Malware Analysis Report

2024-10-23 17:23

Sample ID 240827-c856qa1bmr
Target c43b9078c4db5b71ccbdcb13aa95257e_JaffaCakes118
SHA256 45ac56037dc160853370f384ed8cb8a418d3f25cdb892842173b5ab3770cf104
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

45ac56037dc160853370f384ed8cb8a418d3f25cdb892842173b5ab3770cf104

Threat Level: Known bad

The file c43b9078c4db5b71ccbdcb13aa95257e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

System Location Discovery: System Language Discovery

Browser Information Discovery

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-27 02:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-27 02:45

Reported

2024-08-27 02:48

Platform

win7-20240704-en

Max time kernel

135s

Max time network

143s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c43b9078c4db5b71ccbdcb13aa95257e_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "10014" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000023a0c1397bf58ccb2d8f40e90bc76d407c2381ec2d89cf83fa3a9b6324cb9da1000000000e8000000002000020000000a99055d9e0624b9fe3986923a6a0b4ce778eccb2df03bebb980cfa99d1662f9c2000000024f469aa715ec41747dab42d7caa872cc9f8347c10d1b3a4ee408b9c6ccf7338400000007da68938fdcb0c311eee2ff4794bb43bbc402cab54980d2d2e183f44a11ece96ad1b297e2947c475c2f127349be03cb5e8c455a24a359ba6b6ebf197ee6f8653 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000737dad4c006873ca9562c5340161eb99b60b834ce4fd8d4c999771ae44d4879c000000000e80000000020000200000002b44ff199c2548e5585e6306ff14eaa1d9dec1d406a3dad45c0f4a97e098847a9000000088559935485d7f8ea16b9ad8f8e578dbb789f81f32272c9000b5deb733e1fff86652bc75a13158570c00f104484af103601ed17cf094859a6a816baa8bb3e24c11bb19fa1d6950d2ab246c251c65700ea7b4c4a72aea7dd5240b0e73ac3eb4154a8dd590e6febe8692c97341d1f55deda37123cf167c69974c1440a4e1cbe8dc56fbb587ec91893316cff678ad5c248540000000453091e25f34401d4e561a8af7ea448cfdcf78bad0aff8e9e6eba830303a9cf2a2e8c3cf2b3afb7e8f72210b0bc5d5867fe9f5a60a7a2438016e4e85c42dec4b C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7859EB11-641E-11EF-AAA3-7AF2B84EB3D8} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02c43512bf8da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430888619" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "10014" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "10014" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c43b9078c4db5b71ccbdcb13aa95257e_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 casadeseries.files.wordpress.com udp
US 8.8.8.8:53 media.tumblr.com udp
US 8.8.8.8:53 s-media-cache-ak0.pinimg.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 otomescriativas.blogspot.com.br udp
US 8.8.8.8:53 i.imgur.com udp
US 8.8.8.8:53 blogsbrasil.com.br udp
US 8.8.8.8:53 www.linkwithin.com udp
GB 151.101.188.84:443 s-media-cache-ak0.pinimg.com tcp
US 74.114.154.22:80 media.tumblr.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
US 74.114.154.22:80 media.tumblr.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
US 199.232.192.193:80 i.imgur.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.178.142:443 apis.google.com tcp
US 199.232.192.193:80 i.imgur.com tcp
US 192.0.72.21:443 casadeseries.files.wordpress.com tcp
FR 142.250.178.142:443 apis.google.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 199.232.192.193:80 i.imgur.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
US 199.232.192.193:80 i.imgur.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
US 192.0.72.21:443 casadeseries.files.wordpress.com tcp
GB 151.101.188.84:443 s-media-cache-ak0.pinimg.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.179.97:443 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.178.129:443 lh5.googleusercontent.com tcp
FR 142.250.178.129:443 lh5.googleusercontent.com tcp
FR 142.250.75.225:80 otomescriativas.blogspot.com.br tcp
FR 142.250.75.225:80 otomescriativas.blogspot.com.br tcp
FR 142.250.178.129:443 lh5.googleusercontent.com tcp
FR 142.250.178.129:443 lh5.googleusercontent.com tcp
US 199.232.192.193:443 i.imgur.com tcp
US 199.232.192.193:443 i.imgur.com tcp
US 199.232.192.193:443 i.imgur.com tcp
US 199.232.192.193:443 i.imgur.com tcp
US 172.67.190.33:80 blogsbrasil.com.br tcp
US 172.67.190.33:80 blogsbrasil.com.br tcp
US 172.67.190.33:443 blogsbrasil.com.br tcp
US 8.8.8.8:53 64.media.tumblr.com udp
US 192.0.77.3:443 64.media.tumblr.com tcp
US 192.0.77.3:443 64.media.tumblr.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
US 8.8.8.8:53 casadeseries.wordpress.com udp
US 192.0.78.13:443 casadeseries.wordpress.com tcp
US 192.0.78.13:443 casadeseries.wordpress.com tcp
FR 172.217.20.174:80 www.google-analytics.com tcp
FR 172.217.20.174:80 www.google-analytics.com tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
FR 142.250.178.142:443 apis.google.com tcp
US 8.8.8.8:53 blogger.googleusercontent.com udp
US 8.8.8.8:53 www.meionorte.com udp
FR 142.250.178.129:443 blogger.googleusercontent.com tcp
FR 142.250.178.129:443 blogger.googleusercontent.com tcp
US 104.26.3.31:443 www.meionorte.com tcp
US 104.26.3.31:443 www.meionorte.com tcp
FR 142.250.178.129:443 blogger.googleusercontent.com tcp
FR 142.250.178.129:443 blogger.googleusercontent.com tcp
FR 142.250.178.129:443 blogger.googleusercontent.com tcp
FR 142.250.178.129:443 blogger.googleusercontent.com tcp
FR 142.250.178.129:443 blogger.googleusercontent.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 snapwidget.com udp
US 8.8.8.8:53 cdn.getsmily.com udp
FR 142.250.178.142:443 www.youtube.com tcp
US 172.67.75.33:443 snapwidget.com tcp
US 172.67.75.33:443 snapwidget.com tcp
FR 142.250.75.238:443 www.youtube.com tcp
FR 142.250.75.238:443 www.youtube.com tcp
US 103.224.182.253:443 cdn.getsmily.com tcp
US 103.224.182.253:443 cdn.getsmily.com tcp
US 8.8.8.8:53 accounts.google.com udp
IE 74.125.193.84:443 accounts.google.com tcp
IE 74.125.193.84:443 accounts.google.com tcp
US 172.67.75.33:443 snapwidget.com tcp
US 172.67.75.33:443 snapwidget.com tcp
US 172.67.75.33:443 snapwidget.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
FR 216.58.214.163:443 ssl.gstatic.com tcp
FR 216.58.214.163:443 ssl.gstatic.com tcp
US 8.8.8.8:53 www.meionews.com udp
US 104.26.8.125:443 www.meionews.com tcp
US 104.26.8.125:443 www.meionews.com tcp
FR 142.250.75.238:443 www.youtube.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
FR 142.250.179.100:443 www.google.com tcp
FR 142.250.179.100:443 www.google.com tcp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 scontent.cdnsnapwidget.com udp
US 172.67.71.109:443 scontent.cdnsnapwidget.com tcp
US 172.67.71.109:443 scontent.cdnsnapwidget.com tcp
US 172.67.71.109:443 scontent.cdnsnapwidget.com tcp
US 172.67.71.109:443 scontent.cdnsnapwidget.com tcp
US 172.67.71.109:443 scontent.cdnsnapwidget.com tcp
US 172.67.71.109:443 scontent.cdnsnapwidget.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.16.170.50:80 r11.o.lencr.org tcp
GB 2.16.170.50:80 r11.o.lencr.org tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
FR 142.250.75.226:443 googleads.g.doubleclick.net tcp
FR 142.250.75.226:443 googleads.g.doubleclick.net tcp
FR 216.58.214.166:443 static.doubleclick.net tcp
FR 216.58.214.166:443 static.doubleclick.net tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
FR 142.250.179.106:443 jnn-pa.googleapis.com tcp
GB 151.101.188.84:443 s-media-cache-ak0.pinimg.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 92.123.142.59:80 crl.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
IE 74.125.193.84:443 accounts.google.com tcp
IE 74.125.193.84:443 accounts.google.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
FR 142.250.75.226:443 googleads.g.doubleclick.net tcp
FR 142.250.75.226:443 googleads.g.doubleclick.net tcp
IE 74.125.193.84:443 accounts.google.com tcp
IE 74.125.193.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\TarCD91.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\CabCD7E.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 4878339b14f9456051720bcee14823e4
SHA1 8b20369058782ea6d53e6ad218aa77355d43b486
SHA256 d67917ef3126dcaab7998d69876139ccef9ce42b415f1835da9f2712420ba285
SHA512 065bf0970a59e6ca2fd280448e3aeb678855415095d0deff31bcc690f6ba38693c1e2faf2625e165e3e6425dc465c8e717b02ef2cef2787c5a282d3ef5cf69b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 4103c21cede21cf344955d79f5f87220
SHA1 27a810c177f163fbf28668bee674c0e865057b0d
SHA256 d10ee069105b107056114cbd3c1a25feeb99c0cfb59f4e6a9d7105dc943a0f58
SHA512 d890a2aaf627e858959825e9c1c14435a8deeff7d1c2c84670067a4f086a5d4ee1f29e3ab8b72c32ec4234cb13fcb9eb0f4cc91a5af4cceb577d91e4ea9f1fed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 d25ca78a22a2a500e0a7c6fe47fe4cee
SHA1 093c76ccfc55559d3214dc264298a086f239ae2d
SHA256 a24a8192eafd645fe1d1be4eafc0b276aa4415c77f5a1c61a4f02374179d9eb7
SHA512 44eb54fde781833e209f7ebc7ebd209344a0155ac2a4a7f3dddeff26d955d8093477cf6bb4a05dfb9c298979365c3b80eed4a1030ab33b80d99fd73cdc905227

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78b25007c7c13927e6cf3bf24589c0e8
SHA1 cd360212cb40a7fec9fee733bf9430eb483c0c26
SHA256 82cc49ba8c3e11c657b836cd7ce9233af9c00ec5d16baed7c3d32599f980e388
SHA512 3a860b8f4172f7f1f78d39251618d9fc603db0adb418ee57f544cfaddeef0224a764482b17c5daeeea4468081cba7e76a060aa5573bf09f7c30f5b98c48c2441

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 eb7e683a0fc56dd24476e2459ccae553
SHA1 61d5f6daf0cab541df9ae65e37df39934e4b584b
SHA256 29f3c4a64ec35b9622280c2fbe5408ee357263696c758c9378bb8dafe693dc4f
SHA512 a0cc4152275517db7356cc3537d28e699c9487753a7db7ed6d092ce5e98ce761806984aee57ff43f149ad1c26568d6f50fedf52a9db4bd7bdda6be116710b2d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3eaae4205a31979bd76b5f5d6b987abb
SHA1 357f41c64d1e939862ec62d9746cd70fc6e08dfd
SHA256 86c260dbb0f87f2e86b450c498f22c9bee5594e2186172c520429a1af8e57581
SHA512 08c009635c69b22c00e23001360968c095622fe33d227ed24c543c682bbd2ac00e8610fcc832c3c6db7401c162de48a7eabe75331469e0580e45bcdb27623433

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 98418ff5695b88d4b13806bd56b23cd9
SHA1 4c9c69e4442cb60cdbb7aa2831affd763bda27e9
SHA256 85f81438d7fcc3fb2eb3eb00ed02e720edce3dbc74e9848436b08091719f60a2
SHA512 20ca0e6b7281f68471883c48d01879679bce66fe50dfa5a39aac52660ed54d72e9ed340171f1ec816900bee8207d3e2e4b1ba1c3e2bd14e8b0a253cae2a2183f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 adac3b360954ba7d3e691bb5b7880da6
SHA1 675a4a688305045b11349f168eeb305682a953e0
SHA256 e91c82327fa292bab963bd4e5c737ab44ded85a914ce9af65f137af23ccf9b65
SHA512 f579fa2b6778bc36dc93dc108a2c341ee166f4aa26274081f265fbc0bd63c4430305431ad638efce8a64faf3c866bacb8349b05a67f873547a895538ea3395b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53948765c1bdb19680d797fc42d17712
SHA1 e1c0764b42be41a26710525c0fabde99bbf0d98e
SHA256 c1ec31531b40045669cd28c0cc28e990dff33b241130609a806a12cbca14645b
SHA512 e61c758ada0e21b075fb0b5d990616a2a495d2d469e84e75546094340deba5e347115f6ca93704b0790c2ed21b90a703175fcb8a50603cdf54573b4cfee92801

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 232c3418295236717f326829f3bb66cb
SHA1 9ae2261a684dcf0887b896c4c7181e5d8ae8bdeb
SHA256 7d2668af0a8c340d4893a62e21dd15de26ebbfac390e36bc22c62e49b6055402
SHA512 4475342f5b4095d0f47baaac1ace0595d4595645fb46e9fea8304ecd1df1d9d2ef3402163140ecb982e7d23fa99e32e83432b8f0d2f12538c73fed1433502e2f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59362e036e2e5700dd50e635c59152bf
SHA1 6e4e0c49ac123a75e55e11dbcfcdb4e4fc5f8cd4
SHA256 7b12cccdfcff39aca5c89bc595403b3c70b2484f095fbe2cb0b11a3e5684dce0
SHA512 c1df1721486972099a87920b41dbf4252413ea89c80de8cab608db5343f6f647f845a31d43d35c31b24baebc5ddae00b9e5e7af81101c6035f569ee05b03191d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 37d3d3edd72159b9ccf8ca2a24255f92
SHA1 3a9ecd99314c170799b49e5c2097e31882470eab
SHA256 749c070af5df09854acc0ee4616d83a41f70b7942f164cbc7091195e057f8a4e
SHA512 9ba5ba2865c7ef178a0259aad603b2af8dfb8c9cb191ece94a788db50ebe6006d35c85abab34683a5db964586b93202fb81fb2cff6d9a0e72a540538a25f2be7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e5f6e8e3f55a64b133b4a3c6ece9a6d
SHA1 589dfec5a3505dc0561c0ebd36ec412bd0289420
SHA256 67f0486d47b7b79644518b688436fe2976cc2e26d94a67d758903c07d8240947
SHA512 bdde16fccd016c3d2021dc766709d428e6de3431018a3d2250fd4a0da0fc947aa33dde8c5dca2a5ac1251d0f1a4c70c5fec47f00804e26ea4b5b6b870e351fba

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GA43GQEJ\analytics[1].js

MD5 575b5480531da4d14e7453e2016fe0bc
SHA1 e5c5f3134fe29e60b591c87ea85951f0aea36ee1
SHA256 de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
SHA512 174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1cd81feeca4711888dc825e5959f1b21
SHA1 aa56d8e38c46f993b11ee798a7c79c4bd17b71fa
SHA256 0ac5d9a53dd2c6c5b7c3b7e6ba9398ab64ef4d844aaf337cdb503b7304e5ba46
SHA512 064294f135e9374da3039bf3f3e6ec8bb7dd46d257a17d2a913a731092364e02d298b4deaf216b392cd87761236691d81bee5bdecf733ec31b2565aaccd335d7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b7e327638cf845c2379b224b96ee943
SHA1 3f19e8bbd53ef4b4678d33538dc06d0887ab3bad
SHA256 5ae970589d83bef25d3e3a9188e250758f9d20f954308aacf25caa03aaf173c7
SHA512 33c5598d7aa0aa3909a5ca15ead3d800cfb6a710adfc49d3c0cb28a34dbbf8f49e9797c9840a4ebde0b3be62c3dbe80fb472841e7f7653f825e0429e73edeee3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da25dc50cfbb2408276b7130e6a688f3
SHA1 c087a95ad3c6224d5e3965dbf2b759e3ba6300fd
SHA256 1305cc7ae20af8a14faf1a7c80e88b5bce8904e905df9fb90c85633934d0ff47
SHA512 3bb70b5a58b22ed646f72f0dea59b488edaa17d6708815e44c7dbff775425ca3e6a1ce7568f56a7124ecb40b7426cce0732c892342c82f4f92d999b4a1ff552e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCY0HBA7\cb=gapi[2].js

MD5 ed72d618fe48f6fc42c19a4b58511e72
SHA1 80a2da4af91d56ec81c7b672afaaaa72c83a4414
SHA256 5bfd37a756bc7772aa6c520102870dafe2d3b808c562412e30f122a7908f8ad0
SHA512 5378b71a33f67309f788b9fce32daea44051e7e9a6aa326bdd783456ee9eb2f4817aec2ad1e837afc1853acba59080b0114d32c040ea731ebd703f0a84dd7ae1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cbc39926a3597bdadebc502e18811e29
SHA1 58b7d5b9b3c661342124dabcedfda4c477008c90
SHA256 ced920020c9085736d8976361340dd100ad4d61d8a38fe1c3990d7e93ae83c94
SHA512 5b34b8b3fc7c3834b71c873670769c95bb7965d7b7ebecc3a41e8e14889a58ccdb6f33be8939b4b2fc031066b91c54015eef3645066b558ffea0553f8eb3edb0

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SW664DGN\www.youtube[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SW664DGN\www.youtube[1].xml

MD5 f68f3cfe86fde5bd85f3168c805f437c
SHA1 5b8b0693839f0f2b57b0d3287e6af699970408d1
SHA256 e05f6e1c2d29806d661c2518ab776984bb26a259188d14be44a16b221f239edf
SHA512 a51b583a7116b9ce9adb2742cd653ea9044c47eb0c6e7514b1e24156e3667c9839438c0f8cd2029753719d58401250fa1fcc9334a011f11d7c6f88f372fe3e36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e346e4658850d9958bd1685e0d20268
SHA1 be5401fe97f6ca1f5af7e4a20888d5de80ccdfa9
SHA256 9bf9cd29fecdfd3116867d589beb86fc4448c3d4ed3d504206f8764facc346ea
SHA512 ac80f11c86a91d6de1ee8a62b1c8f8638ccfa33f02885f4a3879cab316e0e1811f8eb1a65c54738f0c7b23863789a467543168c25c90d32c65d296edb680ce28

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c40334c19936e2c936f4c12372220e2
SHA1 dc5a9edb06c02df91cb01b168641e34448533e6a
SHA256 30576f885cd617ff8c55199b5fff0c7c792ccee89ac430f3e7dc0bc7432a819e
SHA512 18ccbe6060a3208b52303daf5ba5709e4a2dc0fc210721399bd4186d1f105038701cdd5b899dcc510449db38a557d76522d3ce3df03bb947555eefd5acaf8e03

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5fd87cc9053f09e21e915612d51e2c6f
SHA1 482ebee838a354bbd4d987f4d9b3440064a65fe7
SHA256 f40f2d565c97c26d9b444b17d4bc1e9c99ba80d58270ec24b13f932e4efa27dc
SHA512 7f6b779687f023f2401f5a64a348c9b649d49a26bd5b7b32bd366e7cb610b5a1d4d0a7479529e26a79b376c55cbf6f42b90cbad2a6c0e43b50e7d0cf5d4809eb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4c7a815e8c15d566d6ec70f1ec5b791b
SHA1 7ee94882ea83b30a693b4e7c25ddfe049952958c
SHA256 cba26f71c636a7f88862d2716fdb0e40f331b8c2ee0d8b067f2c7a9d097e57da
SHA512 0f1acfd9cf38b041dc27c11f2f4d45ae3baab4e9c1d862f448cc81e486c001b644a52a1069d690498c3d79eb4180620509c20bc65e2c56345ef795be464d3e27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1a328d4b96b64027bfda07ad64d82bf
SHA1 68cff8fb84d37532d22f8da85c5fb73a5963a798
SHA256 fb655f238ac89c64eb82b0a0b8eb26b587d2caa78f5ef0a9107dc82c77acee58
SHA512 0f59886cd42fe2a6ed28faf03e6aad63a552da8ec707cca40939f1f94e8c793c121ce0f346d85e1809f65cc205397fc73df09dd0740377d4bc834ef175f6b222

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 26033b7e5732a61712e31168827f9eef
SHA1 69cf04fd6f139fc21ab4fc3531d8f0bbcd532176
SHA256 5199db7a575f143527fe91acfcf9b9ed4d104762565e61aa8c66159a618dc164
SHA512 d80efcbc1856ae047d549985ca8d667d42ab86f3bf72e9d721b3d8c225e5b346b5238f7e018f763170a162fe6590913b4e7715683b8578d76782498b01df350f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f315c2d6191b71d6486bb62572ae8ecd
SHA1 1b82ae6dfba797136b9ee3b9da995f1ba20afc17
SHA256 2fbadc1a502a5ec0f0199cdd812df23a23d21c8cdf8522f011fb9d6cdda5d224
SHA512 fc91446a42808a630cabbb082940f7e715caa8d6e365ad8a252a747edee53ded9eed6cef8ea0be1079c76cb7fbf838df504c29ce536e7f18c6ef5fe843efaead

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dd7d173935a0e6bc4400a028ac2a43d0
SHA1 4f96fb99636560e55c5152a23b9dedaee2c30db7
SHA256 dc02953d59c380e27b0f76525979506c32ee905e3eae7461892d065ce45be02b
SHA512 ff5f041a909f29d26a7114cb468421538d8e0d981928a8a86da045680a8236ace0586742d7a49c0a3ce19fe3eee5cbc870e7ff21102cca2e64914fb85c9f0044

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 589856c4a8ab4423b626ac8b26c06b7b
SHA1 a8343bcb8b2ae3502b92e71dc479c1692e45e36b
SHA256 a3e7cac7a07fa1f50fecc7f48f2e838390aec7efc9da6b164e0f37c5fcb2686b
SHA512 a36944c2a7a812bb1aa6f7882d61db5c6795069d72543299f487e31d7c4d278dfee4e5e514484d0f24a041d90a46491c2a3062fd5ddde09e46cd445fad43801a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 597125da8f2060b16146e687aa1000d2
SHA1 3eef735019989a057692456e2f3bcdaad08616fc
SHA256 e4ac70ca0c0f2953434a5f2a2550b1ced54c85717613e2d07d11e2fbfa648eab
SHA512 f29679dbc588a22a509c35577fbfad4d58821f3370093ae38e10fe78adaafd4d2e40b21b76960cf483da62d8dad98d2ac1e572efd594d1d93c4691036826907a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 40a337b6f5ac461198f01a40442e6399
SHA1 c3754a3aa854a81e164cd2ef8e10020d9e20209d
SHA256 d56bca49e5f96aea6063398f124056d0f6d109cd5ed1249b8ff9783a526fee1a
SHA512 532632ec1d65e41278f463003dc14f6a02d27e4e68dc079b8ee9cd0ad397e7af0be4dee6ce2a7932c4ca2818e04d3eedab7fdc53afbe8455d0d71d0005606db7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c67fda0ddbf800af23ce671d63d6d215
SHA1 8939aff9f8a8ef7fc9772f97244a6fe9cfb812b0
SHA256 6a1d34966d765c2c3015409d0e714d2d89835efd11f922a40ee96009e6455303
SHA512 f6c28014a3ef5fb276074f853167d0bf17d66a1205d9237610122968d0cea109b1a10a25c6955a433543adc2cd9fb070dfa888c3d0466f65db06361c8a5722ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0aa22f34d152bc293182a2773af06fff
SHA1 fe98456bc9709801ec2185c3296ba95ebdcd6dfd
SHA256 6e5dbe8e727d5d6c69a4e3c987fece4d3d2e0ffcb036fc3cabc9b3d7f2afdfe1
SHA512 bd2f9c404b49d9f158d2c6b5e86d29beb42ecd1a62e15bd921ff11ebc91c921408a4646277dc94b56d54ed915b41da1801e6ac591c68496bea55a1b52c5822a1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 477ebfaa9850795851b967d957a3c3b3
SHA1 2f1404f4a6a4ea6aed5edbb1e3fbfcbaf1297bae
SHA256 4e9d295331354b61a6fff2d7760488e5688787d238f511f77b89df408aab142c
SHA512 4e0f3c5a6c6a429bb725c6fe0960113154955b0a1c7c717eadd82f9f8f5bf4cbc1c7d4d83b3b580b93a6f96cfb8abd77ec437a845c03349ec586708595227c3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d0d66ef5985fbe3f26bb520b6a632870
SHA1 b378d43eac8f678ff5903ad56c9df1fa5d5f7d31
SHA256 cc12005a40b77ec87528711f2f12da0111adf459f1c8b4b20be536ebca1498fd
SHA512 5fda03b8809ea6fc923dc536039a9c868f4e390ba7d9aec3f6c14cfc975b037b1fd9eecc94072e78eb9829c952f47c7ac006537263e2a2a73302101a8b301f82

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7H6XY0V\1380534674-postmessagerelay[1].js

MD5 c1d4d816ecb8889abf691542c9c69f6a
SHA1 27907b46be6f9fe5886a75ee3c97f020f8365e20
SHA256 01a956fa0b3ea8cb90d7032608512bc289c4170bf92759352e40062d5be2946f
SHA512 f534f057e46998bd1ff2c423ad2cf04a880c4a5259e95aee5c6ae34ce7121ccd07ad1bce5d4c3a51ad04f7411b0625da78808326b13d2aeefec502988e113113

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\rpc_shindig_random[1].js

MD5 45a63d2d3cfdd75f83979bb6a46a0194
SHA1 d8e35a59be139958da4c891b1ef53c2316462583
SHA256 f7067f1d01d9c60618becbe4df3d61778244108459226e2e8a818cfbc2c18ae6
SHA512 cea9c9eb8ff0c43048ff371f135148438fc1a2614bf8bbc3518cf430c37778edba3452ce92b4236679cd1a4123af0ca320f530b1c20cedd0883b545209c048cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 86cd76b5fe73f6c7435ae1444511cecf
SHA1 80c7bd53ee6b83e4caf07845db6f4c2f17353656
SHA256 4db6eb41e7fad563d09eaa9ae547cfadc42668c38f2267afdfb91bfc62cb2803
SHA512 d2a01e64bdeebdd98d8dff29bf2e2717a4f609eb0451821fbb68863d1bd984b38e36b18541ca7770a7df5310f438b99a2f400427e33200dc89498ce044e4e584

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ae1ed8850806ec18eba955287bc29f7
SHA1 36b572bdd0fead2a880629bc560323699326a5ba
SHA256 dc8ee2296f39c508a6c5c75f412ee3ee1ec05c4b46afdfbebcdb50f3da0e2939
SHA512 c58f78c9d54821841e22c0474407aff475d1db99890bfd33c0762cf52c813bad9677727867de8c2ab21bbfb0b69753a74244182cc2c844cd3c237de7ac894628

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 e45c60c71fdf603f12f0ad8142e1922d
SHA1 96e73aa2a04d77ed2eb5994fcce7cab318fe3723
SHA256 2d78a708677fa353da385837299557dd0050aa0ec4d8fc423960ebfc3c791903
SHA512 55b853e32b2652123dc23421a7517f98227718e5f5e160184ab4a058140c01e7a5ecf35c12e8910bf6e9937aae0cedc419c225b6a6b5cf8872ab49947925c236

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9402df64fe5a31db25caa4b61e95ff93
SHA1 5c2702d5f88aab58dcd87106653fe4e2479684c6
SHA256 e700372854a4891d8a227f4abcbfc69422fa04825c4faca24019fcf23cc6ea80
SHA512 116cc6d9fc4225b66338f511e7df6d20b86bd5009af3206ce48a5ff77036522a0d6f53f4aba7a9b1d3f7c380cd4d5edd9bdf019af5832216d75518a79ee37b19

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5eb6b7e2d5948f188856fc9c5ba18dac
SHA1 e955c8fa2470a01f6e7abdfb71c4348b5dc34557
SHA256 0b4c3e847d313513be646979b3cb21c107a9bfa31e9dc080efb6f32dbed88a37
SHA512 beb50bb36477cfda931befbee2c639fb97707893309393aafad70965add16a6d3836e9e7431f42e05d6746ac8b46c0dee72a9b012b734aa5ec372561518e76b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f35704f98411a1c9a1ccda74f1a170c
SHA1 3f0b78722ee380cda938ca87d7d80d978a6010f8
SHA256 562b6afd2587f27eac1065252d28c0d45df26145cd2a904d331fda6c1f96cdcf
SHA512 34c42edf6dcc4a16577f74b93f51d0d4cb30e782875f8e98400767ef66cb456a92fd48db5e5ffbeb4058e033b4c84ca4d791387dc88d02680b4f840af6772396

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fef8a03ad85f886879a1bd39b172487b
SHA1 867ceda8b9407273d2ba16360f58f13737e424ef
SHA256 3aad1c8fde20bd6de60e72219fada6cfc26a20f7c34ebf0087f19ec48718ab0b
SHA512 82601be868edcac53141ba6256b09d4ae87991c189295fb27010f6c645899a2834552f769c33438f5218ce590bdb286eccc21ab0519c9c6427fec25fe0dc47d9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c0ae19f1500008a4feaaea1a2a33a3d5
SHA1 74a138d2a1fad2aacd0739c415a961df50220bfd
SHA256 3d93a9a77e348d7bb1bd705934439c5b58a3c8d1adaa3eb9f4c796c6b0f6b5ca
SHA512 28f2c39062f266a7af1190750bb6941fb3b4d0aefdbdb8e245cfd94d5eaf04bc3dd3fd673f60934362026b42e4cbacb44b946a1f650b895dd54b0d797b651979

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19b3f137b5827ffc2aae5242abb4635b
SHA1 436d25c39495bb9778747f5a9ac3b645aa2170fe
SHA256 c415e18506c461fc240197c2b3f35ed0f59c171bc4b18096596031478d288b41
SHA512 20da73aa955e25731842b18f551a4e10eef29022448a2b08e73f680271987a241bd2086b3beb1d0e7c8a6cc148ed6660e256efce0f9eda069cec06849b7ecad1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 ae37df6cb9b480a207d68da4d9cca86f
SHA1 a91bc0bab6fb81692981c6002ea317d7d27f1509
SHA256 bd261eeedb548662458c6bd8e54bf237599802cb6de8d6bc87102ca7eeec8d44
SHA512 c925a6be695f5a518b9c963d4aa638853b0e94b55795c6de93d3db36a91fa42b1c161dc1af454e0a27ecc817466be790f5d12ebb8d5c02d490f5d6cddfe1d1db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 17bad07d9a5b2c21a2b051ee73bdc562
SHA1 f92eb6b2a83a3d72b7c3746e82011c438c49635c
SHA256 0ef0ad8bc1c442df640e097cebe6530b51035fb3a452f439cbbb6c595e7a8578
SHA512 3a94acbfecdda9e49bb28c171aba36d6d8a37f4327b6a7c2d0acc1db4e3657be13be9bce0caed7abcd361214ce6451d26d394f71633ed9876330ffde12b2b274

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7858ee21ec285ad10d0c661665133aff
SHA1 1c80ace91b1f46358879a2102b9cb9123a343024
SHA256 28ae38184c796aa438ccf5c2865f05dc579b4357a0ec4cda370e71def24dcaff
SHA512 e977d53f3e05c59aafe93ffaff6b3a3e5fd68bce683200f2bff2711d3e356bee1eb8995d6ad29c6ece109ace5b8f6463e18e2aee46fdbc75ba055dcfe3c1561d

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-27 02:45

Reported

2024-08-27 02:48

Platform

win10v2004-20240802-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c43b9078c4db5b71ccbdcb13aa95257e_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4596 wrote to memory of 1708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 1708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4596 wrote to memory of 2620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c43b9078c4db5b71ccbdcb13aa95257e_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfe1346f8,0x7ffcfe134708,0x7ffcfe134718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13219268303149054832,9922514629900343568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13219268303149054832,9922514629900343568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13219268303149054832,9922514629900343568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13219268303149054832,9922514629900343568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13219268303149054832,9922514629900343568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13219268303149054832,9922514629900343568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13219268303149054832,9922514629900343568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13219268303149054832,9922514629900343568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5664 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 www.blogblog.com udp
FR 142.250.179.105:443 www.blogblog.com tcp
FR 142.250.179.105:443 www.blogblog.com tcp
FR 142.250.179.105:445 www.blogblog.com tcp
FR 142.250.179.105:443 www.blogblog.com udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 105.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
FR 142.250.178.142:443 apis.google.com tcp
US 8.8.8.8:53 otomescriativas.blogspot.com.br udp
FR 142.250.75.225:80 otomescriativas.blogspot.com.br tcp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.179.105:443 resources.blogblog.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.179.97:443 4.bp.blogspot.com tcp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 97.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 casadeseries.files.wordpress.com udp
US 192.0.72.20:443 casadeseries.files.wordpress.com tcp
US 192.0.72.20:443 casadeseries.files.wordpress.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
FR 142.250.179.97:443 1.bp.blogspot.com udp
US 8.8.8.8:53 casadeseries.wordpress.com udp
US 192.0.78.13:443 casadeseries.wordpress.com tcp
US 192.0.78.13:443 casadeseries.wordpress.com tcp
US 8.8.8.8:53 media.tumblr.com udp
US 74.114.154.22:80 media.tumblr.com tcp
US 8.8.8.8:53 s-media-cache-ak0.pinimg.com udp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
GB 151.101.188.84:443 s-media-cache-ak0.pinimg.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 64.media.tumblr.com udp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
US 192.0.77.3:443 64.media.tumblr.com tcp
US 8.8.8.8:53 i.pinimg.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 i.imgur.com udp
FR 142.250.178.129:443 lh5.googleusercontent.com tcp
GB 146.75.72.84:443 i.pinimg.com tcp
US 199.232.196.193:80 i.imgur.com tcp
US 8.8.8.8:53 131.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 20.72.0.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 13.78.0.192.in-addr.arpa udp
US 8.8.8.8:53 22.154.114.74.in-addr.arpa udp
US 8.8.8.8:53 84.188.101.151.in-addr.arpa udp
US 8.8.8.8:53 3.77.0.192.in-addr.arpa udp
US 8.8.8.8:53 129.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.72.75.146.in-addr.arpa udp
US 8.8.8.8:53 193.196.232.199.in-addr.arpa udp
US 199.232.196.193:443 i.imgur.com tcp
US 199.232.196.193:80 i.imgur.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 blogsbrasil.com.br udp
US 216.239.32.178:80 www.google-analytics.com tcp
US 104.21.10.111:80 blogsbrasil.com.br tcp
US 104.21.10.111:443 blogsbrasil.com.br tcp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 8.8.8.8:53 www.blogblog.com udp
US 8.8.8.8:53 178.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 111.10.21.104.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
FR 142.250.178.129:445 lh3.googleusercontent.com tcp
FR 142.250.178.129:139 lh3.googleusercontent.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
FR 142.250.178.129:445 lh4.googleusercontent.com tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
FR 142.250.178.129:139 lh4.googleusercontent.com tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
FR 142.250.178.129:445 lh6.googleusercontent.com tcp
US 8.8.8.8:53 lh6.googleusercontent.com udp
FR 142.250.178.129:139 lh6.googleusercontent.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FR 142.250.75.226:445 pagead2.googlesyndication.com tcp
FR 142.250.179.98:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
FR 142.250.179.105:445 www.blogblog.com tcp
FR 142.250.179.105:443 www.blogblog.com udp
FR 142.250.178.142:443 apis.google.com udp
US 8.8.8.8:53 blogger.googleusercontent.com udp
FR 142.250.178.129:443 blogger.googleusercontent.com udp
US 8.8.8.8:53 www.meionorte.com udp
FR 142.250.178.129:443 blogger.googleusercontent.com udp
US 172.67.74.46:443 www.meionorte.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 accounts.google.com udp
IE 74.125.193.84:443 accounts.google.com tcp
US 8.8.8.8:53 developers.google.com udp
FR 142.250.179.110:80 developers.google.com tcp
US 8.8.8.8:53 www.meionews.com udp
US 104.26.9.125:443 www.meionews.com tcp
FR 142.250.179.110:443 developers.google.com tcp
IE 74.125.193.84:443 accounts.google.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
FR 216.58.214.163:443 ssl.gstatic.com tcp
US 8.8.8.8:53 46.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 110.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.193.125.74.in-addr.arpa udp
US 8.8.8.8:53 125.9.26.104.in-addr.arpa udp
US 8.8.8.8:53 163.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
FR 142.250.179.68:443 www.google.com tcp
FR 142.250.179.105:443 www.blogblog.com udp
US 8.8.8.8:53 68.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
FR 142.250.178.129:445 lh3.googleusercontent.com tcp
FR 142.250.178.129:139 lh3.googleusercontent.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

\??\pipe\LOCAL\crashpad_4596_PEECWVPSIDLCYLLR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4cba4044492b709b00d26dbd0ea00653
SHA1 51d01455c22e17ba91b4fa6ff9a39224b7a88e1a
SHA256 47fa17316e377f6195924fd4288f8a5140f8257783a5d2b8ace03f8e3b6c02a7
SHA512 37e0a7ce52973c31ce5042b19e05949245a9523b97a23af932cbf75b4cc2f513a2c95c3355e8bec7eb63ebb8f994d6c07d9f7cdbbf9601f962bd6a7bb2580e8a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 64ca1b1de585f74658f1ae64fb58e8b9
SHA1 840a0321ca1a179c150289af1a10fc58cf6a304f
SHA256 eac9c4f8a6340d70985267afd0472ba8f2f645cb7552b8e8c7f73a8e019241af
SHA512 2790659e33f1b0c9ba01b4dc5fd7557dd1b7d8cdaafd9ae47482ba291c244ca3b855993b8b317d6bc3590b242c835d1e428dab7605186bc752051da148892456

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2b74f3a3a8743b234f83bdf7c149cf2d
SHA1 63af7907d97a4307380acf5868b99a82fd90f356
SHA256 9f58f350fa693ec1807fb2c09a3807605de615ab411afccaaaea081167502d8f
SHA512 3a2c5cae6ff84ed7be82f9812630ef4e4f331ad7651d9f957dc31da484440775b689a1ddda27a1daf55b91bcc42c9aa2b9693818bef362882fad00216b82cbf1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 f9d774507ea3885babe13780adc86480
SHA1 8588aef130efcb1dcfd2a1efb238656a1f6502a7
SHA256 c94bfc9d8a688e754971d947129f6f39ec55f8889b8c3470cc9b00d6b8871915
SHA512 933a0fbe40058e569345bf12f02d6fba4cdd851ee143e362795dcda4f9713e78a03c3af787d6f0b1f597049156a8d5700c12cbf7bbb615eab683c13e0c2a999b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c733c84b440f7a9f983fc2c221c16072
SHA1 751be10ead76ac68b99c15ffc8e5ff12114f799f
SHA256 1e1ee1eea7173ad32d719b5ee574b2271ac8b423dc3af393b6957751104e8355
SHA512 073792c87a0416dd60b2c4bef82c59e9f4096fa1316d29049285c61d921c6a19e7b85e26715ead4b5f51c5f778b690449fee67801cfca53afe6f4c3000c595a3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe599725.TMP

MD5 b76f95d79ee95cdc415fa8f5d770f7ec
SHA1 6ea59f23ad5536d01a2e4cd44171e731534cc619
SHA256 1f5638b808f50f7c270d59372e167cf99fc0db283b5b26efc28bba23960d76c2
SHA512 09e9f1cafcd7d951edf52691345b8aca0b208e1d10998457447946300e4a384ee7d9e2f545983042dd5cae609e4043320bd71d6252f94c62ead7f52206fcb3d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 fccc190f5b63f8ca9a9187052aaf4191
SHA1 40bbe09fdf4e531fc2bc4d136ccb649e60ba4335
SHA256 d1071eb90a9f1a89ec60bc7dedda26121d10b258d9c86367eaa7509b8dd879ca
SHA512 3c8b2cb364cf98df527e350a60072a9663b662ddd38677f48206a682d01a2ab32aa38087fe60dde4ccf8bd662a91a011a285b47949c29de8210a83c722135cb5