Malware Analysis Report

2024-12-06 03:22

Sample ID 241027-12yp3avamk
Target 762ed391d05eb33375099833108db7a3_JaffaCakes118
SHA256 fa55f8518ed7c5b3fb24fcbc94c6870fcf5d8862b0e890223696e5bebdcc9ae9
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fa55f8518ed7c5b3fb24fcbc94c6870fcf5d8862b0e890223696e5bebdcc9ae9

Threat Level: Known bad

The file 762ed391d05eb33375099833108db7a3_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

Socgholish family

Browser Information Discovery

System Location Discovery: System Language Discovery

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 22:09

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 22:09

Reported

2024-10-27 22:11

Platform

win7-20240903-en

Max time kernel

141s

Max time network

145s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\762ed391d05eb33375099833108db7a3_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21236F21-94B0-11EF-85C5-7E918DD97D05} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436228834" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000caef9e4e686d1d07a8463cc537e3a420eeca6cc8630a88ba52513ef82627abd4000000000e8000000002000020000000f73ce84162af2788b96873072917f94fea046a7727256fd681d13334c16dcd4f90000000b7e27d6eb8856d6558a3796fae7511e4b8c7c77dbe9fe4ff45da2f838e5bcd53e0131cad4eb11a066aba01240eb556614a6841af248a320ee051e5ac5f80b8c81b23b6f08c75569b87ae7974227ba3b090a2c6139071fbdf936baab006332df30b59d4e2d5bcd234994a29dc9649aa87feebd90bf41e4655b954bd0b9bf6ffb570d5a4e31aa20fb49bf63df59c82fcef40000000390b32e273c851c5b2f64fff012730fbee97b50bfe121bc3b5d697298d6b954b5096203a44de09066e5bcefb31c9d1f1f1c9eaef0711ec34afa3165b3fde4870 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000014279ba218ca7cd6efde300ca7780bced1633d614ebc3e7b7515cd8e77c45955000000000e8000000002000020000000fdb69ae4f6f9f2777658182f465dc752a2345ed671e98565fe13688da185054120000000b0e5548266ea3d395558bba21612aea6378a063695940bd0f9e281f037469ef440000000e3b89074871f260c9eba827abe219bdb33054825678eec0fd329d777daf03fbce3df68493cdae5a4a6c9846450174597299b2c54addf666da3bbde1e4ce9aa36 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c784fabc28db01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\762ed391d05eb33375099833108db7a3_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.204.67:80 c.pki.goog tcp
GB 142.250.180.3:80 c.pki.goog tcp
GB 142.250.180.3:80 c.pki.goog tcp
GB 142.250.180.3:80 c.pki.goog tcp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 142.250.200.42:80 ajax.googleapis.com tcp
GB 142.250.200.42:80 ajax.googleapis.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.200.46:443 apis.google.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.200.46:443 apis.google.com tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 synad2.nuffnang.com.my udp
US 8.8.8.8:53 themes.googleusercontent.com udp
GB 142.250.200.1:80 themes.googleusercontent.com tcp
GB 142.250.200.1:80 themes.googleusercontent.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.blogblog.com udp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 s7.addthis.com udp
GB 142.250.178.9:80 www.blogblog.com tcp
GB 142.250.178.9:80 www.blogblog.com tcp
US 8.8.8.8:53 adfoc.us udp
US 8.8.8.8:53 www.auto-ping.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 i1174.photobucket.com udp
US 8.8.8.8:53 gickr.com udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 www.newcounter.net udp
GB 184.26.134.46:80 s7.addthis.com tcp
GB 184.26.134.46:80 s7.addthis.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.200.1:443 themes.googleusercontent.com tcp
BE 18.239.208.12:80 i1174.photobucket.com tcp
BE 18.239.208.12:80 i1174.photobucket.com tcp
BE 18.239.208.12:80 i1174.photobucket.com tcp
BE 18.239.208.12:80 i1174.photobucket.com tcp
BE 18.239.208.12:80 i1174.photobucket.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 162.159.135.42:80 www.auto-ping.com tcp
US 162.159.135.42:80 www.auto-ping.com tcp
US 104.26.6.10:80 adfoc.us tcp
US 104.26.6.10:80 adfoc.us tcp
US 172.67.215.51:80 www.newcounter.net tcp
US 172.67.215.51:80 www.newcounter.net tcp
GB 142.250.178.9:80 img1.blogblog.com tcp
GB 142.250.178.9:80 img1.blogblog.com tcp
US 172.67.131.14:80 gickr.com tcp
US 172.67.131.14:80 gickr.com tcp
US 172.67.131.14:80 gickr.com tcp
US 172.67.131.14:80 gickr.com tcp
US 172.67.131.14:80 gickr.com tcp
US 172.67.131.14:80 gickr.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
DE 18.66.240.120:80 ocsp.r2m02.amazontrust.com tcp
DE 18.66.240.120:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 widgets.amung.us udp
US 8.8.8.8:53 www.facebook.com udp
US 172.67.215.51:443 www.newcounter.net tcp
US 104.22.74.171:80 widgets.amung.us tcp
US 104.22.74.171:80 widgets.amung.us tcp
GB 163.70.147.35:80 www.facebook.com tcp
GB 163.70.147.35:80 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
US 8.8.8.8:53 lh6.googleusercontent.com udp
GB 142.250.200.1:443 lh6.googleusercontent.com tcp
GB 142.250.200.1:443 lh6.googleusercontent.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.73:80 crl.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 9186a444a95240c2b5e753055622bd3b
SHA1 74238539c1bc429803ca800539927246a96544ad
SHA256 714b1c133ba1264eea67ad6ab95b943ff412f369bd2d3c2ace73683d25312e19
SHA512 afc6dfbbb4e389e0c614b66b65575b7d305ed94a46465a511dff3dcb8e55547a2a62a30c3afda7388db55b5354456fb2d1a006a21a40e5df556f6ee4d6adaae4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\Local\Temp\CabE312.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarE316.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29deed48b73d0624c91b6e920a9c22d8
SHA1 0655634c5dcb1b23450b47f345aec00dea7464f3
SHA256 4ac963c04715cd670c827a0fb7756573f1cd0b06204657fa95474f944def96af
SHA512 e1a2c6a1d9a95b0812e3031f811bd4407c3ca5972d8fd7cf79776093ff682f68a19ba02a2b904154d96a4e695c3757cdb4b6cc31bd710d856cb0463be684a455

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e61943806932aed7c719bfdcdc363f9e
SHA1 2801de000cde9d1ee9d09c794c8e8ca95e68b0a3
SHA256 8e3d9378ad169c512caee194a7cd8811d3da5f785ccf47f84490041eeaaceeed
SHA512 39392abd9f92505ebd9647f98fedc68a58b4691405140e72f542073027c362d77414ebcaf39d13da392ffde1f352719d642dc4163217da9a5a0b8a040782d653

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 403b654e691e361db3a0cd8cd0854e2e
SHA1 224e4885f5affd74bff25083f86f90958c9c1354
SHA256 2bfd82828b1e10c35cfef39bdecbdd8e62653ac45d7419aa0b001303ff02f911
SHA512 ef59107a1fa47580b62905328c1ba2364cf643e38ec1c34c0f3fed82374506283c1e186735added938212855974ebd47ff961f07d5201f5a447fce38af259294

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8909cb3afb9c74792aac5d93187339a
SHA1 6dcb97e722074cc7e89963d44eda4eea55a071a6
SHA256 bacdcbc9d4a4243c69a74955e0ae626788f9a50f969c4535a920997fbbcdad60
SHA512 d2b855308d0e08f4b1451d653a2d0e87ab904c059c3156aa4472bf348917b3b692298ffeb748e0f76b8a159d5f21fc08660d4d2e5e0ba46f9b47e49ad97d5a54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 492e4f2bcb353d5dd29567fbf5ec8bff
SHA1 c4d5a07d7d5270baea30441cfbb2f410d2d9013d
SHA256 727989e5021cbea6626934062ede474dd11e0a62ea8e614de9857333bdb9f8d0
SHA512 9cd0263897044b506943d358afa74b496296d4afe40b8c38dcb8014078c0e1f91825f598343230f065372ac7a7a067e08b0061bc4e104b8802b0f49db70f1102

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ee0ac7a8b02efc3a87d731f7780423f
SHA1 2c58754436c123fb8740883038d9f81a097a0e39
SHA256 64abb1e893d9699c3f4f03f3cfc153049c6e51484bcc8ed964f142b59d0f76e6
SHA512 39fdad39ead30ea97a1494dd9cd6051d04961caca97cd18dd53d663e8225c4a9c667d2d2c20a0795666e2a7ee7e45e3f8ed92300fd8b4383dbb3a95d5561bc46

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

MD5 47bce8c3cdd17394fefaaaec2c4006bb
SHA1 f0b7c8e054e253565e253336504f4986d03281a2
SHA256 26384f308f91787b07ca8c547335bb4c2546be883c02c391b1433f07616601cd
SHA512 f69cf63c6801547a35e0ba3bd4d0ab02a636f11d56c185a303a50b51a65b93caa5946059b710d6a17bd82d0e1bc65b3db84fd8299e66c1d2b48024fc682c45d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

MD5 d0d9a0909fea0641142a1b502ede34e0
SHA1 e87b688c878accee897832739f60843454c81bbc
SHA256 a965843701374d57e38c2c82d56329494c2b430c97f520dc6b0c3b80f84f709e
SHA512 66d6c354dad4037f6752ed96d7773e5c39e1c4ebd6cce7719dc1f4d95a6eeedd00f1bfefd34cc7f700fc7a94f27d696cf3a9f7c65935577638f87a22bd7ea3f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

MD5 6f5d6bdd92483cbd29ebb41408358aa7
SHA1 9352722fb1a3e16df2d7f6f0180575717df420ad
SHA256 83d37979de1e81c63d02c14d01dbea5e196f4b8fc69270610df7f56fd862efe7
SHA512 350a4e65c170800b2bcffcdac1f558419ed457337cf79fa017c6aa9e3183bf3766932c46ae7d131b21666eb37899e853e94631bb8ad4ea4d997787a9bf8703f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

MD5 422cb19995d212a1074543c5f093793f
SHA1 6ee3e4857ad4bb59c5bd3709a6f022c44e52de10
SHA256 f6cb63cf0db5b32be2195837afab3aab3823dd3ddff35d4ffe248cf5a30eca13
SHA512 ffb420a139e7b82f432845000cc4c60a243c727145db952c157e1a70d813c4c32bb39d42bf57a0f8ce25f045af355111226502f0e392ec3a3ecb29c2b158156b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

MD5 765e33888ee8f3908653476a0e638fe2
SHA1 2879e90ab47f6f0f947e97bddd26f757ef1cc5d6
SHA256 8c37afa1d04dd3f738570728a5366809a8496940ec0067b7d1bb40a17ee48849
SHA512 b370a1e2da47ce6c4043e78fda0a074e3359e21c7f5e128d6c25d47e64012cab0083cad997d5ba070430c9f2e2a07dd48756c2c407d1fb3128065d1693185c0a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\plusone[1].js

MD5 1106da066ce809fb5afe9c6c1b4185b2
SHA1 3b64d3a7f52b4c07047fa8727db4207137733bf8
SHA256 d0f3af1e716ce7846e7c252ace160c12480d41eecd5a7e7917ee5b2ccde62b51
SHA512 3f0205b89d5293f14d863e344680a9d8518e5d4ee3b981dc5981106534bd597ed6b388eecab1385320f77c8d5a46a4ce5b64f03f4377b8ea13ecf9b569878fd9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59b302c14394e43b9d266a0e9d01249a
SHA1 2d767fd4bb0553580975fc4d396beefa9ca8fca8
SHA256 7624aeb70c1845bc16be5403d0c32d2c42f0ab9dbeb8ea2b1e5f2db33b65fd71
SHA512 fdb95033ac6f6874b7d22f10f340e534ec6be68498b2b1c35aa79a28f005540b1d04f33e19e689dde4bd3d3e8c0dea3375e85090c8b2689bc6061984c826ddaa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92c977161342ee3e01601e2ac9e07d14
SHA1 bf8d514cd5004f1af3357e465042b2e807749915
SHA256 8aa5905f5d32afe3f2eb8fc9137d2455d7ead90145b08ed39e081b098f4e2966
SHA512 803452fccb24abd955e23214a9f3bfb60ac1d5ff76365ac46be75feb569b239a72a6184782aba91d19de36e90a2add34f4fe5e220f179f5b3490c970ff868678

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd82dc97d5160a3a05fae5cc89cada46
SHA1 ccd626b84bd7551ca0f1c9013e63b39f17f8d611
SHA256 910136fd6897ed7051fbe3074559096b1f38bf1f8c0831483117b54c262dacad
SHA512 5426c4dcc158fe57233422637830adf2d1d69fb96b9c59bb77f36f565f6cc6cb574748c51d911b6f2653a8d1489ac9e08d330ebde422f18900642dc9b9fa52dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a05ead4e10a985af08dc9f74aabca308
SHA1 cd229b4462efaf3738110b39e8ab05ac7ced2270
SHA256 d933ab35cdde36e93265180bc8b21463dfe9c156fe813f3cc6a8a4826fa62c55
SHA512 ab5786b81db43c059a99a6a0a1b30e036047e13040a55abae7bca86c5d72da8e0fafa790252e736418f93eff765d7f49fe2b1cbba14e35b625d2805949aba405

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ea9da13dc7ae2a16b0ae12a991ff520
SHA1 34d173ddc2707c2811198484aa7ddbeda69066f1
SHA256 f3a7daf4b210a31b4a4cfcf7fd4b00d663099a21948afa9fb3325ee76dd076f1
SHA512 2a1caaf2ddf1a392e5947dc44a1524499c07c33f46c7f58f1f20c301e7b2514fea3149c8fb443c6ab3cee9233bd140b5798cec3e11b339b917931ceb74175061

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 173321674570feccf0464e6abf33530f
SHA1 0225ccc06b13e2d7c8eba491bfa38150a5c80fa6
SHA256 30dc287386563910724cc8a07f762aef12664b4c42687f9585ca6efc37f87a9a
SHA512 adb4e71eb354c03b2c819d1d1703ee1cb43e68c8773970cd43c2ba2b39d257ac32a5e926344103bfee77538a040e9e1a883bcd936f91679b8cbd7de3e04eb5d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ce766c750e02840728b992090c86dbf
SHA1 b01c139dbdbb6fb7e9cb139eba6b6a92c299bd87
SHA256 966c1b9fa5e55debad762f312b8483cf7623b596cc104d7de72a0fa75f41b735
SHA512 a55950c471bdf995a611a352a2cdc7b0d16e0d758d6ff6f914815fcfdaac9d7595410f274e3a454c14c5b10f1c2cc04f3f1c79909f5cabe523a6e5c66e7fbca7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c93c04bdefa95a1cfd4b0585382facd3
SHA1 0d75a64931c9c459f21434c9559f5ee2b46340e9
SHA256 a2d191ab118ba17d0930951a065a361849ef9f55564083ce41f47e6899b7702d
SHA512 3d3378f4c8e3bb995e137ce65248a93a6b53a4fbc662c5039131bee8a065509b37edc08b61edfd0b016eddf4d5d77728a8b95ecd3a15693dae4b452e8a95e152

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 01c14bb63de55fcc4b8971f872ce532c
SHA1 94671f04d4f8935b58915c4cab5c970ee089b286
SHA256 bc644b5a6d86c5ca18fa60dcd8bcdf1cf06d7cc0a0144c8996d5929b08817726
SHA512 2bd132eaad74a64a7aff5131a1e5db6e376c956caf54ff41777b4406bd281ec4791011785255d5e5ad0501418e6ce85d0a443e56552c57e2ae8ea2195f694178

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3dd95533845f1320f7025ced1fea25b0
SHA1 56c7c20e905e83ac79259730ef1ca5beb755a4f3
SHA256 d9a0fc08ff80932b42249bbf7da26b61144e8126207f1ae0f80434248ca36fbd
SHA512 3970d73dfc79602640a12e3f3f78b3bb6bd529e96f56b26c233bd1f29161189762872a04d58b8b66f4194c4f2c6934eb574411434c3e3a65267c7a85cfac8ab5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1301e2efe5d587e8326065fc161b6f6a
SHA1 fe38f0c6255f406a4a2801c797dd43d4c97863af
SHA256 f4ba749a3376d4db1600befc02298df1030aa168704ac62a93e484eae2f6bf5f
SHA512 0a72dfed704bc96b07e0a787ae0906d81fe0dfd50edc9754f3c4b20015fb88c8245408e85521a4762f65175e3cbe0adc46f8e3b386a85fb8be0f9247d4024c4c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e36d8b3ecdc4ba992e8e48acee12dbf7
SHA1 5233195af97047f5b0a4461dce4b58c3e0a406b2
SHA256 47e74a4506e4086f87d94e9b87730272cd6f3e2b1cc0534dcfaa87c86178f89f
SHA512 8d59fcf32e77e35f34996b555c1d65128e804990591d4473d1846b20f8c25a29c16d8cfe45c25f46754e734124b784eea394de3bd72f228ccfac14cc99266579

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 aaa917d9a78a3a164a5a65192fb23d3d
SHA1 95641a2e8ec2ead9c49760c180ca6f86e65a86e2
SHA256 232b2cb3404292468d79750c5d0aa2f365170c2600b9bfc68efd595970fa8fbd
SHA512 7cf5654ae22b7864c3c70ae84012a067597005acffadfd733f7d4a38499e6247132bae164490108c03196930877a1adc99d38fedea6ea0007c6910db5d58a55b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5f91ffb81bfe31b76cc6c80e241e0228
SHA1 aa6810488da19620b8098c5a73736dc60b7fae15
SHA256 b4443b5bcc5e9e091af75b2235e3351d9b53f865dc577a05b32d00660ce75603
SHA512 cdfd062d84792c83fad9669322abc835c43961beff6c62e28d6cf8abd5bfeab6959c7bbd1ad16e270cd1ffada230c77e84e9f12f4419e761326840684452cc77

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8da39688bda808a78e7cd3f9b545ff1c
SHA1 10de486d5cc52a0a30b4d0e91341c61590dc7d58
SHA256 fbfe13faa3ae387fa0641b727d30ef1643d6c157936419a766c74aaedb994326
SHA512 fdb0199db919408bd966b1f9cfb2a7c79df3f37c4443219aa8a8b1e913a13942fe06b94037050d0c4dbd886b9d5785c1b98570018791663a8a462face756d838

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7aac21dbdfb772767a562988b6e04c39
SHA1 1ebc1e9667310b46d9ac199fcb1092be6b3a4e48
SHA256 40616742da3848be80793143b005b6b25af305e776656deba37c66443fe97efc
SHA512 5d67ec1ee395f1848f04fb387d9af3d374272b38c50d8706e10e8a01e99756e5afcc46cdbb8792b72b75a6c2a21def302a3754476984b3a741b85bc2c5df799d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 df08ed76cfe8b1f8ee85dd8d9d478941
SHA1 5e05327c4c01331fc01e0d19d9433ead8e2082a4
SHA256 e19575bb3d932b7fc1f91b6635fc0e928692f14703045502c3b5e53edec13a91
SHA512 87802a2d22288a9b30e2a11cf15b187bccf0063079541e5dd28324fa66e59380640f3994a23f63d8bce9a26fcea18f563ffa71a653d60bb03c07c9414903012c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 deadf251a4a9c786fc39edb3b7a48518
SHA1 5bcd3d31233e60043aa979d15a592774196730e6
SHA256 aa1c2cd1d1bc138f557e7a9b0f816db94b2b441fd4a3d749a40ff3d14900558a
SHA512 a1c38f9e80f6c84652798b1515206a8073feb18a606c742fbb92884c7b68821c3f5c618de5ad10cd48fa32f1f5e1ab312e1dc5ae6969b7aa80b30023407cc86b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 f3bd60d3330bcaeb924d7a487d695a3f
SHA1 03fd112ee60555dc5644ee15568dd361a109c5ed
SHA256 781f2a41835718ccf3feee61e69274650014f0cf3476e9205e6464bcdaf619a6
SHA512 e20f7deb799a6ceea28794aa21fa4c51122d8aa42b725d77d07fd0b872052b50950a1d29f6f811ea047b58c9bfb3fe50fad176db75f216c3fe465de1589e94f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 06517f7ef2599260eaf2eb103aaade4d
SHA1 6de86926a94997134714ebc9bd63716e2db44fc6
SHA256 0e4a9f3395d9b8e6adba189188f822a035c10509959a248622293e411881fefe
SHA512 98161bb3ac2f0b484bb0487a008bbbb5db8894fafb56b2ea5292cd25dc99081d36cfefc6d11de1fbeef2a433601ac609d77af92b78b8f392dc27d5c0d3e887b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 277c62ddb44d2b9c4104cf38d7c339a9
SHA1 70260af8daab596e4490dd5b09b099ae78c59f98
SHA256 479ff5dc6fc9cd73469a8a091a14a4531ab3976ddeee660aabc18549996a4973
SHA512 061cc1eca5f80ed8e2eb2dcc70f8230c56439cdc068457c9c95627e809a058c8ae522c799950321095cf075ae1d6383075989252cba84aa59fcf0fcaffc0c3a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cc28d41707cb7f4d8b1aad1864dd20a
SHA1 3c1fcef0c4d6dbdd24ac7d1a825a928feebae2cc
SHA256 1797abf9f39b2aed0d6d583f1573818ba07beeca442593bfc59278c29be8921e
SHA512 8876dedd22b1d3dc85ba7869f8500420a7a51bec500996ca2039fa0338ba75fcfe655a7029563487e1e4ea362a56f353114a136bf0cea56c619c028ec488852d

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-27 22:09

Reported

2024-10-27 22:11

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\762ed391d05eb33375099833108db7a3_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3996 wrote to memory of 548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2756 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 2744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3996 wrote to memory of 4404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\762ed391d05eb33375099833108db7a3_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9396046f8,0x7ff939604708,0x7ff939604718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1547445356963025340,8785828589890105702,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6000 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 216.58.212.202:80 ajax.googleapis.com tcp
GB 216.58.212.202:80 ajax.googleapis.com tcp
GB 142.250.200.46:443 apis.google.com tcp
US 8.8.8.8:53 s7.addthis.com udp
GB 184.26.134.46:80 s7.addthis.com tcp
US 8.8.8.8:53 adfoc.us udp
US 104.26.6.10:80 adfoc.us tcp
GB 142.250.178.9:443 www.blogger.com udp
GB 142.250.200.46:443 apis.google.com udp
GB 142.250.187.226:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.blogblog.com udp
US 8.8.8.8:53 themes.googleusercontent.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.200.1:80 themes.googleusercontent.com tcp
GB 142.250.178.9:80 www.blogblog.com tcp
GB 142.250.178.9:443 www.blogblog.com tcp
GB 142.250.178.9:443 www.blogblog.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.200.1:443 themes.googleusercontent.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 202.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 46.134.26.184.in-addr.arpa udp
US 8.8.8.8:53 10.6.26.104.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 1.200.250.142.in-addr.arpa udp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 www.auto-ping.com udp
US 8.8.8.8:53 developers.google.com udp
GB 142.250.178.9:443 www.blogblog.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 216.58.212.238:80 developers.google.com tcp
US 162.159.135.42:80 www.auto-ping.com tcp
US 8.8.8.8:53 i1174.photobucket.com udp
US 8.8.8.8:53 gickr.com udp
BE 18.239.208.12:80 i1174.photobucket.com tcp
BE 18.239.208.12:80 i1174.photobucket.com tcp
BE 18.239.208.12:80 i1174.photobucket.com tcp
GB 216.58.212.238:443 developers.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com tcp
US 104.21.9.233:80 gickr.com tcp
US 104.21.9.233:80 gickr.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
US 104.21.9.233:80 gickr.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
BE 18.239.208.12:443 i1174.photobucket.com tcp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 www.newcounter.net udp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 142.250.178.9:80 img1.blogblog.com tcp
US 8.8.8.8:53 synad2.nuffnang.com.my udp
US 104.21.45.144:80 www.newcounter.net tcp
GB 142.250.187.195:443 ssl.gstatic.com tcp
US 104.21.45.144:443 www.newcounter.net tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.200.46:443 apis.google.com udp
GB 142.250.187.195:443 ssl.gstatic.com udp
GB 142.250.200.1:443 lh3.googleusercontent.com udp
GB 142.250.187.226:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 42.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 238.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 12.208.239.18.in-addr.arpa udp
US 8.8.8.8:53 84.69.194.173.in-addr.arpa udp
US 8.8.8.8:53 233.9.21.104.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 144.45.21.104.in-addr.arpa udp
US 8.8.8.8:53 33.4.157.108.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
GB 216.58.212.238:443 developers.google.com udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 cdn.adfoc.us udp
US 104.26.6.10:445 cdn.adfoc.us tcp
US 104.26.7.10:445 cdn.adfoc.us tcp
US 172.67.74.85:445 cdn.adfoc.us tcp
US 8.8.8.8:53 cdn.adfoc.us udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 play.google.com tcp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 adfoc.us udp
US 104.26.6.10:445 adfoc.us tcp
US 172.67.74.85:445 adfoc.us tcp
US 104.26.7.10:445 adfoc.us tcp
NL 173.194.69.84:443 accounts.google.com udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 widgets.amung.us udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 172.67.8.141:80 widgets.amung.us tcp
GB 163.70.151.35:80 www.facebook.com tcp
GB 163.70.151.21:445 connect.facebook.net tcp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 t.dtscout.com udp
US 141.101.120.11:443 t.dtscout.com tcp
US 8.8.8.8:53 141.8.67.172.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 11.120.101.141.in-addr.arpa udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
GB 163.70.151.21:139 connect.facebook.net tcp
US 8.8.8.8:53 whos.amung.us udp
US 172.67.8.141:445 whos.amung.us tcp
US 104.22.75.171:445 whos.amung.us tcp
US 104.22.74.171:445 whos.amung.us tcp
US 8.8.8.8:53 whos.amung.us udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
GB 142.250.178.9:443 img1.blogblog.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 amazingare-ban.blogspot.fr udp
GB 142.250.200.1:443 lh6.googleusercontent.com udp
GB 172.217.16.225:80 amazingare-ban.blogspot.fr tcp
US 8.8.8.8:53 amazingare-ban.blogspot.com udp
GB 172.217.16.225:80 amazingare-ban.blogspot.com tcp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
NL 173.194.69.84:443 accounts.google.com udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

\??\pipe\LOCAL\crashpad_3996_GOUEMJONKFBDITRT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bd3e8b7893a9f7fc0b2922a3cebecd73
SHA1 4bf9c00df91486f5532080bb24b996bd981f62c7
SHA256 90d7aeafbfbb37834107a008655dd25f955eb6ad8aa43a9a4a1cee25ebae726f
SHA512 dbf362e8a8099f0644da1fa521658fc785882a1414aadb3450f1b1acb3778289f57eac5551d2738ac8d2c1a2a555e66a1e00bbf1189ef18b56ea5637c04b8192

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

MD5 05197e9427acea2ac4dc812f97a8f078
SHA1 3d2a38b79da52e57783360f195ac3e7c85edefd8
SHA256 7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191
SHA512 084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f175b72f40d500cf35f97f6abc949f36
SHA1 1b7b17e3e60767cfc9ff8ed7eb6eef97ee1f53b4
SHA256 64d5de7cdecc582e26afdf367e1ca8f32c84ef5cdffb20f19f98a83331a8e935
SHA512 809ad8444f0063737230abac490de02daa67eb3ced3e225a612bbbb266d380826cb4dc5c967f3864efbf9e074eb1a3dc6105be8f708c3c4433d3a8afdfedab71

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ad291b58fce85814b07d1095c0850dee
SHA1 ad440e1006eb51cef19d873372650dcfe3d68263
SHA256 8ac896ef63c2d7bdf62a9539b259dfa3a2e1374d2d4877f00e6cb61b0a89ab40
SHA512 da40de1945b5174dc2939ce4956bcebb470a83a3e650cb3a489c977a4797a4796051805fc74c036e08048f4c5778d0097e6e42c78ed0a28918d0f831b52c19bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7985612fd2c0d45dd67c288f21a1e687
SHA1 5a3d7c3334cf2be4d62ccdee8606fb614159b8ae
SHA256 6d1e472c56e6eef6867fb03b303e5343b1c69630ac813041e26eb9a9ce0b5a9e
SHA512 cea0d7e54673a81a894ac9226d8d24715eac50007bb7c5c090e6b624d5252d5152a985183ef7162f4bc17e894130198ba14f16850efda67fa22e2529644c4769

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 532be7ef62671b9c03d98e816fd852cc
SHA1 eaf0fe24dd8779eeb63c5ae473d6330e621e924b
SHA256 a20d6b03e6dbf0eae3c65fa6df1438f1184193f84d0609a7b84a0ab5f9eafc3c
SHA512 07f14a840f8dd7b1e118f2e1a3b41bd80e0d94894eb6c6b51b3c7ccfde6a4a2e04032479707a18be008d20cb479882f07e7e7765dddd9a8c2c4a6cf3768cd95d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 f520473a9a55a78c798533b25c8447b9
SHA1 b9cc1119d3e448d53f1b2310c1d4bd68c933e5f3
SHA256 4e38799f22110d4640f0c5c43b0600b2dc176e3a8751f71f76df037b4d4e8188
SHA512 fa9a6ecd8b64622bf9cdad2d9ea1e66a32e4f986dabf2a018d890f86188e9a48f77bcafe7035eb86c1d8cfcbdcd71206b088bf70a2a5116daf0921958677c0f1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 2258722ae10b54603979d66e128834ce
SHA1 6dc61aa393edba4066bdeb0389a66521be915cbe
SHA256 c8aa68696278d95a067f5dfa2c164dace6c277a58aeffde17282817032055584
SHA512 2e1ed944087724a88c31e0afed65118f578de313abc96f43f513f4e60361371c98f4d2981d88e99045e9978168c9715f33e4ee6e123d8a8707d36303f9949e76

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c6a5a01e725f3059d198c9a683b55cc2
SHA1 96f9f0c1fec13e50b22a732357dad32d65450f7a
SHA256 e9716cca6868c66e6f77f89c5665c1112913bc9e256b9ef82fe8adadb2f91eaf
SHA512 1526ff8cc34ab05524b4031d90b5ebb35dcc910ede38760d782ff741c4d235943df3e5658c9c20cac696f4c6756d53efa4dcf827491ba40810a8f452b7ddac96

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 d1d49d362ecc769681a6c35d9188289d
SHA1 33d801fbeefce80468542ea3c0147a52b09b2368
SHA256 8cc1ec73659ae546c5cf4b98c245532d70d285d4c7ed9ca7da438561c74eb95b
SHA512 513d743605c5f2e51ce28b55a16bf93c2745fef166f83008615e087802c6bff7ad9a07dae8995d1be9657b8cd95cf0c416ac8a591367c4bf5f002336edbb92bb