded5bf
SHA1 5f4b679c8df1901be64d3c2ca6129ff56b1221ff
SHA256 dda3abcaf7cd81ec9cb71b19e58581d3ce6d679f27863e4784dfb31d04bf0ff0
SHA512 833bc6a8279598f74e6f2b25b3ddb5c934ee4cd4baaf8982c527594121c295f6614b18df93118f7a87be7d3d3bfd71f47cb2956ba025d0ba4834799b1638715b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d81ff7017b4fa6fb89a4df78b676bdb4
SHA1 ea3b88491811d8881295fe12ccfd2451f981345b
SHA256 132872deee27f24ef60765a77d6fc2d23adf59d82cda9a53a3f548693a7d54d7
SHA512 3fab57597c9e4ab89a1aee860a94bbf45ee1c20d5d02d954558664e98e5fe4dfeb9ad59a0f1de354fd1a2b87cd702223173cd50d0276c8f0f0d51ab8eac2165a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 570b1694a444a71f7b5c9e30c7f82dc8
SHA1 4f2df3319ee3edf227974ccb542fb4399f6ee397
SHA256 e39de7acfa2635e75586406196763ab5f1f2c297355f0ca4532a17d2f5c17c41
SHA512 196e749c4b7f7b1f142aa0d9a53dda735f542c62bee3feba545272b84bd454072e0bee157102dcfaa1fbf26bf4d6af10862f6b6320b1cc5cd73c069c4fb2e902

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-26 16:47

Reported

2024-08-26 16:49

Platform

win10v2004-20240802-en

Max time kernel

146s

Max time network

141s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c36ba95556dbf734fc3599d316a52737_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1372 wrote to memory of 880 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 880 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1372 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c36ba95556dbf734fc3599d316a52737_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c78546f8,0x7ff9c7854708,0x7ff9c7854718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 pazos-blogger.googlecode.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 dl.dropbox.com udp
US 8.8.8.8:53 www.blogger.com udp
IE 172.253.116.82:80 pazos-blogger.googlecode.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
FR 142.250.178.142:443 apis.google.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
FR 142.250.75.234:80 fonts.googleapis.com tcp
FR 142.250.179.105:443 www.blogger.com tcp
FR 172.217.20.170:80 ajax.googleapis.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
FR 142.250.178.131:80 fonts.gstatic.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
IE 172.253.116.82:80 pazos-blogger.googlecode.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 216.58.214.66:80 pagead2.googlesyndication.com tcp
FR 172.217.20.170:443 ajax.googleapis.com tcp
FR 142.250.179.105:443 www.blogger.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.178.142:443 apis.google.com udp
US 8.8.8.8:53 ads37459.hotwords.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
FR 142.250.178.130:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 games.mochiads.com udp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 82.116.253.172.in-addr.arpa udp
US 8.8.8.8:53 15.64.125.162.in-addr.arpa udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 170.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 105.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 131.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 66.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
US 8.8.8.8:53 img2.blogblog.com udp
US 103.224.182.246:80 games.mochiads.com tcp
FR 142.250.179.105:80 img2.blogblog.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 www.juegosflasheros.com udp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
US 172.67.146.51:80 www.juegosflasheros.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
US 172.67.146.51:443 www.juegosflasheros.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
FR 172.217.20.162:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
FR 216.58.214.66:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 97.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 129.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 51.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 162.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 dementor200.disqus.com udp
US 8.8.8.8:53 www.facebook.com udp
US 199.232.196.134:80 dementor200.disqus.com tcp
DE 157.240.27.35:80 www.facebook.com tcp
US 199.232.196.134:443 dementor200.disqus.com tcp
DE 157.240.27.35:443 www.facebook.com tcp
US 8.8.8.8:53 a.disquscdn.com udp
US 199.232.194.49:443 a.disquscdn.com tcp
US 8.8.8.8:53 134.196.232.199.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 35.27.240.157.in-addr.arpa udp
US 8.8.8.8:53 dementor200.disqus.com udp
US 199.232.192.134:445 dementor200.disqus.com tcp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 49.194.232.199.in-addr.arpa udp
US 199.232.196.134:445 dementor200.disqus.com tcp
US 199.232.196.134:139 dementor200.disqus.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
US 8.8.8.8:53 cientosdejuegos.blogspot.com udp
FR 142.250.75.225:80 cientosdejuegos.blogspot.com tcp
FR 172.217.18.194:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
FR 142.250.179.97:443 ep2.adtrafficquality.google tcp
US 8.8.8.8:53 225.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 194.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
FR 142.250.178.129:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

\??\pipe\LOCAL\crashpad_1372_GNRJIQTJVAQAGELY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9353d264836dbf84716f62349563dad0
SHA1 d92f6ec5a25e932584994498945ad2fa9c08abf4
SHA256 5e5c0826aadc8037cfbf506cabae353c7491a6fcfd9bfd5f5ea9072b9f912f49
SHA512 f74e91ba2b3837d209c018a2e35957e591a31bcab41af5435129df3dce0f2c336395acd75018e5fc1bf09337a23a1511a35c771e58ba509f1a25a499ef7f3a84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ee17fbe0d80532750b9384776ccf3750
SHA1 d365f640485bd0b19526b47c054e47ff74bf2975
SHA256 d0974335ecff33620ebdb9c1538ad030931801322b093f79cec732b35f089787
SHA512 5e0b8c7aa517e0b96ffe21c77ac99c98ba4f44a9753744e1e9522d5407834f1660702c097cc4181b906d7ecd17beaf20be4be7b4141a87c97fdb059a40334e12

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 578e4d77f1750b009f8aef67a8a14ea2
SHA1 3f26822e7ad0707b5a757f8e02ba27dfea75a301
SHA256 525c8b2b658e6c8e1917c5be78f8fcd4f3bb180dad383a8344cf033fea316432
SHA512 3ca6dbaddede9a8a6ee8075adee1b2a3ac9f2d436c034b7ab1257ab6426a107b3d441d7b7d52ab91337b979d1e7d3958aaf13e36bc2d0d37ec2de840fac72582

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 6adad780d73a02a4e5fdc2a7ef9fa3c7
SHA1 ca58987b95b379ff10264511f5c7458428f1c69e
SHA256 ab4adc7d34d3960964da0fae0d6f767cd7c0c40cc1b9d4505ea56c6f5cd3fa53
SHA512 da7749da69e9351d6e54854321df985904543d8b6ea5cdc8dd763c89e92f09789e6c9d22a9bd2714c5a16bc347cac669195ec26ba637a8989b3c3e22992fedab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c368e124db06bd28ec332b7c233bff80
SHA1 99b8c9ea3a238209bcda26c007423eedf3048814
SHA256 8b0563e44e4ef1e9af6343f3199057a39a7678cc3a591a78d3091645c121f661
SHA512 cf84143c81a5f4181c263e6f4f59ae88ca680bff76088561cc6ffc3db910637a673eb73536c417764a076de3f95c7e33d364206b1a588efea47cd88089336fe3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 18f9f6ffb2f6fb606e4b6d56e8e5cb99
SHA1 31fe879c7cefedbcd1aed2a0db4b71be97d67ea9
SHA256 7fbd431942fc758b272b846c899011575c35a2955ad1bd1cd9efe5ab9b805cd0
SHA512 e7a9213929186d0c72b0dc5dc2073cadbd320a0ccacbeaf8aaae2bfa8a52ee995234b7256e29f74e8969b9fb30f1d767ef62a0d83546ce77f2e5b7efc5c10794

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582c99.TMP

MD5 e7ac3205fef20b3f7e7f73335818eecb
SHA1 63b9c256c32d11ba4cb7897f6a9aef830a1fb8b0
SHA256 72593557ebe43931b05b3ff7e3011e0ef377e19bc75285840937acea78fdf152
SHA512 1b83b7dee4ce4e8f8ff0f7f24f18a3b48d602521c5e94ea9cf2eb31275d526db2a15fb2f092027d63a098a6ba0d5f54dadc686a34924a214e4babe2fbf0a86b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 85ef62bd6f36e729b9a1a597da10a788
SHA1 c1ebfa6e2d0a5139f692ef8f058d0555a074a4e6
SHA256 b6ee72bfe42c29d937e4b33f9fc88f52f76781aec1616358a612a062ce6acf2e
SHA512 1ffc3d0c91f723a9249ffc835aa8e43ee33316eb228c259e5fdf1441e523cedf72714613ab76992d8e22e4d76adc2c9b98fb8dad9de798b8b15faa45f48be7fd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 2035658502d65387576b7719b9a9d62a
SHA1 4ac4fd855bf73a384bd23b18037b78b32d5a505a
SHA256 e436d5298a8bdeb0a4c36153cd9ace189277996c8a1523dd372120a15d74b47c
SHA512 7eb5ffbbe620036bfe32d9bab32939dc63d8a91cad2fc86ab79bd7ac0a5f3a5bac064da872ed9de7e230f76c3d9934fa519c537ef040b4f00c40b21571ed4a93

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 5642fbb055b997e25406afea67fafeed
SHA1 5711dc05d0ad19e7da73581915ce29aee6b9461a
SHA256 d9504c41ff9be4d3c8eb55f342b0e1288d006a191f61d14b0f9b803b746e378a
SHA512 5d991978f17aca5651f27d25e3f435ec43d2bbddc0ed34229f32f955b43548b91cc0e15e02a1b800bd534153e1b97c692899c8e20655eed30a8c688eeecc725a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 152da278a3e4d6f8651e02df8799f07f
SHA1 d46733e7a5a97ed93050f7f7da2bced7b8060b7e
SHA256 0cad476afdc97c31e522217ced08d4c155cd84874bf6dd8c4e13ed6da54d4a0c
SHA512 b1e47877a1fc9cce8cc290880a9ab8a5046b82f8e3994002d26d611b719652a5a81b3ef5d3996d4c4e409bfa8858d928272039773c48d1bf716becc26a72679d