Malware Analysis Report

2024-12-06 03:17

Sample ID 241030-g897wsyarg
Target 7e33d0c8ac06ce3efba818afd948af2a_JaffaCakes118
SHA256 aeb43dd14328cfb579ae9de6d8e4ba7a699afbead10faf0c0dad9082531df8d2
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aeb43dd14328cfb579ae9de6d8e4ba7a699afbead10faf0c0dad9082531df8d2

Threat Level: Known bad

The file 7e33d0c8ac06ce3efba818afd948af2a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

Socgholish family

System Location Discovery: System Language Discovery

Browser Information Discovery

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-30 06:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-30 06:29

Reported

2024-10-30 06:32

Platform

win7-20240903-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e33d0c8ac06ce3efba818afd948af2a_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B6086D1-9688-11EF-A742-6E295C7D81A3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90951249952adb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436431653" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000b8a11095253929562fb33e2eea9b01121c7465a50107d167348070405e64eaa6000000000e8000000002000020000000dbe6844c482bbfc6e806c2375868381d716189bee97ef3acbbbc72499ea8e2d090000000dca9fd58ebbd48920c6cca13ae820b127b95a8c51391859ab3fe1718c32663fc62c5fe325caf8b8e55e4c9569d66a2ed6c9b9a7a58e2443403d09d227ada3d7aa3d3fc07153d70e48df4f3b6b346b8b33d39096476a7d5b6bd1230226490aa92a1c2fca5291daa653949b495b5ff8f67ccf760bd687702a037340c3df3009cd5cb0aca3026139ef1c9bb9faaa29e8719400000007193d608273aa085e52cff98d5593476d177d12a13bc2e53d329afa716147f8553620234fc37203f69ebe911fd41dc362240ff378e1f7e535de6e05de14e9ab1 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000093241f728e78094bda70502f67673dcb394a02692469906b7f1a05af9ee86b1d000000000e80000000020000200000004734d07c52708831812ed46a3680267f7003ecc022ef310d4e7ce6a3089255a1200000004e859e3f9304170a5338be01a6bf525a373e5ca14c9a7e8f56f752ac88f86f0f400000004dff39b31d785500ad5ad2fa162e83571ad6961150790c9a52f3c54611eefe40611c2f7a51b9a9846611abd7a99658f80e958f643ef810d986ae04f5f3a1ed82 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e33d0c8ac06ce3efba818afd948af2a_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.jennyschlief.com udp
US 8.8.8.8:53 www1.vietnamcar.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 automotive.arae.us udp
US 8.8.8.8:53 www.situsotomotif.com udp
US 8.8.8.8:53 mactrainingguide.com udp
US 8.8.8.8:53 images.paypal.com udp
US 8.8.8.8:53 autocars.niima.us udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 www.designertechniques.com udp
US 8.8.8.8:53 fc03.deviantart.net udp
US 8.8.8.8:53 www.wallcoo.net udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 joshua.maruskadesign.com udp
US 8.8.8.8:53 www.carbodydesign.com udp
US 8.8.8.8:53 geoloc2.geovisite.com udp
US 8.8.8.8:53 www.mynewcounter.com udp
US 8.8.8.8:53 www.clayaim.com udp
US 8.8.8.8:53 i155.photobucket.com udp
US 8.8.8.8:53 img1.top.org udp
US 8.8.8.8:53 www.blogtopsites.com udp
US 8.8.8.8:53 us.i1.yimg.com udp
US 8.8.8.8:53 buttons.googlesyndication.com udp
US 8.8.8.8:53 www.podcastready.com udp
US 8.8.8.8:53 www.newsgator.com udp
US 8.8.8.8:53 botones.blogalaxia.com udp
US 8.8.8.8:53 www.blogrankers.com udp
US 8.8.8.8:53 www.bloggernity.com udp
US 8.8.8.8:53 www.topblogarea.com udp
US 8.8.8.8:53 www.bloggernow.com udp
US 8.8.8.8:53 www.bloggapedia.com udp
US 8.8.8.8:53 www.blogflare.com udp
US 8.8.8.8:53 track4.mybloglog.com udp
US 8.8.8.8:53 www.scrubtheweb.com udp
US 8.8.8.8:53 www.blogarama.com udp
US 8.8.8.8:53 stats.topofblogs.com udp
US 8.8.8.8:53 developers.diggstatic.com udp
US 8.8.8.8:53 xslt.alexa.com udp
US 8.8.8.8:53 img.blog.com.pt udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 198.49.23.145:80 www.jennyschlief.com tcp
US 198.49.23.145:80 www.jennyschlief.com tcp
US 13.248.169.48:80 www1.vietnamcar.com tcp
US 13.248.169.48:80 www1.vietnamcar.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 172.67.169.38:80 www.situsotomotif.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 142.250.180.2:80 pagead2.googlesyndication.com tcp
US 172.67.169.38:80 www.situsotomotif.com tcp
US 34.210.130.104:80 fc03.deviantart.net tcp
GB 3.162.20.24:80 i155.photobucket.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 172.67.173.119:80 www.mynewcounter.com tcp
GB 142.250.180.2:80 pagead2.googlesyndication.com tcp
US 151.101.193.21:443 www.paypal.com tcp
GB 3.162.20.24:80 i155.photobucket.com tcp
US 151.101.193.21:443 www.paypal.com tcp
US 172.67.173.119:80 www.mynewcounter.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
FR 54.36.176.112:80 geoloc2.geovisite.com tcp
FR 54.36.176.112:80 geoloc2.geovisite.com tcp
US 8.8.8.8:53 blogs.blogesfera.com udp
JP 202.208.220.131:80 www.podcastready.com tcp
JP 202.208.220.131:80 www.podcastready.com tcp
US 8.8.8.8:53 www.zimbio.com udp
NL 212.8.249.233:80 www.bloggernow.com tcp
US 34.210.130.104:80 fc03.deviantart.net tcp
NL 212.8.249.233:80 www.bloggernow.com tcp
GB 87.248.114.12:80 us.i1.yimg.com tcp
GB 87.248.114.12:80 us.i1.yimg.com tcp
US 35.208.181.67:80 www.carbodydesign.com tcp
US 35.208.181.67:80 www.carbodydesign.com tcp
US 3.220.195.79:80 www.blogtopsites.com tcp
US 3.220.195.79:80 www.blogtopsites.com tcp
US 172.67.155.21:80 www.bloggapedia.com tcp
US 172.67.155.21:80 www.bloggapedia.com tcp
US 65.111.168.243:80 botones.blogalaxia.com tcp
US 65.111.168.243:80 botones.blogalaxia.com tcp
GB 172.217.169.36:80 buttons.googlesyndication.com tcp
GB 172.217.169.36:80 buttons.googlesyndication.com tcp
US 3.33.130.190:80 www.newsgator.com tcp
US 3.33.130.190:80 www.newsgator.com tcp
NL 212.8.249.233:80 www.bloggernow.com tcp
NL 212.8.249.233:80 www.bloggernow.com tcp
US 172.66.43.66:80 www.blogarama.com tcp
US 172.66.43.66:80 www.blogarama.com tcp
US 208.98.35.225:80 www.scrubtheweb.com tcp
US 208.98.35.225:80 www.scrubtheweb.com tcp
DE 185.53.177.51:80 img.blog.com.pt tcp
DE 185.53.177.51:80 img.blog.com.pt tcp
DE 159.69.186.9:80 stats.topofblogs.com tcp
DE 159.69.186.9:80 stats.topofblogs.com tcp
US 8.8.8.8:53 developers.diggstatic.com udp
GB 3.162.20.24:443 i155.photobucket.com tcp
US 172.67.173.119:443 www.mynewcounter.com tcp
US 172.67.169.38:443 www.situsotomotif.com tcp
US 172.66.43.66:443 www.blogarama.com tcp
US 143.95.250.139:80 joshua.maruskadesign.com tcp
US 143.95.250.139:80 joshua.maruskadesign.com tcp
US 8.8.8.8:53 bloggapedia.com udp
US 209.90.91.147:80 www.blogrankers.com tcp
US 209.90.91.147:80 www.blogrankers.com tcp
US 104.21.40.170:443 bloggapedia.com tcp
US 104.21.40.170:443 bloggapedia.com tcp
FR 141.95.187.173:80 www.wallcoo.net tcp
FR 141.95.187.173:80 www.wallcoo.net tcp
SG 172.104.57.50:80 www.designertechniques.com tcp
SG 172.104.57.50:80 www.designertechniques.com tcp
US 8.8.8.8:53 c.pki.goog udp
HK 47.75.130.169:80 img1.top.org tcp
HK 47.75.130.169:80 img1.top.org tcp
GB 142.250.180.3:80 c.pki.goog tcp
US 208.98.35.225:443 www.scrubtheweb.com tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
SG 172.104.57.50:443 www.designertechniques.com tcp
US 208.98.35.225:443 www.scrubtheweb.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 151.101.195.1:443 www.paypalobjects.com tcp
US 151.101.195.1:443 www.paypalobjects.com tcp
US 8.8.8.8:53 orig12.deviantart.net udp
US 52.37.130.11:80 orig12.deviantart.net tcp
US 52.37.130.11:80 orig12.deviantart.net tcp
US 208.98.35.225:443 www.scrubtheweb.com tcp
FR 54.36.176.112:8080 geoloc2.geovisite.com tcp
FR 54.36.176.112:8080 geoloc2.geovisite.com tcp
FR 54.36.176.112:8080 geoloc2.geovisite.com tcp
FR 54.36.176.112:8080 geoloc2.geovisite.com tcp
US 208.98.35.225:443 www.scrubtheweb.com tcp
US 8.8.8.8:53 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com udp
NL 18.239.18.25:443 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com tcp
NL 18.239.18.25:443 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com tcp
NL 18.239.18.25:443 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com tcp
NL 18.239.18.25:443 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com tcp
NL 18.239.18.25:443 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com tcp
NL 18.239.18.25:443 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com tcp
NL 18.239.18.25:443 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com tcp
NL 18.239.18.25:443 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com tcp
US 8.8.8.8:53 www.zimbio.com udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.18.190.80:80 r11.o.lencr.org tcp
US 8.8.8.8:53 gelgit.tk udp
US 8.8.8.8:53 culturesoccer.com udp
NL 185.126.34.25:443 culturesoccer.com tcp
NL 185.126.34.25:443 culturesoccer.com tcp
NL 185.126.34.25:443 culturesoccer.com tcp
NL 185.126.34.25:443 culturesoccer.com tcp
NL 185.126.34.25:443 culturesoccer.com tcp
NL 185.126.34.25:443 culturesoccer.com tcp
NL 185.126.34.25:443 culturesoccer.com tcp
NL 185.126.34.25:443 culturesoccer.com tcp
US 35.208.181.67:80 www.carbodydesign.com tcp
JP 202.208.220.131:80 www.podcastready.com tcp
US 65.111.168.243:80 botones.blogalaxia.com tcp
US 209.90.91.147:80 www.blogrankers.com tcp
HK 47.75.130.169:80 img1.top.org tcp
FR 141.95.187.173:80 www.wallcoo.net tcp
HK 47.75.130.169:80 img1.top.org tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.73:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\TarFD17.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\CabFD28.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77c18cad7a853ff34109ee17d2a55bb4
SHA1 4e80235ffb0e6170947b8c9a7d6f60a11b2bd7fe
SHA256 3cf663111f7b8ae7724c7aef03219355636563a0449db6218c8308795b0cefc6
SHA512 cdacd8e44edc84caa97746f51059886bbd6590d30187789775d10478145c6570913846576cf79696603cd4d6d47c970bd01ad6b6b25427b6134739d4faf5c9bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d856703ecd9926d90f622f1cbeb26257
SHA1 824fc5f3381b5187b4c72368f2ab37fe43fbbbf4
SHA256 daff34bb1b85df2b326cfeef76458cd9b417b5b7721729aca8118725a716a3c9
SHA512 0fec1d7e23f7a28d16037268740facff925f62b8b13abef84dda4997d2a676b91fafabf2adb1f360190fadff92f52c7b06d115bbeb62399365bc58965d11b679

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\f[1].txt

MD5 8add81be95b2422076d414086e842934
SHA1 5532d2d81583896341b80eed275451fcd797b3dc
SHA256 da63d55f9b85e8487b072bacc9a1dad501273e8c26d576ee710b595533c5b960
SHA512 4e89787e415ee4326d1299e8a99c6035b48e5e9b9ae227f1cc21f7be44c7817e5f4c71b1dc0b932eb0f072e1fea1e4409e64c9760ae3be542538194a5630220d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f87861e814bb69799d1458568e74586f
SHA1 17833636e5e70171db0fe57d6bd185e823d43f29
SHA256 b05a7987b8cff01280013b7ff77a2a515ac0a250a3ba4849ff4f1f8af618b39c
SHA512 7f4b7bce1fcde26a1136f18053a7d086fa79b5f7dd4d79020a99d183764e22fd2f1da9f9506c4074c3b8a20f2f85db2dff5ba1c527cef94bac6d4600845ebfd9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 7cb7302928b53133597b8a834df1d225
SHA1 07ee164c684526b390100827d7f52e2628dc0b89
SHA256 2cbe6a3dfe54d13b56e237ee00c4e9a3ef15d2e6d6cc17b9ce238edc6b8a4dcc
SHA512 7818d47747142c9e03dee536b797845e925df31c8a35af74f53ea8114e02fe4d13440d385c0f52cec7ad400a867cf1c5623ecc141d82f5af56feb239cf8c3238

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a1f55957870d75dfdd3aa46e73098918
SHA1 1a3e864a36a2850d82e038f1c73484b3797b5543
SHA256 470591e6e340413f8a918dae503f5bfe7e670a5bf79a343df6c34035ff0cbbcd
SHA512 df06a079a06fb79c3433511abd3351c44d68b5cd913836199ee4e468cbd1f94e50af62114db426f083b4152364a1a74d5ba9d27dc2709a9b2b778240046f1067

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 65f5fa04258bf42eeda0b614f2ee6c15
SHA1 34cbb6ad5a0be3ca9ae01744b1b504d91def7a84
SHA256 be66d974093e0c002d374130777e326f5cb3064098179fa5b861f67e38f11b0a
SHA512 3a474501f73a0542f17b8ff395362a4c53280644ea93e34d06144b6df762f263fb0a1f4f6c51c75f4847f9631088f728d667bf6c460c0c2666a5d2d9db3ec08d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e95a1875d8e6e374379b9dea190a530b
SHA1 aec3b7e4075f831790f4bf6e523194424a7e65e8
SHA256 65f8b7bd3e07bf5b7cc657dc7c7c5a53b880232244f23aa92ef99d5f5928b3a4
SHA512 4cf77fb5a15e4d880c36a2f61979d579f6fb32b79bf63874c3c6787d97e85edacc8e67e68f99c8aa9f0eae21e1a564bd918f032819bc3b50b757923d0c6518ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a17d985d4df3ac86d1729a4d715fcb1b
SHA1 ac13440089348bb65855e432b0ef4df022039a2f
SHA256 58e666dbd04f022d4f3fb942ab479366a05786c6ad562ce0425b1169b623e3c7
SHA512 4fe946f8e152058763a815d20341f981da4afc15623f2d2b8a4fe2ae32536a480f7fb131c77462eca088f9c67fcc7b15180f6f9ba414733334d839336b4c76b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8d12a1e8f797f975be227b5d3c39ba7e
SHA1 dab0104d0caaa7b6e7ff9b0c36500931b39828ff
SHA256 ad6d2b21fa14c39e03f85f503dbe6e2e54f996782f114b67315e423c3ed12ff5
SHA512 050ce0399ed6ae5bd580a50d8c24b2790f827bdcbdc058911c8a2f1714b0db1911c797288eff270dd7bb6c85d58bdcc5162385759153b2dee42327c12420100f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7e9e579a699259ec90b94dcb71af0734
SHA1 4f02823c04dc20507b67abfabff5e80de4e21a6e
SHA256 ec10adb7311633d6d435ed8b267c6c4f4c437a2f44dc85d4a7a47f8d815e1da4
SHA512 be3b67b148083b34ea5f6753dfc763b233fe9143a989ab59af1219ba7835adad0075a3579abee8a42fc8cd6f807dafaa5f13c8d1a59192e4e227ed21ea953ce1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25f27a43f65f248e944f8c6cc7d5ce59
SHA1 744e8d54d92c2b9f90fab06ce3ba0e4250559de1
SHA256 74790dba2241b575c5db2f0781bebb225cdefc711f774275ebe9e515d93220ed
SHA512 4564650e6b8041eea3c99013a570a86f03932689f3d697f3b058596d9768e08e65310e12ef26381eeb354684d069d5d7bcf3c66970e6d90852ee4d33f2958a64

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63461b7c50b3c6bc939009e0861bd309
SHA1 6e7bbfbc6ede524c6b9f8a402fae3215a3732bdc
SHA256 baa6e09bc28c76f486c95bbac6d6b033b0481b33717abdddeac2d926c12d89ea
SHA512 740485f69ed1cba144d055d39ef0780d94af2ed667ccc1e42b77fe1a4070c0d7b7631ef3ccad7faa14a4bebceed29fd5a2a469f5cd59beca77111ab92a1f2c42

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c6c3729fbd11e3a09e94bf383bc91108
SHA1 b094602022deea61fcc2811f8fb221899897868d
SHA256 b0378fec95b1442e156357c87b6e995192f49ebcb27cf9edee386b52788947a9
SHA512 64e91881760ffa4332944e0f2b744c6d1b2186439f232563209e65405240c4a66c4fba7c274f9fc77ce7b104daf2c451e01072bd07058527ea278aebf9cb5e70

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 7cb3a6bad75212b43fbab4f69f03bab1
SHA1 5dec1068a760a46d02beb1bd4dd2b10b66d73a84
SHA256 14e5f80b5f2b53af5b201831bbabc393093dfc17dde440a45db997cbacc507cd
SHA512 34e3e2d6d4e5ec95366667394570397bd68da227cdf449f9b0e2b185b54fccd10fdb7b51e348acf7085b1ab47fbabfd1172242b8052cc99b8de1ff8907dab371

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bad2d694417bd8e2fe71c8f24d08579a
SHA1 3ce061deb4e77084b9a35ad7cf1e5db9c53c85e9
SHA256 ea98559a689906c997d758c696fa92e54e7649438ffc1e015d76b4ccf0f76b71
SHA512 55483b18f71b88daef2a5cbaebf44a7eeb13c41312547c7f0995a4f227d6c310ae62c09e330b0f920c35e13276fb3244704088b90549541083d9d23ea0eab823

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ac4573949b0c20555994a3a13199fd61
SHA1 f682aa317c3f84216aa13bbcee7d29cbaad69093
SHA256 8386d71ae0bd6c247d47a6eaa8b87716e8f7fb4eadb0965052e0e9edf94ea047
SHA512 ba085f253deeff63a9a82d74cdcd36dffb8a15d1dab10e48bbd7b5aa43a307644363d4f43741b64fac3a227fd08d56e8f7d84bcbaebfcb879acc0ed4e83e44fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc206419429f549559a04ae843d22dd5
SHA1 835f9968864d6379bc99eeb4a4571c0732ef9f91
SHA256 4bbc24197f91ab3f4fc3a64589592fecc126f0dc595abf0a5f333387ffbe9dd5
SHA512 e845170850b05f9108de920d9b447468995d7a96bed2de949fa30e8a19398565b64908a2c28fd42d81057376279f4375e98d8740137963ba8460a0913744c765

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f5471be5a9f569f999486b507b7e15be
SHA1 153183606c4d5c0b056588d9fe8333c493812695
SHA256 2895ca09da4af6dd3622d50eaa99ca3f216dc69810b78d5e1d3058433cb0e944
SHA512 8af8ba9825aa72c51cc3be79cf301e049cb38dab12ac549a812e38858fd8981b884b1cf0f81d68ea0ce573f2d1379af379b9cd2ebbef881b19d38f22568588a1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7da7875f0486c7e1064d0acf1087d791
SHA1 56fe9f208b2a00c1fd17bbcac542e1e26293808a
SHA256 bff57d589e57e8dc3d56db8c19b3a54a38585f9047f5808eaadd37a97b49076c
SHA512 90017b9554f1fb84d40e18a2c254fc60dbddfae800dc959a92c58da78031479f91303c9a6b022ff3a189e371727486c451626c9f611a63d683275bd0a20f6fae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 86b35f61a45e50127421613616cf1491
SHA1 ecccf761d71e2340e073e43088618da03fd69142
SHA256 603a16ddebeef2d6121826a80d0e8fd31e41210f83c4c9e084975be8ba911c65
SHA512 1fdb12680a654b86c0161a09311901ec209f4198b0b430f21fd92bf4b990bb7aed9d775fda8faea283d7d6bd7ee76d1f7d2afe6aad19c1fc66836e510c4a7967

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6639396bc9783bc9d80c5c692e7d0789
SHA1 04bdd7e5d2ae5cd860b5127ce0977e90781f9c9b
SHA256 e43b0ac72235c724a7e27aab4a0dac96f797610bf72509ab868c71046dc1a3db
SHA512 4d7029a8c12cc424875eb9a4174242f73c8b8130baa73c44cd422b57292c67a96d79bb6dfe283f101a5975685bce59d2226ab5b10e1fc1642f8e0ec289b8e180

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 288751b608f080847c61a9ac40b4a78f
SHA1 c915bc74c4b76f719e5fad017f6c91a5c5e01548
SHA256 3e319e6ba90ca4483e574239ba9a0c8b8511ae161420a1a2b7120e56a8630f8b
SHA512 52055dfb67743a1c836c1d5ef9d7974ba09203e581f66f593abd2d731827f7b3e54bf1c80e637c68eaf3a31779f6ba0995fa01fbc5cc3dcbd82f89f7cea22a82

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ceef4a23db08aec189afe6a4cbb0bbf
SHA1 cbefd405f85cad4588b3b4e6081fcef4ecf5b003
SHA256 568f41be7a6a48fdf2da3aed697c423aea22e7ec3ca590612387c3ac757869df
SHA512 1a5d9c39565a10c35298e2a198812fb5786af3e724300ac0b5959cdac8200ed27158ee58bcde2a40dde2ad38d042c5f674c77225d2343c0ee25da83a47dfbe43

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3abe01575955f28814f24120686ceb1e
SHA1 fcfb4221d7cf07049308646f768d40c24b154ee3
SHA256 0e94800c9dec5b7bf7e40c23a30dce67297fbe68eb565059eac9fbee23de4e6e
SHA512 a6632d753c32e1ae0557cae2b389815f7bb7c67a0dc4a9da08817848348fb1c3899ffc535bb98c7c07997d9bd0824e786a6dde4e8911ae77ae33e86626c2c465

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b9fc5e78030f02503de2e72f92d7ccb
SHA1 99fe9ad69f058cc7c5fae0d162b9fbf06fbc1c94
SHA256 344db3b3076895ee02478a4a30c53cd321fd40714fb0320455f056c17a2b1196
SHA512 b6536e6699bd0f5105f55cc980d630e8614909251e14a5dd362ebc108d324cce93cf4f4e2774b941bcce58d65b06f9fbd1003846c849f7a695d88906ff3903a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f80a35f5c7a06581afe1389e83a3784
SHA1 d6a7f4c53c41368cc45fb64f14b60eb438a8586a
SHA256 f599ffe91def0692d9300cc7cdb813c7132173f9005b7d2b5dcb17538c2811be
SHA512 7bf6ffc0d766579567aadf854136c12d765f3905296d35fdfa7f0190fb51cb8055873f9562ba1fc15b069fe30180664b528892cc4a97e16fc05587fbfed13768

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 69f8c4510ddd98a5060c2c4e21388aa1
SHA1 b309e6a797777c59fbdf1f916c985757583f95ba
SHA256 7680b84345bcbb8ff7e538a3091b1c3c816dfd69f170c505c93e1fae5f5a335f
SHA512 f6522ac297650286932d01e9996ee569f80e2b0bfa5acb1f1b0a694ef92958c984788221bdf467133360910ab665b9ef892e53b6ac511055502bb398b556385c

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-30 06:29

Reported

2024-10-30 06:32

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7e33d0c8ac06ce3efba818afd948af2a_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3960 wrote to memory of 2196 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 2196 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 2488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 2488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3960 wrote to memory of 4220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7e33d0c8ac06ce3efba818afd948af2a_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8e4a46f8,0x7ffd8e4a4708,0x7ffd8e4a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10965548222206352471,13238275720773017425,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 automotive.arae.us udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 www.clayaim.com udp
US 8.8.8.8:53 geoloc2.geovisite.com udp
US 8.8.8.8:53 images.paypal.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 www.jennyschlief.com udp
US 8.8.8.8:53 track4.mybloglog.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 xslt.alexa.com udp
US 8.8.8.8:53 www.situsotomotif.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 www1.vietnamcar.com udp
US 8.8.8.8:53 mactrainingguide.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 54.36.176.112:80 geoloc2.geovisite.com tcp
US 8.8.8.8:53 autocars.niima.us udp
US 104.21.95.14:80 www.situsotomotif.com tcp
US 198.185.159.145:80 www.jennyschlief.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 www.paypal.com udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 13.248.169.48:80 www1.vietnamcar.com tcp
US 8.8.8.8:53 www.designertechniques.com udp
US 8.8.8.8:53 fc03.deviantart.net udp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
SG 172.104.57.50:80 www.designertechniques.com tcp
US 34.210.130.104:80 fc03.deviantart.net tcp
US 104.21.95.14:443 www.situsotomotif.com tcp
US 8.8.8.8:53 www.wallcoo.net udp
US 8.8.8.8:53 joshua.maruskadesign.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 13.248.169.48:80 www1.vietnamcar.com tcp
US 8.8.8.8:53 www.carbodydesign.com udp
US 35.208.181.67:80 www.carbodydesign.com tcp
SG 172.104.57.50:80 www.designertechniques.com tcp
US 143.95.250.139:80 joshua.maruskadesign.com tcp
US 8.8.8.8:53 www.mynewcounter.com udp
US 143.95.250.139:80 joshua.maruskadesign.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 112.176.36.54.in-addr.arpa udp
US 8.8.8.8:53 14.95.21.104.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 145.159.185.198.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 104.130.210.34.in-addr.arpa udp
US 8.8.8.8:53 50.57.104.172.in-addr.arpa udp
US 35.208.181.67:80 www.carbodydesign.com tcp
US 104.21.30.171:80 www.mynewcounter.com tcp
US 8.8.8.8:53 orig12.deviantart.net udp
SG 172.104.57.50:443 www.designertechniques.com tcp
US 44.236.88.217:80 orig12.deviantart.net tcp
US 8.8.8.8:53 www.paypalobjects.com udp
FR 141.95.187.173:80 www.wallcoo.net tcp
US 151.101.131.1:443 www.paypalobjects.com tcp
US 151.101.131.1:443 www.paypalobjects.com tcp
FR 141.95.187.173:80 www.wallcoo.net tcp
US 104.21.30.171:80 www.mynewcounter.com tcp
US 44.236.88.217:80 orig12.deviantart.net tcp
US 8.8.8.8:53 i155.photobucket.com udp
US 8.8.8.8:53 img1.top.org udp
US 8.8.8.8:53 www.blogtopsites.com udp
US 104.21.30.171:443 www.mynewcounter.com tcp
SG 172.104.57.50:443 www.designertechniques.com tcp
GB 3.162.20.23:80 i155.photobucket.com tcp
HK 47.75.130.169:80 img1.top.org tcp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 8.8.8.8:53 us.i1.yimg.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
GB 3.162.20.23:443 i155.photobucket.com tcp
GB 87.248.114.12:80 us.i1.yimg.com tcp
US 8.8.8.8:53 buttons.googlesyndication.com udp
US 8.8.8.8:53 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com udp
GB 142.250.180.2:80 pagead2.googlesyndication.com tcp
GB 172.217.169.36:80 buttons.googlesyndication.com tcp
NL 18.239.18.126:443 images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com tcp
US 8.8.8.8:53 www.podcastready.com udp
HK 47.75.130.169:80 img1.top.org tcp
US 8.8.8.8:53 www.newsgator.com udp
JP 202.208.220.131:80 www.podcastready.com tcp
US 8.8.8.8:53 botones.blogalaxia.com udp
US 15.197.148.33:80 www.newsgator.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 65.111.168.243:80 botones.blogalaxia.com tcp
JP 202.208.220.131:80 www.podcastready.com tcp
US 65.111.168.243:80 botones.blogalaxia.com tcp
US 8.8.8.8:53 gelgit.tk udp
FR 54.36.176.112:80 geoloc2.geovisite.com tcp
US 8.8.8.8:53 www.blogrankers.com udp
US 8.8.8.8:53 1.131.101.151.in-addr.arpa udp
US 8.8.8.8:53 culturesoccer.com udp
US 8.8.8.8:53 stats.topofblogs.com udp
US 8.8.8.8:53 171.30.21.104.in-addr.arpa udp
US 8.8.8.8:53 23.20.162.3.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 217.88.236.44.in-addr.arpa udp
US 8.8.8.8:53 139.250.95.143.in-addr.arpa udp
US 8.8.8.8:53 12.114.248.87.in-addr.arpa udp
US 8.8.8.8:53 2.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 126.18.239.18.in-addr.arpa udp
US 8.8.8.8:53 33.148.197.15.in-addr.arpa udp
US 8.8.8.8:53 8.39.65.18.in-addr.arpa udp
DE 162.55.172.212:80 stats.topofblogs.com tcp
NL 185.126.34.25:443 culturesoccer.com tcp
US 209.90.91.147:80 www.blogrankers.com tcp
FR 54.36.176.112:80 geoloc2.geovisite.com tcp
US 209.90.91.147:80 www.blogrankers.com tcp
US 8.8.8.8:53 www.bloggernity.com udp
US 8.8.8.8:53 www.ncurproceedings.org udp
US 8.8.8.8:53 www.bloggernow.com udp
NL 212.8.249.233:80 www.bloggernow.com tcp
GB 192.250.239.194:443 www.ncurproceedings.org tcp
NL 212.8.249.233:80 www.bloggernow.com tcp
US 54.87.82.0:80 www.blogtopsites.com tcp
FR 54.36.176.112:8080 geoloc2.geovisite.com tcp
FR 54.36.176.112:8080 geoloc2.geovisite.com tcp
FR 54.36.176.112:8080 geoloc2.geovisite.com tcp
FR 54.36.176.112:8080 geoloc2.geovisite.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 www.topblogarea.com udp
GB 2.18.190.81:80 apps.identrust.com tcp
US 8.8.8.8:53 www.bloggapedia.com udp
US 8.8.8.8:53 www.blogflare.com udp
US 8.8.8.8:53 www.scrubtheweb.com udp
US 172.67.155.21:80 www.bloggapedia.com tcp
US 8.8.8.8:53 www.blogarama.com udp
US 208.98.35.225:80 www.scrubtheweb.com tcp
US 172.66.43.66:80 www.blogarama.com tcp
US 8.8.8.8:53 bloggapedia.com udp
US 172.67.155.21:443 bloggapedia.com tcp
US 172.66.43.66:443 www.blogarama.com tcp
US 208.98.35.225:80 www.scrubtheweb.com tcp
US 8.8.8.8:53 212.172.55.162.in-addr.arpa udp
US 8.8.8.8:53 25.34.126.185.in-addr.arpa udp
US 8.8.8.8:53 233.249.8.212.in-addr.arpa udp
US 8.8.8.8:53 194.239.250.192.in-addr.arpa udp
US 8.8.8.8:53 0.82.87.54.in-addr.arpa udp
US 8.8.8.8:53 21.155.67.172.in-addr.arpa udp
US 8.8.8.8:53 66.43.66.172.in-addr.arpa udp
US 8.8.8.8:53 developers.diggstatic.com udp
US 8.8.8.8:53 img.blog.com.pt udp
US 208.98.35.225:443 www.scrubtheweb.com tcp
DE 185.53.177.51:80 img.blog.com.pt tcp
US 8.8.8.8:53 blogs.blogesfera.com udp
US 8.8.8.8:53 www.zimbio.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 172.217.169.34:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 scrubtheweb.com udp
US 8.8.8.8:53 225.35.98.208.in-addr.arpa udp
US 8.8.8.8:53 51.177.53.185.in-addr.arpa udp
US 8.8.8.8:53 34.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 81.190.18.2.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
GB 172.217.169.66:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
GB 172.217.169.1:443 ep2.adtrafficquality.google tcp
GB 172.217.169.1:443 ep2.adtrafficquality.google udp
US 8.8.8.8:53 66.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 1.169.217.172.in-addr.arpa udp
GB 172.217.169.66:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

\??\pipe\LOCAL\crashpad_3960_LPHMBAOSIRHFFJSD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 976421d561417af56db4cf6a29d73f1e
SHA1 7e1f318f26af19ab0bd3a70235d96eac2344ea5c
SHA256 033942f8aa38800d4ebdca9823abfd844a4935addc156a091892194e7ec5311c
SHA512 b97a30d5949017e3c1384116e7ddd192d4a002e744dbaf3e56a3474af50181d6f9e389f03f9c92ebcc741eeab45f8f99070c1695a498327d1b5899212b5283ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0af371036572acacac639fe2655e7f77
SHA1 e973e6fce1f5dff2e0bc8c9a9eeee5ac5e81c253
SHA256 c9be88d8fffced99a1f17b90612ff87d708fb920992a728e16606ee16062c200
SHA512 a1c2d034c995cc9516a0e13bde43429e5005c81aedc10ce703b134c7cdef53a209ed57472d7ad1209b73711a1b4eaebbf8df019a2d2394dc243b0f07db319bb4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 979beef9037f81a579db5a03291d1c59
SHA1 844d101d7a62b436e09e108799d87bda14c5d23f
SHA256 d994d8ab8c373d75e57b0110f89e1c7796a6c7ec65d4261e346737a82b4e0618
SHA512 99186c63457a2f3105d25ddb875f160600096e446b2d645550f8d556e5f16427087f114d9f94054e1b0b7860dc14d051b2339eb9b8b8873b242495478fd32e12

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a3f9c47dd0816f118820afc91c149406
SHA1 85a129180e5431859aaa04dcbb0e6de9dcea7d53
SHA256 b1fe3b223a4e5b17b630f92eaf37d7ed2ed2c10ad030c93fdba9509808a0b630
SHA512 8e27b90ef5d12d342c93eb5f09ffd98c7d1b8fd309a58dbc5e27053332c3514b3a25fe971d7b4ec14c651575491d4a70065ac63548ae481cafc63ffc50b66a13

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 61cc1257d7705474c47c808d22a29b19
SHA1 615b98796596bcf642a56968d8881cc3ae67220f
SHA256 43885a0e747d8dff20a171ce45f55c4d2712fb71799cd6dd719c70506af95227
SHA512 8092539a60d2a038e6b66d077bcf8243224814e7f1bd930c56430170857c5e3ef1df0eb9c467f38bd258940cfa9b71031c0b21a5cfd5446a5e8933b5664ea272