Malware Analysis Report

2024-12-06 03:27

Sample ID 241028-rwsr7ayqhn
Target 7a10e7da6760aaf1c716b8826a1508e9_JaffaCakes118
SHA256 badc56883ed11e4fa76db23f9b41e7c9191796a6e2667ecb6ad987c39ca06164
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

badc56883ed11e4fa76db23f9b41e7c9191796a6e2667ecb6ad987c39ca06164

Threat Level: Known bad

The file 7a10e7da6760aaf1c716b8826a1508e9_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

Socgholish family

SocGholish

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-28 14:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-28 14:32

Reported

2024-10-28 14:35

Platform

win7-20240903-en

Max time kernel

133s

Max time network

143s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a10e7da6760aaf1c716b8826a1508e9_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000d82996a5c3e688b599abde62f88bcabcd91098d938a88aed39280cfdc25de23d000000000e8000000002000020000000060084e210ba25dc0ad03c0fff86834283064c462c02ee2df1d8c768a9a2b8bd90000000ec2fbe4ad0c584a2693451b99a2dc9711d95c507e10af2be11e0e620c71202ab0de1e775427f6496a787d685fa3b87cdb187abf746bf5fcc3d232480e5acdd3ca7fd634ce73952f16522064ebe16d83334ab906cc7631d15f3d9911c9e51b99fc306f4a991599e0e5b993a7ac6ed5d32c4ecde52e6c4117f770058b4997212ac5fbb9134f75d3a92089e19ff397f1b7a40000000a0d724cac1465d74e7614ab3a5144b49e7c3f6c2f45b86c3524cb61e5e1878b51cdb4f79cdaeb6aafe99be299cf4a5bce9f6226842abd18a5aab9ae06b010f16 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436287845" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c3a6614629db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "10776" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "10776" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "10776" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87143E21-9539-11EF-BC71-EAF933E40231} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000004b29992bbc64bd489bc864e56b88ff4c7dda39eb9ae76661e69e8290561bd3d4000000000e800000000200002000000073e1167ab45146337244014925c6e58872fb590ba4db448b607cc32b6855571d20000000ccd291f03485ca7e221f865418ace651ea34083207ba1e0c98ae43998505108b400000000af88fc7e991a316352d5a8315ef815700714ce38f9a7a50aa03082d1e51e8099cba3e73972f5d3f90900a98575aa06e47ab2637831713c0fbe5857bcadb7ab2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a10e7da6760aaf1c716b8826a1508e9_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 cms.lichngaytot.com udp
US 8.8.8.8:53 lichngaytot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 172.217.169.42:80 fonts.googleapis.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
GB 142.250.200.46:80 apis.google.com tcp
GB 172.217.169.42:80 fonts.googleapis.com tcp
GB 142.250.200.46:80 apis.google.com tcp
GB 142.250.200.46:443 apis.google.com tcp
US 8.8.8.8:53 s7.addthis.com udp
US 8.8.8.8:53 www.baokim.vn udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 internetsupervision.com udp
GB 142.250.178.9:443 img2.blogblog.com tcp
US 8.8.8.8:53 www.xemngay.com udp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 216.58.204.74:443 ajax.googleapis.com tcp
GB 216.58.204.74:443 ajax.googleapis.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 104.18.25.243:443 lichngaytot.com tcp
US 104.18.25.243:443 lichngaytot.com tcp
US 104.18.25.243:443 lichngaytot.com tcp
US 104.18.25.243:443 lichngaytot.com tcp
US 104.18.25.243:443 lichngaytot.com tcp
US 104.18.25.243:443 lichngaytot.com tcp
VN 42.112.31.40:80 www.baokim.vn tcp
VN 42.112.31.40:80 www.baokim.vn tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 184.26.134.46:80 s7.addthis.com tcp
GB 184.26.134.46:80 s7.addthis.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 104.18.24.243:443 lichngaytot.com tcp
US 104.18.24.243:443 lichngaytot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
VN 103.131.74.28:80 www.xemngay.com tcp
VN 103.131.74.28:80 www.xemngay.com tcp
US 12.171.94.43:80 internetsupervision.com tcp
US 12.171.94.43:80 internetsupervision.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.195:80 c.pki.goog tcp
GB 142.250.187.195:80 c.pki.goog tcp
US 104.18.25.243:443 lichngaytot.com tcp
US 104.18.25.243:443 lichngaytot.com tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 xemngay.com udp
VN 42.112.31.40:443 www.baokim.vn tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
VN 103.131.74.28:443 xemngay.com tcp
VN 103.131.74.28:443 xemngay.com tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
GB 142.250.200.1:443 lh4.googleusercontent.com tcp
GB 142.250.200.1:443 lh4.googleusercontent.com tcp
GB 142.250.200.1:443 lh4.googleusercontent.com tcp
GB 142.250.200.1:443 lh4.googleusercontent.com tcp
GB 142.250.200.1:443 lh4.googleusercontent.com tcp
US 8.8.8.8:53 static.mytour.vn udp
US 8.8.8.8:53 www.phongthuyviet.com.vn udp
US 12.171.94.43:80 internetsupervision.com tcp
US 12.171.94.43:80 internetsupervision.com tcp
VN 42.112.31.40:443 www.baokim.vn tcp
US 8.8.8.8:53 widgets.amung.us udp
US 104.22.75.171:80 widgets.amung.us tcp
US 104.22.75.171:80 widgets.amung.us tcp
US 8.8.8.8:53 platform.stumbleupon.com udp
US 18.208.90.128:443 platform.stumbleupon.com tcp
US 18.208.90.128:443 platform.stumbleupon.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 embed.tawk.to udp
US 104.22.44.142:443 embed.tawk.to tcp
US 104.22.44.142:443 embed.tawk.to tcp
GB 142.250.200.46:443 www.youtube.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
GB 142.250.200.34:443 googleads.g.doubleclick.net tcp
GB 142.250.200.34:443 googleads.g.doubleclick.net tcp
GB 216.58.212.230:443 static.doubleclick.net tcp
GB 216.58.212.230:443 static.doubleclick.net tcp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 142.250.187.234:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
NL 18.238.246.206:80 ocsp.r2m02.amazontrust.com tcp
NL 18.238.246.206:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 104.22.44.142:443 embed.tawk.to tcp
US 104.22.44.142:443 embed.tawk.to tcp
US 104.22.44.142:443 embed.tawk.to tcp
US 104.22.44.142:443 embed.tawk.to tcp
GB 142.250.200.1:443 lh6.googleusercontent.com tcp
GB 142.250.200.1:443 lh6.googleusercontent.com tcp
GB 142.250.200.1:443 lh6.googleusercontent.com tcp
GB 142.250.200.1:443 lh6.googleusercontent.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
GB 142.250.200.34:443 googleads.g.doubleclick.net tcp
GB 142.250.200.34:443 googleads.g.doubleclick.net tcp
NL 173.194.69.84:443 accounts.google.com tcp
NL 173.194.69.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 4aeac92a1c1100ff979eb2f93ce27c1a
SHA1 bb4234b5ada97d3e5a6f3b59c0b0dd7eba0fbd46
SHA256 17974ffcc86245f2c49e2c950dd44ea15fdc39cb29d1bb85826bd41d49c6305a
SHA512 aa427fba910e67b520a924d6af91ce287ffb7fd95e59343e910795e943c135a981c6cb6f603ef80fedb3b4932f6101f21eb2b4e1b685a5278f1453a8306b6133

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 065a50aade872e6b827896c10dd8ce52
SHA1 d34ad772d7cb940f5ac06544e808626cde20fd84
SHA256 66919e0710d9c2e1369b4a193afc8cd5a22760f1f9830c32a520ff502ee529cb
SHA512 e12922ada4470002873ecc8df773cafdd80a3e8bf8c9dc0d76e16e041c56b19176922102ede1f1c67b1168ef6ee4c588dd01046c1510d1a2815dea620b6c31d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 67e486b2f148a3fca863728242b6273e
SHA1 452a84c183d7ea5b7c015b597e94af8eef66d44a
SHA256 facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
SHA512 d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 20d86c3de24d8844583d572d973b2129
SHA1 74818939ba8fd24979d99d3eb0474675d563344f
SHA256 7e4c547cb1e21c0bbb33a889fb54e657625874f5fe7b5d5fb9b8238ab12e78b2
SHA512 13a7df6afa0a5f3ea8b17e650fbea3c6589df444bf8a942af8398e762e1ef360dcc72eeedbc8f148763602e33553a30022eafc366f409b155204c064be49e52d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 a3eb203d83209c0079b7fe590e263858
SHA1 4cb9ddd434ec46f151177ede7ce8966edfce8968
SHA256 64428a4cb361282be7239aed56a8d35820ae4dea99bbc8d7c05835d99a1e3d94
SHA512 44dd715bef50ff8dd243a83af51ef5463634ec38fd3a3b333fa502e761488e06bcf2fa98c3161d51d701ece6912d1234c190bd00ce011cdfc019960fd112748a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 f0e99afe0e7a522187db107557e5d136
SHA1 675e84490e5e8daa4eca7434f4f1e8f3a78ae6cb
SHA256 9d9a860e345a3f44dec75b9474b5fc75db798c4c7809cd5a62178d57de9dca0e
SHA512 300dccd689c421e2c09b1bc78ddf584a48790a5effd4c1718653ef8ea8e7b2a3170e42ff32ff32e2ab05fdd4c71c88e47ecba5fe6688e5f6a413f581cf3568f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_1D349A035F531E40CCCF658F74AE70F3

MD5 c79cc17dc3659f80a1efa85ea0fe08ed
SHA1 b61258c807eaff2d426dec4d35cfa40f9e9d09aa
SHA256 16b3801e79f7b5a7046b6f83e9d6a8599b3ce26a89ea71938380bb1cd668090a
SHA512 1e48441fadbe44a3c7c2f4dd905774eecf268d8a799942eaf3794cd9350163d8400a0bb925c74113798e2c2b8854bfd960f7cc80ab8b0973c66dd798a183d3da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B5CFE5FD779BB3279A8A1976B86E6FEF

MD5 4c0387032029237195370ec716b458e3
SHA1 5b5475b518a6781dd0cd13570f6438e00fcf5134
SHA256 49967736b6064f924c4a15e4959a3a4b917ab996d329c2af63664e370f05aab8
SHA512 1ffdd8409ce25e4ad5d5f58b5362aae78cbba38a34d5f29bb271d6e760fcf00bbaf2a066208063581526eb92d62af4d6f208526c19bc0a616b2562c7dd931cc6

C:\Users\Admin\AppData\Local\Temp\Tar99C5.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\Cab99C2.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOGPI1N2\plusone[1].js

MD5 1106da066ce809fb5afe9c6c1b4185b2
SHA1 3b64d3a7f52b4c07047fa8727db4207137733bf8
SHA256 d0f3af1e716ce7846e7c252ace160c12480d41eecd5a7e7917ee5b2ccde62b51
SHA512 3f0205b89d5293f14d863e344680a9d8518e5d4ee3b981dc5981106534bd597ed6b388eecab1385320f77c8d5a46a4ce5b64f03f4377b8ea13ecf9b569878fd9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59e7f1799a170a943d9b88fde9ace5b7
SHA1 d8d19077a161773e901c3492074c5350ff07ec33
SHA256 c61792b400f3e264dc1cea51b04a8716cd4e1cff8f058cfa0ce22728acb35dbb
SHA512 2fd9013d9b44d9847107518209ddf9c7f2e33f3e149ebb3e34762cd0f01833043a64a8e4c78f966f8b8b61188f2fc99200b66890d711f8948985fcee0dfece3f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 05560deb22a3d42f7121167aa585dcda
SHA1 a6014cb01bd5b78b7f2888a2a25bed0e56b9499f
SHA256 bf147b909e1655694f87f70212100ca1d9a7f7433614da10518d992e06dc4c7b
SHA512 6fee519382f99750af6eac9dc5933f03d41b188202afa5ae64c55e2591b840b7203e2d77e905f03b1faa780547f3633b76e6b930efdeca1f4ef0525ca2e0fe2f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2D1IIYME\www.youtube[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 06eb653fde1a7cee26464d1b97a70493
SHA1 a2d9f5776c8c3d221a2644a2f06542a43f235e1c
SHA256 78a328eb46d702f38d4ffcc11b874c66561b9f0e96ad3d6c6b5816982c4b8290
SHA512 1fdc94cd052d5a856d4f9eb1bfccae136b5a72eb95a6d06e72b5cdddef746e74e840c74af285ecdc2f0261f179b6d6821ea655c1c643108354513dda476162a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b67642de04eb6f40cca39f6941245dbe
SHA1 bbcf54f8cb7faeb0ab32ad3a82445bf9e75a5ff4
SHA256 7d05bb6b0b0a8243c812f09f9a9b07fc73b370c03bb5841316d1e62253bb3c94
SHA512 30d133889e21954905b90c3f7ecbe4d86a1134090ece0e61e23a07be3b672e80790af5978e484b0736fb95d4b27cd9c343f203d9734e1a46c3cdb5b0653a4317

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2D1IIYME\www.youtube[1].xml

MD5 c74d771e8a2b3000c31c3921d382699e
SHA1 9e18c365b3c81b7f1f4475f32a20b6be52bfe4d7
SHA256 64bd9457ac2247079fecf303322a7b5eca3220a172e98dac1821fcfb8488d252
SHA512 e18b718114a7e51be421e2c5dd1036d1f9b5a225e9bfc728230c2cda0d22fa938c14d5f4da8625e0b4282fdc9df71a4b1b9504f446a8050ccc6d18440d223e21

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOGPI1N2\cb=gapi[1].js

MD5 1d4cb29476060a1b3681fdb681200b11
SHA1 d541f88bf8d4fd98b9e0e723e050c47d4d32c18a
SHA256 5930e64b0cbf1dc5922f65060422fcf822870ac69439450ee3cb134365a51a82
SHA512 85575c3656c8e0d70cbcdf76194e37dbe3f7bd4535221a8f51fb6b51266fd682809fa86bc556c27d127f713a6ff75290ae1fbdcd8e589211e1685f82b99d93cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8fa8b99313673114776e1c5e01fab22a
SHA1 014b3f19531e7733cf45fd11e7802194b8185c90
SHA256 c8b9ae0a2f2cae49d1735a59609cfcb297a1341d3396218b49df713e5d69bb53
SHA512 585e376d569a6ab1f4c2e1552c94a003ce9461ca120174dcb8efea73ad68fa61a53c7142e3b3402cefa9cdf38f99d7081e37b008d68457ac40a066675228bdc0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e898b433df34efb2296735692e47383
SHA1 89c834113b4ee6856472c001474e95cb7a0322bd
SHA256 1827112fb6ba8683d2b60da4434b0209a300a41f91072e2d9adb7198c54818f7
SHA512 873c518dd256d043ff3c2444320335bca4438ffb458b4c6ec1d0858344c12c98fc08dbcd115b05a73355f09dda6844ddbf8ff06b5616cb10040d12f171c67bee

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2D1IIYME\www.youtube[1].xml

MD5 2a9807b9f676c07481f3cdd2b400a763
SHA1 002f0fdadaf97a711e1af1352646a984dd66c958
SHA256 3718e89e385450f923c9c2f8ed3b123e0842c72206112903bbddb996d1a5c3a4
SHA512 6efc1fff380b245f58093a51d904378573649b33c6cfb95563be8c4d78dec47e7dc57506f047d78fdbe35a36c3b564cdc889075562c86cbb2dcdf6d5fea17988

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2D1IIYME\www.youtube[1].xml

MD5 199e0d791990102954e2a363753caa59
SHA1 0606170765c2a89542bc17ecedf26e0cc86c717a
SHA256 ee7f325c31d32772481d3d2022b304dbb90196a21ff7db919f795f6143c5840c
SHA512 bd2a0000e0e2f7693f2b68033b2db35a9e142a980f5fab80552ef6c0357c8292ba9b4f608c8c85fab7a987ff16fa0a0ceff6cff1d44c2f9088e9bde3b7ccdd1a

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2D1IIYME\www.youtube[1].xml

MD5 59d527121c3c20728ae604993ecdbf58
SHA1 c701fc2ad5cdc3eb3d9ac8ec863682690e08cd4e
SHA256 8687dc896d397e89689d522fc8ce02d411db0db49e0a4ceb9d1a8ea2c89b0ba4
SHA512 af6cd960562631d607a08b2e5f82bde9fb6909c0d16fff721686ee35d65f21a703863bd8a33ca35e218f679c126c440e3465f6771139a39b94f8af46bce16c55

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2D1IIYME\www.youtube[1].xml

MD5 1983a744ad36f08a9b162b890b856eec
SHA1 9fe428b6bc90026219247d6d3b0c784821dfa154
SHA256 32c003db43ad974388ec93b5a7b7e4d1bd08d25e629410f0338cc86f066c26de
SHA512 c15bc4877f8fe4933b6f5bca50fd0fdee6906db59d18f51716a29e18d44820ce94de09a23dfcdbd9997e4aefd6a11336b17fd9db56414e7617bdb095164a5068

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2D1IIYME\www.youtube[1].xml

MD5 fafb0a610ac6369e5a98a91ea530ed6b
SHA1 96bff72e2e3259c4de995bb67eafbdabea38919c
SHA256 363d24eb7a005f308fcd8016e9925b8b93d0f02584380fc22ceb510c4bc3c5da
SHA512 559ece3d93500d76544844df21b9d229619d9657f11b2bef9d99b247448ffac66340facbd0c3d59b5913fdbcf8f21f9d26b421d478e3f4a8fd4b1f6117d0ed7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e97e3041000aff114b7fd250928b101
SHA1 fb115508259ee979f891e8bf2b55ae01313a3b0c
SHA256 9b74a4cfa12fc489ca4f7cf54528c153b7f4bfe6d1b838bfbdab0e3c911e9809
SHA512 ec847ac2d2303e65a38e28e0b05781355cff169193c1e5e17b1c407ced646ef87ee221316e764468938ed8100eba305070a947ed6685c9c80620aa67353614ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ea99114ed05a6793b06a946a0154007
SHA1 a2288e50eb9aa341bda2868d65af119a2369beb2
SHA256 c09e8429beb4c3cdc82c3d9ce1767e7e4696074567c545c31fb6b5f6218a18f0
SHA512 45a6cb1fa7f2ede6c58ca5ded6f2cf00b2dd62a5763c1ae4cfe9749119269c7e69ab49401bb843abda22cb6155e8b4e916092f64e11a4fe60280ac2a3250da0d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b24590970bbb6d1798cda9915546cc8
SHA1 508d7dea676214375740acd2445ad0611b3c96be
SHA256 21c1293acacf93e1a0135f528eaf14b4060d2e8b293b288a3a0df7f7f580ae06
SHA512 6a4a9e3ff91f7ad4656251a726ad7cfd3e147fc090f90aacd04e39d4de195ce2bb2d8877be9670796623cbb9ad5100ca9c70b775d8ce7fbc12c9f5ad5d794854

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59a46ed7b941e24003d9c80d1532912f
SHA1 b15b92ff63caebc548ec25c4f5c12298060f0bf9
SHA256 98c0dcac519ada444387c7694ce1077c0599935cc7650ca4318a299ae4e2572c
SHA512 ae2ee28eca7d5c7267cc7e78aa2e68821faaf1601fb33795781a0da02e23cf712acd00937ea5222c125d977aeba2ae2009c29545bf895bba3462057ef200feef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cfef0121715f41e7b44800b8a4c5ffa3
SHA1 0e54048a25089e02afbc07383356faebd9a19915
SHA256 b2ac7e9163653f41f9f5133ec086f008d429f62cfe5d28777b45599b9e2b04f4
SHA512 c92ec5c20c82c3053fd346452d21e914b3f24db84019163ed22b5f711e285779c02a182cb33e73c0393111cf092c7c0bacf744138a1385929caef5143a8169f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a2075c456720a181ad36667bca3453e
SHA1 4efee5a7edf6030a6efa9f880f59fa867ab440b3
SHA256 1c30745e4ac164557a8f84267bc1fb536a76ecbb41748c2d721bd9ea2fa3504e
SHA512 25a0d88a3e98831700f4af4f65f28cdd9c1736ec1970684431ee0c8121eda9624e95b2c62073c59ce995426730c76747a2bb12033b3fb7d140590056b920fd82

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d132cee6a13fdcb959c00a9a0eedb08c
SHA1 d42dd452a2a6d833ac8cc911ae06928d2ec6026f
SHA256 80299b95befec2e2bde8da565275217e1230a5d42443bec6a9b5b20b141fa760
SHA512 180cef70f2a4b6af701d9d5d4246e093dc80f2d96cd20eef7cfa76fc8bf08106bf9053ee4fdf93ab9fdc40a3321eb81b95ee0a26e4e4e1916ba0c99f2802393c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1d2a4bc18df5218d12fc5053edbb3094
SHA1 9126ec2548ec861a4c36167313df0d1934948dc9
SHA256 b517c868f1130fb3b4dca40f5224b99fa05cbb6d1cef1670e03c0870fd317cce
SHA512 7a818a02c59745e3afb6566ac34fe868810c6a89e7fd7ac5cd13049c1a50b00f798deadcf0f4a287a9d0310c95fa7c8eb8b6c4f1a37e2ad8e55bb05c90142d5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 89496d32e6dd2f5a783f860f315b729a
SHA1 e6a7f745eced17da1590c04b146ab5e61e9dd155
SHA256 93967ecaa7589d6123e4192cdb686e6f9895fa9a21896a61b5f88201f4b63794
SHA512 73a9d2fa4a4d59da37a7181c2c6a91bb5f010ea420b4a2ac7fc27b0eb26b5de57653fa9a47b4aa363b408be145d1857b72b016e72ab8a3378cd583fa3a6c0b50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c5cf524a610220f21f2151c5fc810ed
SHA1 5bc6ee150fd08c588e375b9951541141bca8bcfa
SHA256 21b042f95d2f208a6a8b550049ca9b80b5097fd4d4c69453187d0d7490f938ff
SHA512 2771da66daf903c94c8190a2a134a3d0b873713bd2f3514e086a3b1e06441d47d4d30f5c87fe8806a49631ca60fed8623cc8d1141def1c137bf28fd333c7656f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2D1IIYME\www.youtube[1].xml

MD5 a117f53fb7ca5ee37ca517a773a51925
SHA1 c24b518ce4345eb94aa24d846fe103e2df29320b
SHA256 63fc505241c131267d96f7ab62a3c04deb13fe18d4427f62e56ea7953a3adcfd
SHA512 ea7049f90f72d103aba99e93b90bda5815e350951f4f34bc6dcf6835396e6475ae42ea1571a33bfaf05155f8b49019e481a0450cdf54f8a92ab3973bb6712510

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1357768ed8938b8eb7a4f7eaf36f70b4
SHA1 fe1e33c56c22bde574a1f4b109d3fbf311571e7c
SHA256 1ba581a13db48c15cdb490c09e8e2d975182c4e5c5ac3951b340984eb90a7fd6
SHA512 f70029c4bfdf4746897e626da3e35d7ec35277a7c05a952b29149cf9e8c21b27d82b72056b962e2840d577b271ddf249dc8dce0bdde3949e79776f3f59218b21

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 432ed47a8a78d6bca2b55fbe5e39a378
SHA1 741ee5c70f399416382cb265dba4c170a6cd3104
SHA256 8cecb940f1fb883d5a0830462c32dd7f7854b2c49182ff8dc5a4afe54e18dea7
SHA512 719f3c590ba03cadc15ed3c320d2f123eac8574162fc60ff558c88560246ce163178b8c2fc990716c7c82326bcfbb7e32c62e9c493b26acaa03713ffe1e3d47e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 ce1f5aa579eea36a2941389a9cf011cf
SHA1 321f1761362a9864505dc1cc89a185ab376543cc
SHA256 b1b52f69f8da1b9f07d08189235493561a6700d4e7ad19aebfcee453a2ca62d1
SHA512 5425eabb1ccc354005a0dbb75277849b76f08bd01370914209417c284e7c9cfad83718432502554c3b1b51a4b628a4a6d86b60db3c07807b03a380ed8736c79c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75adf61864f6ef8e100e526020a8fff0
SHA1 2a003d66595cc50018637878baddbc7e0cc735b8
SHA256 c6cb74b75bca8dbb5126b5bcfc56b640b9b95eed1a14da93571e27fbb3f5adec
SHA512 48a1dfc47a8b024ef97fd0f6b7e90d66e484e161af7315e2fad257863a4f042c7b85c0779b802da456b9b1746d6464d2857bbd7fc59ee32b0ae91d8d9bbd5c31

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e2de8fe8ee75d3d7acb523d4e16cd34
SHA1 6bcc12250f37b6578e73beb3608f2fd511fbe7cd
SHA256 cf3ee1eb4bd9c86386aa6263a5545492693ab4852552a646b99807ccdef78495
SHA512 4319580b8a263299b1715c237e972934e91ade0598e749f451afcf02f77911438f6a5656bcedefaae5db8b6c783cbfeb8cec937acf074bbf67d787d668bd499c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81597a3d59945a44bf6f0b4e16f75ce9
SHA1 e8395949922c45979082978625a0b1f70dcf2fe3
SHA256 ff2f976f25d679781b0e986c0fb9c32ef0cc49644f166f2eb5094f2aadbb659f
SHA512 31395c5bd81e0d786a40d94bda9b654ecaede585543236cc53a1bb27f6f8911683b1adb73c8232d8a94fe91ac9818c7a7f80d7d33e8eeccb1f919ef2580a97be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a922546e032c8b2c2fc2025463af99f
SHA1 923cd08ac0727b93f6fd12423f4ab98b27cf2f91
SHA256 ed2c26a79bc4bdc7acd85c5280e54776351c28cf6e8ead16b58d99405bda08b8
SHA512 97e87c1b8defc196a2edd9886fdc80b19d1be338b5a42162ff149f779bf8e4b2eadb6c2e77ae3361092bf5e951b68f362c75d967274236fb7de6b4139479ff92

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c53848b8f559fbef10602b784cfdf32c
SHA1 ed745ec925f0e4093d88092a816b70d1d505b222
SHA256 fd1df33ec9a2292e6e3fc089eb98170c31f3f856428bb4a379e7cf2f35cc1239
SHA512 a4946e5f98517e94b40e8f3397c2b06629871bfca01d9d9815dcaa91a2e6be86f6408d5d02de5efa413162bbf9fe7cff766cd0623806e6e9bde57b4f4c3730d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 50b8742de0a49f64d6f2c6e038e6aae7
SHA1 d9e9a08219a6d3099368dd0afe04bc97a225def1
SHA256 89cc0ce0e9211116ad9b9e9a235cb34778dc1ab67d7b8a5cf1b255e6f8d2db89
SHA512 ada561aee6243ac0a31f0fc1993677ed4cdad41ceed2b567f45069a7dc7fc4b01b568b71952a628b320f673a41fafbf0186efa95aa1672737e5b0b6d09584445

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 068d34a0539ae3f72bbd73de6888ab6e
SHA1 3470ed91e5be4f92dc0c5f3f7aa320d46fc5a3f8
SHA256 155bcec033be0714702930e61a555789c356a561829bf358ac2487c438477c66
SHA512 4d4bea607bd54d082ae375cad655c7a3d6d60c7d8d8e7f7efc4fd092103b2144b17f4abf00aac05fc6fbe6fe40548cfbcc065b3f7cdf676a28f4183507cf0371

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 166d5e7a5a514c979317b4d251c968b9
SHA1 13acf9a1b5cd37b8bc18aab6b21ecc8af4756c6e
SHA256 536581e3940d9ba534937723ba20fdad77f37feb7ec9592c93d919ac53bbb856
SHA512 a9aff992418d57461ff59e8a472376de2e4aecee853f88ce7fbdd950254295947e4cf33b474d5b6dde9533ce27fb85861da4f7a4318eaf787f5e2630c2a009f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5de9253c74e1dc6f4bc2447a31a74d39
SHA1 4b0151d43081aa0a3d261c815d3bf132d7e3d53b
SHA256 19d0fde93bad5ff708dce5623ef0ac70b544c5dec06cd2c9b5eac6655cafa28c
SHA512 7d8be1c99c368fc2a68fd87709d92aab4cada6fee5133500f8b717c1feed50dca167c8d7c38c690601731d04968e04be71f2c4527e1f3f262bd67729c57526b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc7cb07a92a23422af1a914d6f343564
SHA1 e932ec6a76bd928123401ed81c50bc45a6689e60
SHA256 9f9f48fb3d2afdb2f008d3ddcbd0556fd0ed19fda71bca52099911f706638801
SHA512 e24f4c047b6c3e66816e5e0abda85ffaecc5cbe31f1f810f36bddfe6a05d11ae5e842617295a5d021e49f4e9c9e45529e27d3c428cd579fe0ffe6deb1c3442b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cad34fb14b313e8a40a956dc88b83817
SHA1 ea10297eb9bbf1331c8d0c3b1fbadc8867d86a09
SHA256 a59f45b4add5eb16ad2ada4622a05f0f5ebb8c60323bc16eaa2787df06acca30
SHA512 1b73cce05c20a191303356d895c0909102db9f5401078b1add7b489977c50fdbdc1f4e3f978e8ea68a7dca514f215d852ffc19929b25ed9b9469560b55b46d45

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c3383b926a9e681e8afa63e96627e91
SHA1 89c5220a8a43bf098b6ca6b76fbb5cc1d50bf4c3
SHA256 ea4529ea99db5e71dfc6dae84a5d59fdb67f876d7bf81b8261f0b75bec8ac9a3
SHA512 c00281e1e088d564527c949cfe1ebc3df8705b4ef89684dd1587f435b2f29eb69b2339e2b334814fe40e40eba8dae5e86020928c05937bcc15a2b43d27db2fbe

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EB0KZ1Y4\2254111616-postmessagerelay[1].js

MD5 c264799bac4a96a4cd63eb09f0476a74
SHA1 d8a1077bf625dac9611a37bfb4e6c0cd07978f4c
SHA256 17dce4003e6a3d958bb8307bffa9c195694881f549943a7bdb2769b082f9326d
SHA512 6acd83dfd3db93f1f999d524b8828b64c8c0731567c3c0b8a77c6ddcf03d0e74ee20d23171e6ceac0c9f099dce03f8e5d68e78c374da2c055973f6ac2db4e4f9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOGPI1N2\rpc_shindig_random[1].js

MD5 70116351ebc507731f11cfb8653f69bf
SHA1 667d48cd3c244c41a84302056e5b14140045acd3
SHA256 e3fff060584ca9c8eb12a6925252c8c6333622f4e6aeae8417449bf0ae355020
SHA512 a69875a52b635e7a561cfe2c7f4639bc122be434989dd39b37ab8dda08b49aa4bfd681c572628e9dc056c69808d0a03e2c6b4fef88db20a59ca73f097870aee9

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-28 14:32

Reported

2024-10-28 14:35

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

145s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7a10e7da6760aaf1c716b8826a1508e9_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3712 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4036 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 4728 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7a10e7da6760aaf1c716b8826a1508e9_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb773746f8,0x7ffb77374708,0x7ffb77374718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6762998902635261462,12001724287328449483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 172.217.169.42:80 fonts.googleapis.com tcp
GB 172.217.169.42:80 fonts.googleapis.com tcp
GB 142.250.200.46:80 apis.google.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.200.10:443 ajax.googleapis.com tcp
GB 172.217.16.226:445 pagead2.googlesyndication.com tcp
GB 142.250.200.46:443 apis.google.com tcp
GB 172.217.169.42:80 fonts.googleapis.com tcp
US 8.8.8.8:53 feedjit.com udp
GB 142.250.178.9:443 www.blogger.com udp
GB 172.217.169.42:80 fonts.googleapis.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 s7.addthis.com udp
US 8.8.8.8:53 www.xemngay.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 cms.lichngaytot.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 static.mytour.vn udp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 184.26.134.46:80 s7.addthis.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.200.1:443 lh5.googleusercontent.com tcp
GB 142.250.200.1:443 lh5.googleusercontent.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
GB 142.250.200.1:443 lh5.googleusercontent.com tcp
GB 142.250.200.1:443 lh5.googleusercontent.com tcp
GB 142.250.200.1:443 lh5.googleusercontent.com tcp
VN 103.131.74.28:80 www.xemngay.com tcp
US 104.18.25.243:443 cms.lichngaytot.com tcp
US 104.18.25.243:443 cms.lichngaytot.com tcp
US 104.18.25.243:443 cms.lichngaytot.com tcp
US 104.18.25.243:443 cms.lichngaytot.com tcp
US 104.18.25.243:443 cms.lichngaytot.com tcp
US 8.8.8.8:53 www.phongthuyviet.com.vn udp
US 104.18.25.243:443 cms.lichngaytot.com tcp
US 8.8.8.8:53 lichngaytot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
VN 103.131.74.28:80 www.xemngay.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 42.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 46.134.26.184.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 1.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 243.25.18.104.in-addr.arpa udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 xemngay.com udp
GB 142.250.200.46:443 apis.google.com udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 internetsupervision.com udp
VN 103.131.74.28:443 xemngay.com tcp
US 12.171.94.43:80 internetsupervision.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 www.baokim.vn udp
US 8.8.8.8:53 widgets.amung.us udp
GB 142.250.200.34:139 pagead2.googlesyndication.com tcp
VN 103.131.74.28:443 xemngay.com tcp
US 104.22.74.171:80 widgets.amung.us tcp
US 12.171.94.43:80 internetsupervision.com tcp
US 8.8.8.8:53 t.dtscout.com udp
US 141.101.120.10:443 t.dtscout.com tcp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 28.74.131.103.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.120.101.141.in-addr.arpa udp
US 8.8.8.8:53 171.74.22.104.in-addr.arpa udp
VN 42.112.31.40:80 www.baokim.vn tcp
VN 42.112.31.40:80 www.baokim.vn tcp
US 8.8.8.8:53 40.31.112.42.in-addr.arpa udp
VN 42.112.31.40:443 www.baokim.vn tcp
VN 42.112.31.40:443 www.baokim.vn tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 133.130.101.151.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.200.1:445 lh3.googleusercontent.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 platform.stumbleupon.com udp
US 8.8.8.8:53 developers.google.com udp
US 52.20.104.98:443 platform.stumbleupon.com tcp
GB 216.58.212.238:80 developers.google.com tcp
GB 216.58.212.238:443 developers.google.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.200.1:139 lh3.googleusercontent.com tcp
US 8.8.8.8:53 238.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 98.104.20.52.in-addr.arpa udp
US 8.8.8.8:53 83.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.151.21:445 connect.facebook.net tcp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.151.21:139 connect.facebook.net tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.169.36:445 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 platform.twitter.com udp
GB 151.101.188.157:445 platform.twitter.com tcp
US 8.8.8.8:53 platform.twitter.com udp
GB 146.75.72.157:139 platform.twitter.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 embed.tawk.to udp
GB 142.250.200.46:443 apis.google.com udp
US 8.8.8.8:53 whos.amung.us udp
US 104.22.44.142:443 embed.tawk.to tcp
GB 216.58.212.238:443 www.youtube.com udp
US 8.8.8.8:53 accounts.google.com udp
US 172.67.8.141:445 whos.amung.us tcp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 104.22.44.142:443 embed.tawk.to tcp
GB 142.250.200.22:443 i.ytimg.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 216.58.213.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.200.34:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 84.69.194.173.in-addr.arpa udp
US 8.8.8.8:53 142.44.22.104.in-addr.arpa udp
US 8.8.8.8:53 22.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
GB 142.250.200.34:443 googleads.g.doubleclick.net udp
GB 216.58.212.230:443 static.doubleclick.net tcp
GB 216.58.213.10:443 jnn-pa.googleapis.com tcp
GB 216.58.213.10:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.179.238:443 play.google.com udp
US 8.8.8.8:53 230.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 104.22.74.171:445 whos.amung.us tcp
US 104.22.75.171:445 whos.amung.us tcp
US 8.8.8.8:53 whos.amung.us udp
GB 142.250.200.1:443 lh3.googleusercontent.com udp
GB 142.250.200.1:443 lh3.googleusercontent.com udp
GB 142.250.200.1:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 www.phongthuyviet.com.vn udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
GB 142.250.200.1:443 lh6.googleusercontent.com udp
US 8.8.8.8:53 va.tawk.to udp
US 104.22.44.142:443 va.tawk.to tcp
US 172.67.15.14:443 va.tawk.to tcp
US 8.8.8.8:53 vsa68.tawk.to udp
US 172.67.15.14:443 vsa68.tawk.to tcp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.129.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 14.15.67.172.in-addr.arpa udp
US 8.8.8.8:53 229.129.101.151.in-addr.arpa udp
US 8.8.8.8:53 vsa1.tawk.to udp
US 104.22.44.142:443 vsa1.tawk.to tcp
US 8.8.8.8:53 vsa24.tawk.to udp
US 172.67.15.14:443 vsa24.tawk.to tcp
US 8.8.8.8:53 vsa97.tawk.to udp
US 172.67.15.14:443 vsa97.tawk.to tcp
US 8.8.8.8:53 vsa15.tawk.to udp
US 104.22.44.142:443 vsa15.tawk.to tcp
GB 142.250.179.238:443 play.google.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

\??\pipe\LOCAL\crashpad_3712_DVTHGHJFOUEFMBPE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0489146f81662aca180ece91606d78a7
SHA1 9506463eda3f5da5f1bc1e347ed60a1c25fed618
SHA256 a35b6c7b79367d155caf274267b3a685211d3fe49be7d2a042b77402504a3c67
SHA512 8ee2decb510caac06a16d7ce3a1fdc452deba787b102d8c18bc428dd796205ae026fcd56edd3f9a9c9edab19d763004e1c7b5138c28abae34129c707c9a71c85

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

MD5 318ffbb8b70b421abc02996dcfe8afc3
SHA1 4240e64a8604fa36481bf24471545a2c7c10c89c
SHA256 fba866aea3cb0fce98cf10cb57975933d6cfaaed27f9f25250008814c9bf8e95
SHA512 1a0f6266836348c4ee0fbfdfdc9197b66add2a5b150ea8a1205b4e3876eb5c82d7404bd26791de29ff48004dfed187d9bab5a9678dfe1c71cf513dd49abacc56

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c6a489510c0a81d2ee38a160e4694332
SHA1 edf80d243e657e8d41c97d8103dd529f8068076f
SHA256 21ce1b1f112b6f92abef77d6cdd44e4654cfa9bfc23112f3ae904a4eb0e6f618
SHA512 9b41e132b1d22c25c67c390a0e7862dfa7deb9feb3905513347f4771d7ebb670e1df2daa1d3560d49490fa069ac9dfb0a20e6714625f88bc6e4eacf109dadcb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 270351514e497891feef753c045a0c65
SHA1 55a4bffb8304bdb8ef1246da0db9a2040ca57aa2
SHA256 145d385a5cfd9d0c962ff518977b352fce1917112bd9e1deccac48798d06d874
SHA512 d426a92b0ccca994d0113e3e4637155e0d6ad98d429378be998440f9e35e5c8f28138a33bf81107a821cd2f00c67ce21107499c57464c74d3ccbc573b75254b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 c17e12b440c082f7419d0315b3fa6bd4
SHA1 dcecb914e507cebe602690afb4a5938cdcc18760
SHA256 9e3d675205795a5d3977bff8ef214a85c4b0690fd2933ad184fab154c5c405e2
SHA512 05fd47123d18c3b01e47e6cefc672e6c8ccfe4912ce1376ed3e628a68a87d253e7d8673d1109b63ea8cdddfaebcb8696fccc7cda9eae96052d5befc91e936546

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1ce4f55358b20093276e9f6f5834b162
SHA1 43fa366e54f9d68d9b5df34e17c346d8ff6d885b
SHA256 0008d43647f0ee45dfb15d074b771492d4589628bba768af1b8eaf7296e6f41a
SHA512 135052d88b43f8dcd42a28e98adb650df3d7b5d0b9d361dbae117c1cd384c94e979f4277da3ecc67eaa1ebca0c00f7b2dfb925a5c122e48c612435c6606032d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5809fe.TMP

MD5 0c2894de376ed09197ac56897b60688b
SHA1 4d4056dcbf562558075c565000b0dea0e18fb992
SHA256 ba93fb35770906eabda400fd35325b8f568cff98645a9b7cef293a962e902a02
SHA512 59addefe8a9c5f9401ef38c9e29ad0472bcb9d621d70f81351b56a38f69b247c264cb2a432beb128f568d529c2a623a94a3a50842bcfcc1cd9d1dafa13faed87

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 826276d88c67034a4cf24da6182b1f33
SHA1 da53ed6741c19a2a1a42aa429f84933a983c31e2
SHA256 a6c680d79bb56c1ac8d95e90350c55acc714b79b76e4acaed7bcc94f9ef9df5f
SHA512 5fa8385d65e2dbe75c3b2cd8f567629fbc79f97fbc1530ea9fceee9cd142be9508c799398bb221d6a63111a74c5d4d35ae0cc82e6181812662dd58ccd8b1fdc5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

MD5 05197e9427acea2ac4dc812f97a8f078
SHA1 3d2a38b79da52e57783360f195ac3e7c85edefd8
SHA256 7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191
SHA512 084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3989bd663528e55e47e12820560176a8
SHA1 6d1513d43465f6a58f79edbcfadab277e34e2c7d
SHA256 1d713ea348c67885537051d838149c72a71f00cf4bb090a72f41217c1df9eff8
SHA512 d7f50cc01ae98db10849f743aadb71a75d005e6080229be1d6b8345fb932a0141d8e75ff5dfd8f1352408afadd7065510de253ec5225af24630d6f6aabfa4839

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5edf0765e64c001b37680024566ec6b0
SHA1 8a4f2ae5feb8628fc5ae44f50998b0fdbf36049a
SHA256 ed3282bcf96e744484714357f09ab9d6f33eb5090b0ea7a2fc8402ec5a348177
SHA512 5606eafbdf8daf142e9d45207d9c8abb8a254efb00e003f3ee676417a238f68922b4ffe0033309fd0a6d011a4092abc7cf79ec9cde7e0e0bbeb323680fa9aedb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 6ae741972a80dcc60f434330dba5eea3
SHA1 7eb7c89eec92afe97201bab2f4599305bed02c3e
SHA256 f49ad3fee3010cebbb2c4f9772ae935330938ad1ee9c296e8641f711c09fdf89
SHA512 24f8fcda890eacd6b09ef411f582591aebd6938143d73a05be9457ff0b04e021bbcfd62ea34c88658192652be65ab8403d4abaceabfc7a143e263b9e8a500058

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c3109c9c308c8547e8b3e18e20ec6858
SHA1 b0597129cc838e46d4639d1a2feef18def98b377
SHA256 bb04b05208087a8c72713141ded049809e3566fd1ef9e60423aac60856a40e10
SHA512 11f1b47609781c9f6790f2b54052a4801197a6a13b47cbf5206d36abde93b66cbb80eb9238746ed599fe5599ed40468e5a640980f03ca325080f790c6413d2a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a2af5e89f4d410aade9aeb4ccb985782
SHA1 214f1983236c72b036314143fe4782c8dec53cda
SHA256 9f18487bbd8ec78fe33e1d43eddffcb7bbf9366b1a1b95a8c7a52620ce9a7535
SHA512 a721a8fd81d890968868dfaf795a9670405572b9c562dfd3683fe165a0da4b1ecb4ecdbd9f7796fcc1fcb0020a7d1b3856a5a237f4b328ad45339ce6cb60859e