Malware Analysis Report

2025-04-03 14:22

Sample ID 241210-3hmjssvlgw
Target def7168d20c0ad5c39324a1ca2976285_JaffaCakes118
SHA256 a4adab7cf5459a859013000cb429a91ff5742e8b7c32542598687498c49ee48c
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a4adab7cf5459a859013000cb429a91ff5742e8b7c32542598687498c49ee48c

Threat Level: Known bad

The file def7168d20c0ad5c39324a1ca2976285_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

Socgholish family

System Location Discovery: System Language Discovery

Browser Information Discovery

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-10 23:30

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-10 23:30

Reported

2024-12-10 23:33

Platform

win7-20240903-en

Max time kernel

144s

Max time network

145s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\def7168d20c0ad5c39324a1ca2976285_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009990dc3be9636419a173dfbbf0502c6000000000200000000001066000000010000200000007b303c60aa9b6b9717146208c8c0a3febd800fb89ed35717ef2e339b833ff5fb000000000e800000000200002000000008318611de3ef8ed70bc3579a25ef73e14f715f2b4b853df576849f77321d90620000000b10e4db31a8bfd902e4a4adb093392aff0a4c5b455fc7109a5f947e9694990504000000001bb1ccbaa4c46c16e8119340bfbc4d299e95e5db7ded41310f499c02df04c20a1b1efb796cccb3670266cdfc90e1e411a7a76b37a53fbd49e963895acda19cc C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE8FFE11-B74E-11EF-A444-523A95B0E536} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatango.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatango.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000009990dc3be9636419a173dfbbf0502c600000000020000000000106600000001000020000000772216fcd3ae25f383a64a9057f41a3d35adcfe8ecb2c61ae4ffa0d033862e88000000000e8000000002000020000000f3df251b6fcfc2f3289681c42770ef38b91a813ac787aa62d699ee2f6f12aefb90000000d8b6fe973e994065c466faeeb11178d7f0a29345ee133c62735034ea1c8f6535be8456cd1d6312673fb02a50772355d0425cc47612413eebd666d33e05403597b60a89f744247c06495dfe8b455fc0492b88f6d49cc073148f6a1149f4fe645f6e43cc31fa720807563e8a50eff73467f01b24bb0f8463f012cf1b24d25d6bca2bbb63b27d3e7cc790c14aeff64f77114000000085bfc9bcc27d2270eb8c9c57712ce36215e80a1d17e2b3baeb0c220366659ce76ec75470265f9a6583f90d151e548870756f45320301be7173960474b5d6695b C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440035325" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30533ab45b4bdb01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\def7168d20c0ad5c39324a1ca2976285_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 i43.tinypic.com udp
US 8.8.8.8:53 static.hupso.com udp
US 8.8.8.8:53 i40.tinypic.com udp
US 8.8.8.8:53 rinconurbano.net udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 i41.tinypic.com udp
US 8.8.8.8:53 i44.tinypic.com udp
US 8.8.8.8:53 m1.webstats.motigo.com udp
US 8.8.8.8:53 www.calcularpagerank.net udp
US 8.8.8.8:53 i155.photobucket.com udp
US 8.8.8.8:53 s0.wp.com udp
US 8.8.8.8:53 stats.wordpress.com udp
DE 18.66.248.107:80 i155.photobucket.com tcp
GB 146.75.72.157:80 platform.twitter.com tcp
DE 178.63.3.34:80 static.hupso.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
DE 18.66.248.107:80 i155.photobucket.com tcp
GB 142.250.180.2:80 pagead2.googlesyndication.com tcp
DE 178.63.3.34:80 static.hupso.com tcp
GB 142.250.180.2:80 pagead2.googlesyndication.com tcp
GB 146.75.72.157:80 platform.twitter.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 192.0.78.26:80 stats.wordpress.com tcp
US 192.0.78.26:80 stats.wordpress.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
US 192.0.77.32:80 s0.wp.com tcp
US 192.0.77.32:80 s0.wp.com tcp
US 104.21.35.235:80 www.calcularpagerank.net tcp
US 104.21.35.235:80 www.calcularpagerank.net tcp
US 192.0.78.26:443 stats.wordpress.com tcp
US 104.21.35.235:443 www.calcularpagerank.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
DE 18.66.248.107:443 i155.photobucket.com tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.facebook.com udp
GB 74.125.71.156:80 stats.g.doubleclick.net tcp
GB 74.125.71.156:80 stats.g.doubleclick.net tcp
US 8.8.8.8:53 st.chatango.com udp
US 8.8.8.8:53 s10.histats.com udp
US 208.93.230.26:80 st.chatango.com tcp
US 208.93.230.26:80 st.chatango.com tcp
US 104.20.3.69:80 s10.histats.com tcp
US 104.20.3.69:80 s10.histats.com tcp
US 8.8.8.8:53 o.pki.goog udp
GB 157.240.221.35:80 www.facebook.com tcp
GB 157.240.221.35:80 www.facebook.com tcp
GB 142.250.200.14:80 www.google-analytics.com tcp
GB 142.250.200.14:80 www.google-analytics.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 104.20.3.69:443 s10.histats.com tcp
US 8.8.8.8:53 s4.histats.com udp
US 8.8.8.8:53 widgets.amung.us udp
CA 142.4.219.198:443 s4.histats.com tcp
CA 142.4.219.198:443 s4.histats.com tcp
US 208.93.230.26:443 st.chatango.com tcp
US 208.93.230.26:443 st.chatango.com tcp
US 104.22.74.171:80 widgets.amung.us tcp
US 104.22.74.171:80 widgets.amung.us tcp
GB 142.250.178.3:80 o.pki.goog tcp
US 8.8.8.8:53 r11.o.lencr.org udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 88.221.135.115:80 r11.o.lencr.org tcp
GB 88.221.135.105:80 r11.o.lencr.org tcp
US 8.8.8.8:53 crl.comodoca.com udp
US 172.64.149.23:80 crl.comodoca.com tcp
US 8.8.8.8:53 cdn.taboola.com udp
US 151.101.65.44:443 cdn.taboola.com tcp
US 151.101.65.44:443 cdn.taboola.com tcp
US 151.101.65.44:443 cdn.taboola.com tcp
US 8.8.8.8:53 s44.chatango.com udp
US 8.8.8.8:53 ust.chatango.com udp
US 208.93.230.159:8081 s44.chatango.com tcp
US 208.93.230.16:443 ust.chatango.com tcp
US 208.93.230.16:443 ust.chatango.com tcp
US 208.93.230.28:443 ust.chatango.com tcp
US 208.93.230.28:443 ust.chatango.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.83:80 crl.microsoft.com tcp
GB 95.100.245.144:80 www.microsoft.com tcp
CA 142.4.219.198:443 s4.histats.com tcp
CA 142.4.219.198:443 s4.histats.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabBF4B.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarBFFA.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 120a28172aa0f2047fdfb06df028ad0d
SHA1 b47ff0583e28cbd199f5f06a3b05f057816869af
SHA256 6d98ac714f3bd778d20a7a71df69f298307823798839664640de8df316ad56b2
SHA512 bbef4a0ffdb1a0084d9b3def1a71d88df86d3a2ac8cd24a757d52e3323b5fb4615586e1c34481cd8558af813acafb8a960a6a59242db3790cb95ba4a6acb18b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 8abc6f0b2a76523922604b9e8608f84c
SHA1 966c79af5f5f582b4d277397180f22ded54dc316
SHA256 ef43c7832baa894125c4f3316973693bf01aec1b45e9aa591307c8f5e2ae153c
SHA512 fa7284cd8f61c6196c383306b187c84886a7447223b98b3c926160990561513a66ac2ac3c340e106074899123ff139d09c215edb9b8753ff8ad08dfbdf0e9366

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 30eb533154a2ff5b05c68ae1d1d17da4
SHA1 9cc4e47cb9d5b101e3aed1d3548fa8a5cb0ff355
SHA256 11fdbc314b079acef30a173d192d907fcdd9e27f8b7007d760d81d23dfa17e14
SHA512 4431a11cbde6c01714839eff79503b5152879c6e0abe3979304b61fd66b3fe997a3a5af6dff074a8734157e3183db17a8ebd5cb65f5677828bfef17b710457fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3cc7258c82efacf0d4add79ea9792f13
SHA1 e354afe61532e6179e15b3b84e2118a0604d35f8
SHA256 5e48df54fb85974c3bd51a614a67465424ebe610bbce5f0625d0c89f7588dd4b
SHA512 b1ede138c08ba74f063f2213a3e1bc5e8804aa1e6f2811c6b7c701ecb7b053f22595b01f6fa9ad46101daca29963624d41cdae088d6f055c91f9b00c74203d69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1278ce85d78d334c0cfcf997fe960b0e
SHA1 4352a317c040ce2d7331cb0f5db54bb265fb4a0f
SHA256 38a5f36247e6b94ca485f383ba91cf9dd253ed2e0a8d5fa9ec7fe63f395071f4
SHA512 807c2f42a9fb74988530543864a74e1d5e2546390db034037b521e88f8924d4c334f320d9f899472e9422eebf3d6517c3854278b6e301a7a8884ff98342deedc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0208c032a535b73ce75e2a909493221a
SHA1 fbcecdf9cd6dc97abdd8e0f9e603bd695f7f1c24
SHA256 bd85d7d05b67fd8fe84523b2a484b8af9cca60e954d6e612732e264a79edc27b
SHA512 b6e04bdaa31fc20ce7138df0a32b9c4f0eeabe7cadaa9de345dd0d1e25e5698eeb18f400483aab82474f5aae7bfb79a9eb2932c3467c2f85384c0e8c022f8aec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b3e0814cfcef4830789fbdd52203452
SHA1 1011cfe730de2cec139dbd58b03e4b8a47b997ad
SHA256 0835b24306cea8b9259edee6144e8e0448ba808a27464053132250e7c7e88d03
SHA512 9cc6f734db586b8590af95b7f8529721ae768094924fe7a753593799e4bd1f67cb4a75bd233b20b130021819fe87501dc55062b6878c016893945067033262c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2196e5b8fbed18a829e11e9264ffd13b
SHA1 8a46f9609be8a7ccd0bca14ae1ea62c117b37e6a
SHA256 88f64a4a1936505c53f5043f2f83c4829954ba908be5424ab320d9eba1f85c7c
SHA512 5d50e2809fc79aecd4196f894a31e8088e23918185301c274be0191c25fbb6aaa5e504b81e17e93ac76c2674881d878590cff09b149df45d81f25aa95187f1c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3bdf21f4d62e1882ebf1abe8e6b0eccc
SHA1 9475148f5a11b624f307e5b16b015ec67494be27
SHA256 52dfb2e8ba8c3bc2355138c4380e2c73185bedd4ffdc78dc9c7a720ecf06dc58
SHA512 9c2ec640758d28a4aac3815f7b3885c5beb4fbc5227298152e57e563b6b946a0a70f7805c0437f0450fb18d2addac59dba5ea1720ed67e5a046540e116b1a665

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 611066cbe68e82f6db86a64c83709c6c
SHA1 25c1649b8b784b673a9ccc30c375b139bc414afd
SHA256 ac91fc34c26872b69496aa926fba9d31dd3fdfb018fd757f1ab02c4e790fadc1
SHA512 9a625b245e8b3ed52f9f0b91d74c9c3e6ded6f39f4f9ce5b3e69e9d7d2549010b8feeec370ee7ca7ba6f71c12d08ed75c653f6ac3da9f390dcfc37ee481e755f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 22442429e86f9d91cf4879766859a671
SHA1 1e7b61f788cf1a40c9ff38f05275a795e7c43c3a
SHA256 58afe3fb4962c2b07dbc2d927bc8bcdcbcafd045405b02bc554281d7d3d5e484
SHA512 39c4432f761fb34d73c88c33940a72495cb6a3e2bc348bf8ffb242c8ecfb0daf1c58e7e5a99c86de65b12ba26663497caf41316b6bed0efdecb6ecfdca014ac8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c34e9314225952701aac047d933348d3
SHA1 506567771c7a29d8e56f89c26a30bca9178f21ec
SHA256 19ad6de0bfc27971837a7be712b661d847e8b4c41014da6f056764b1f2cce1a3
SHA512 822026d30696d55960408914165fecbea5e63200eb72b4197b38241e35edf4ff172adb57c4b3b5abd446ab30bb191f4b9dc7d286c7b69f2582c271b28acde48c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ed7ab53f57dee49fb878d2e85d426063
SHA1 97c4a62cf774c26629b5b262b76808ba1c38cd52
SHA256 576dea81f7e3a5d9a58f6a79348f731237a2fbf3119aa127f2351b1f4d1d5c9e
SHA512 b3e881275019bcec22f65abb20bf635019e7f796984a197430ed1e7e340bf6a4c061b9e3fdf5d5899d2364f3972307ef97f7076acc3b30d855776738af81cb0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2c954218756fa1ea99cba1b92b79925f
SHA1 e1ec1644e244d024360ac2230185fcbc081c3dfe
SHA256 1718093414d5177b283f498344a93a89f35dd34db6956d22c21dcebc336d18f4
SHA512 1e8f47d9fd9f3c073ab0bb5ed882212ca618a040e904f4d153d44bfdfc31a3f9e3a64ea86b8175368ce4c9affb1ab1c49fc5cae3561d2c64048f23ed9b02f67f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e4ebbf259585e2d9a126d45f19f57e1
SHA1 f82cfe4b3c8707acce35bba684c82174a5b4962b
SHA256 b431e06f69a08ace0b781ec40324c98ebc844e129eece1da9d14c802c06eb348
SHA512 97e2d714166efea5dfcc89d03acfe82d228958f7d95727200000ba82ae9590af06f5a14f15a17102355c9dc1f369e0915c715b1009b6146fe4d210e81ce57348

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77a642632521f0c8a0d5fb7fda6e4108
SHA1 d7b34d4c3e8ef0a38a8ecc622ffce918b125256f
SHA256 885dc3728b606b2fe57f15caa4dc1c7144716641334b24e104d1df01fef49a30
SHA512 8d6ddbdd08494ca1ceef92d732346203cdfd1681c9f5243e318b78c939c50fe7cc5163ed5069afa27b022a5c3b5d76e0bd12bf31984e406d2defd6355eabedcd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 70478a03f4162594d54fff27dd82eb19
SHA1 b4c1b4a80b768c9838872617392e2aa54f0947ac
SHA256 2f389d4e6f787a8c02b964338242f8118a70962ddc7e24344d8b776e7c73cc33
SHA512 fda4eaa8b89f1be95d15bc8f7d66694f09fec45163c8ae3bda814d7c0a6a2b429fad3e9acedcd0ab77b9f1a6f44b7b28b7c7c8cf9ca8dc3f91b68ed9bc97c587

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 667e2c8a0fbb039f654ad7539267ce6c
SHA1 6c0935a4adcb076acdca90914ddf297f41ec6467
SHA256 e59cb3ff610587f1b47af2741d94fbf3ecde49a236abe0b7fc574d9256b1ea36
SHA512 7b65d50fcf485d1dbd58052ba42429db20d8cb6128dc9dd879f9bcefa80507cd78346d7c9431069c0792e635bd42d87ebd49cc3755c6ed9c7f5d935216e32cc8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3afa51faa7ab012e66665cdd2d3556be
SHA1 24a1768203c43d631796388e29abbb1571f4d135
SHA256 6cd2ad1fce46020ad5f05dedf2cca19a4f888861f65a06335ff283896c5d046e
SHA512 c7e57ab416425169ae6644b4609e186f7f267742b268c60c41d7c6c9c37e7d1ba97728b7dd8475960d464d6dd7c4d4a758f49554c54e03a82499bf8b697c3976

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84ccfdb73cbf1a550672a648d1a3e040
SHA1 a81eb7bbf3fc2b703c590ca2af1d3cc533c1d9a1
SHA256 48fb20ae71711c431ff206d97a8d1e3424da414d9070b59af0fcb7ca5e36edb4
SHA512 bf8dda4200514ec39c65d04749f42f406298f1afa59959bc9656b82a7bd6a2f61108cf990fe3476bd6b5fc819cce432e8a0e2150a8651b36f8c5a0bb443451c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19b247736171c53a479bceb1fee5a345
SHA1 34c800f5015fe0299643f139b21d81f466e9a4d9
SHA256 a9460e031e773cec518cc4398ffd957df1d73eb44b69ba5495b1304886a0b3c1
SHA512 78ddd989bb31302d9fe7b584cff1029c1e9f2dc64e3c657e69acef058d7d3ed5f61b844a5a373412e554537a709256e389e0e26030c590edfc233c67f83a5b76

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1def43e844159dbbf27606fd5539d77c
SHA1 0a581f52935a154ae25d995aecc21e6a62be228c
SHA256 78bc835a8b3c58b95ac76838c46f6b2742760e5906f62d47aaa4cbdf10be21a9
SHA512 864adfb6c4f8b1c112d7e2bf0232e754bcfdd5d5af54695d415ae91f486e05ac4ceb4207a111664a6011a5fcd1f208878513f6778e2de220e4f6f5ff2f13298b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afa3f8d2df7e23882f06df96ca5341ef
SHA1 57c8e80069f880c51b2bf87a29b4c2ae691f10e6
SHA256 3de6123090ca094def1aeafe3de9feb057dd769daf3ee945a41fcb7f12b5a981
SHA512 6a17eff0cf20e9520b2b0cdfd00a15f51accfae25f5d3878adf63b3d9d1fb0400845aca9246d6c8a8fce001b7a4aee1854f19b77252b4924f8e6bc19d5b3dd3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7bbee2d04329e7f2796e727a78b83cf7
SHA1 c64f0bdaba7956ad1e2b293094f15889235e704a
SHA256 5ff6aecf0fa27b996d100bceda9244424746face80d2ddcf50c3fc95d6f0df1f
SHA512 e812d82436de22e6f973d6c1e0a7606028fb7367bdf16c2c1193f9bb50fc76dace5eefeb7c4dadc3ec85eca31603dde394bfbe1a13183270b9266312d48428b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9c0bac9511fc8baa344e6fea2a2a2513
SHA1 e8872195f43681634a0483e8ed8a9f1b9dcc6d5f
SHA256 d951470d1c8ddf9563735b6ff4fffbafbc7970e2edc193e84eb44b96daf7f102
SHA512 151f73913710887d41e7e8cea6ce5c427b5feeef4372c13160a625fe502a87eb47c13563e00092b98818211c57c149c03f1eddb1c7c233213dcb7c6a0cbd27e3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 58ea1dc463ecc17158737831832ae8d0
SHA1 23171dd40aafe8bcbc40b709b9afe4290bcc3976
SHA256 158d1c7fe68d6ab64d380ae93120f5c03ca0851042f0d4d41a23d5dae3f505f6
SHA512 44559d8e2c45b635a824a6b025abad9569937409d1a23b497ae3454ff51be3f6ffd0cc109ca86490b4b3c42377823a8b5a12a7e829fe9a6d5907928936e7b4da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 889639934acb14bd3415f84a93941d30
SHA1 78b2d3bc6371fa5c648dbd349a030684bad52e6a
SHA256 01dbb86ab4097fcd7017e9392282afa0a897accee323b4b4735bb317a542ebab
SHA512 76033e654ff84ae6a93d21703c4b19122b7fc27322a318aeef6b72519c5a06b5466bacaedbaadf62a1f7580888b2501b68db49cbc0cfc4982d6dac43dfef08b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67c9590d8c0dcb66b5063ce76e8c93d5
SHA1 90d66659b99639270ef4e0eb2843213be55c1979
SHA256 5880039b301dc0a7194ce5ab295e7829a0171f6b76496dd5248bc9100c126dee
SHA512 dbffb635bb33b0788c70bfc3d3fe0d9bb684a43cb54bf59aaa516cb41475fb4127e469e924e2e837d3f7fb21781b0f4701cc5a597f2200a6461e7ea83825b46f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db31f3c525379a78c0414fb98b657e5d
SHA1 55e1f19331135383ed1bfa5ae94726a78b827c95
SHA256 ca0007b9ed61c4c0356eb7a1c99b5e7f9feab12e9d514cbc370480e0fcaca829
SHA512 f408941d1b4d186688d13f181b2487caec53420dd36f5d96b199fdfd48889852570ac4c0f326b548c3a5e96502bd6d1c0303d796d492bb48b2bbf48b344a9304

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 8ac1146cb4d7b1d76b7e7a38c9575ce3
SHA1 5d4ea48cc79b8f1967b338fe3a9a7cea29c75977
SHA256 37c7cb13f94f0425cf30b9093c8ac20000aced1b6b8d5dc00420d9b41bd6e2fc
SHA512 c210dc92d2c8bb18cda534c7b6b64cafb80d5ae940cae8f290aa67a2199012bc15d8d68e99b7ee833c68c50cff1df8bafa336636bc50b45c8fc3b81cff544a01

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 22fa1cc2dbb76a667bd6881c6cafc9eb
SHA1 fc11f079794136b589f25573114b23f6a165b40c
SHA256 22cd67f2531461843dbbb76e74545a8a2dd417b0a826772575d31c6dfb8c36ca
SHA512 997e1e3a4ee4dc363192f13eb2d7bda4a55b46822dfccb668c71e817a9d48136916df41fee5b07145908c67f12b01b7d583e9fba8e8761b02eb185f8654d33ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9fc0aa2d44a1c9a6423bd5823f103273
SHA1 fda5626bb976c28186c8b74ce0fe1ab527528cf6
SHA256 d2fedbfe7ab679fef6d0c1d4c6edab49b2b9d48b8e1bc6c1b85903fa9d659f83
SHA512 78502478576812b864a5c3f53507dd28e1467f8aa85a5d213d20f7a1300661379e18e25723818f7293bf170887b5af4b3a561672e600eba0465979037af58bdb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 366d68a4bfa3cc2c251a634bd792f132
SHA1 eb18cff247757c6fefc67e4a2bd2b4554c3f816d
SHA256 7383a0a0700cd85abac3b03f1fd5a6acfd79c7ef893825c88b661146485f806d
SHA512 1bd30753785223b97e685a526d51a5a08cc08287339139ed4135d0022c4a1f9b57a0e0fa90b39dccc47fed56304a0e2799566cbde7c1602729b1181fb6c7bc88

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 41df90ab73c1e9e71cab273bd4de448e
SHA1 d4d6741bde8c2141f28619e2f982b796ce03edcb
SHA256 9856cf8a3722e366722f733728b71cb0eab9900660265a765657717adc2ed430
SHA512 ee89432ee1489c8b8fb976f52f1beb2f7bff3e685e0cb4c5a45947b5c89cd67f1cceecfce9d3a7cd97b0f7d087666d25d3bfca700071b03a108dc9179ffd2882

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db36abb859e70718e8ffd20b5c2f4d37
SHA1 215bbeb149cd458c557d28df2d3252835cb29e9b
SHA256 d1fd654af152208722a7a360e79ec5b9e2c0ebcea24ccb0f86baca42b35dcbc7
SHA512 993e9bac04d8e07a658b3ddc9a315cc627209c6d4a992ccb916120b5129e678a277dbe573c65d0d88c6be699731f22a5494acc1396c42b7a4aee3c4064157a36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19c6ec924516371ecb5c3d309e6c0414
SHA1 82b7e520fabfe8a80f5287337f41fb9d5c087ee6
SHA256 7a7b50f465370363e3b60a5123505b5e3c78ad249cb8b565cb60df56f94b05f0
SHA512 cef56d1aab4213dba671f579570745c6d4fddfc98060da35283fbb3d7cda03b3cf65ab2fbd6480a477ced5fcc4f370f1a84c18c2182badf96202362300f80566

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 a5d9faf654ee1a2555b01831c47e1c5e
SHA1 147688e202f58d17105284a1aa12f6154602672d
SHA256 1fc8df920f67dbdd1da1f0beab9c2eb9b47f11e170c2547e479662735a985ec7
SHA512 40a91a0666c24aa7fb048aa7be620837c0cb5b74b726e9725accfa850fd9bbe5c209a8bf9d332eac0f57485f6cda4a44725694bc2565700500b9632985948ced

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 66d9d76bacac43c9c615cad313be861f
SHA1 53486a187463aac6508fae83dff3a3a0428c3c05
SHA256 447150393cfad8e9db5ff74fefd015e763ea137dbbea7c0dcb34f418f3f185ac
SHA512 123830bd8d1441d1aca6c9496c5ee8c85eceff854818cbec15ac21a438c1bedf3918a7dabc44ed8bdb84654d14346a58347f5c6406e7ddc39e6086d31d328fab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 294d21e3b90f6c2c28ad60ebd39351bd
SHA1 f649dcdec0b93c6f17238c00a8c715ce6457e9f4
SHA256 5862e238cfa0becae5745d9f2aa6617bdf323f458781d58bf833aaf1346fee29
SHA512 39ec390394b187b293ad8f9215c5c6dfc2ff175cd6b2f8a833353aed01948860023984c20dd86c9d2f08b765cba4113dfb65462d452d0bb6f2c7b7361652ba41

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a08d202d7b0aa59450375eb3ccd7dcab
SHA1 9296336e362a0a2100df499221c279f3d2bfa887
SHA256 2237f31d94a837ab13eb25779ef685b14c163f5e26bf09dc376248763255f3b7
SHA512 d4fe6f1fe210090d81de5b83131818a8afc73c0acb9b988cbdb9037632b3b932c18d57bd78ffcd19a43a9c603abb69456af6016ead0e51758eb4adcf7b4d16f1

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-10 23:30

Reported

2024-12-10 23:33

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\def7168d20c0ad5c39324a1ca2976285_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 744 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3464 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 1088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 4624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 4624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 744 wrote to memory of 3100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\def7168d20c0ad5c39324a1ca2976285_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b7e846f8,0x7ff8b7e84708,0x7ff8b7e84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11991412403687137916,5902993665575544097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3436 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 badges.instagram.com udp
US 8.8.8.8:53 rinconurbano.net udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
GB 146.75.72.157:80 platform.twitter.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
DE 157.240.27.63:445 badges.instagram.com tcp
GB 142.250.187.195:80 fonts.gstatic.com tcp
GB 172.217.169.2:80 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 static.hupso.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 m1.webstats.motigo.com udp
US 8.8.8.8:53 s0.wp.com udp
US 8.8.8.8:53 stats.wordpress.com udp
GB 163.70.151.35:80 www.facebook.com tcp
GB 163.70.151.35:80 www.facebook.com tcp
US 8.8.8.8:53 i41.tinypic.com udp
US 8.8.8.8:53 i40.tinypic.com udp
US 8.8.8.8:53 i43.tinypic.com udp
US 8.8.8.8:53 i44.tinypic.com udp
US 8.8.8.8:53 157.72.75.146.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 2.169.217.172.in-addr.arpa udp
US 192.0.78.27:80 stats.wordpress.com tcp
US 8.8.8.8:53 www.calcularpagerank.net udp
US 8.8.8.8:53 i155.photobucket.com udp
GB 163.70.151.35:443 www.facebook.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
US 192.0.78.27:443 stats.wordpress.com tcp
US 8.8.8.8:53 badges.instagram.com udp
US 192.0.78.27:443 stats.wordpress.com tcp
DE 157.240.27.63:139 badges.instagram.com tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
GB 142.250.200.14:80 www.google-analytics.com tcp
GB 74.125.71.154:80 stats.g.doubleclick.net tcp
GB 74.125.71.154:80 stats.g.doubleclick.net tcp
DE 178.63.3.34:80 static.hupso.com tcp
DE 178.63.3.34:80 static.hupso.com tcp
US 8.8.8.8:53 27.78.0.192.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 static.hupso.com udp
DE 18.66.248.28:80 i155.photobucket.com tcp
US 172.67.180.173:80 www.calcularpagerank.net tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 172.67.180.173:443 www.calcularpagerank.net tcp
DE 178.63.3.34:445 static.hupso.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
DE 18.66.248.28:80 i155.photobucket.com tcp
GB 142.250.200.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 st.chatango.com udp
US 8.8.8.8:53 s10.histats.com udp
DE 18.66.248.28:443 i155.photobucket.com tcp
US 104.20.3.69:80 s10.histats.com tcp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 208.93.230.16:80 st.chatango.com tcp
US 104.20.3.69:443 s10.histats.com tcp
US 8.8.8.8:53 s4.histats.com udp
US 208.93.230.16:80 st.chatango.com tcp
CA 54.39.128.117:443 s4.histats.com tcp
US 8.8.8.8:53 154.71.125.74.in-addr.arpa udp
US 8.8.8.8:53 173.180.67.172.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 34.3.63.178.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 28.248.66.18.in-addr.arpa udp
US 8.8.8.8:53 2.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 69.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
DE 18.66.248.28:443 i155.photobucket.com tcp
US 192.0.77.32:80 s0.wp.com tcp
US 8.8.8.8:53 widgets.amung.us udp
US 172.67.8.141:80 widgets.amung.us tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
GB 146.75.72.157:443 platform.twitter.com tcp
US 8.8.8.8:53 t.dtscout.com udp
US 141.101.120.11:443 t.dtscout.com tcp
US 8.8.8.8:53 syndication.twitter.com udp
US 104.244.42.200:443 syndication.twitter.com tcp
US 104.244.42.200:443 syndication.twitter.com tcp
US 104.244.42.200:443 syndication.twitter.com tcp
US 8.8.8.8:53 twitter.com udp
US 104.244.42.200:443 syndication.twitter.com tcp
US 8.8.8.8:53 32.77.0.192.in-addr.arpa udp
US 8.8.8.8:53 117.128.39.54.in-addr.arpa udp
US 8.8.8.8:53 141.8.67.172.in-addr.arpa udp
US 8.8.8.8:53 33.4.157.108.in-addr.arpa udp
US 8.8.8.8:53 11.120.101.141.in-addr.arpa udp
US 8.8.8.8:53 200.42.244.104.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 208.93.230.28:80 st.chatango.com tcp
US 208.93.230.16:443 st.chatango.com tcp
US 208.93.230.16:443 st.chatango.com tcp
US 208.93.230.16:443 st.chatango.com tcp
US 208.93.230.16:443 st.chatango.com tcp
US 208.93.230.28:80 st.chatango.com tcp
US 8.8.8.8:53 28.230.93.208.in-addr.arpa udp
US 208.93.230.28:443 st.chatango.com tcp
US 208.93.230.28:443 st.chatango.com tcp
US 8.8.8.8:53 connect.facebook.net udp
DE 157.240.27.27:445 connect.facebook.net tcp
US 8.8.8.8:53 cdn.taboola.com udp
US 151.101.65.44:443 cdn.taboola.com tcp
US 8.8.8.8:53 connect.facebook.net udp
DE 157.240.27.27:139 connect.facebook.net tcp
US 8.8.8.8:53 beacon.taboola.com udp
US 8.8.8.8:53 44.65.101.151.in-addr.arpa udp
US 208.93.230.28:443 st.chatango.com tcp
US 208.93.230.28:443 st.chatango.com tcp
US 8.8.8.8:53 s44.chatango.com udp
US 8.8.8.8:53 ust.chatango.com udp
US 208.93.230.159:8081 s44.chatango.com tcp
US 208.93.230.18:443 ust.chatango.com tcp
US 208.93.230.18:443 ust.chatango.com tcp
US 208.93.230.16:443 ust.chatango.com tcp
US 208.93.230.16:443 ust.chatango.com tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 208.93.230.24:443 ust.chatango.com tcp
US 208.93.230.24:443 ust.chatango.com tcp
US 8.8.8.8:53 24.230.93.208.in-addr.arpa udp
US 8.8.8.8:53 platform.twitter.com udp
GB 151.101.188.157:445 platform.twitter.com tcp
GB 146.75.72.157:139 platform.twitter.com tcp
US 8.8.8.8:53 platform.linkedin.com udp
US 152.199.22.144:445 platform.linkedin.com tcp
US 8.8.8.8:53 platform.linkedin.com udp
US 152.199.22.144:139 platform.linkedin.com tcp
US 8.8.8.8:53 rinconurbano.disqus.com udp
US 199.232.196.134:445 rinconurbano.disqus.com tcp
US 199.232.192.134:445 rinconurbano.disqus.com tcp
US 8.8.8.8:53 rinconurbano.disqus.com udp
US 199.232.192.134:139 rinconurbano.disqus.com tcp
US 8.8.8.8:53 badges.instagram.com udp
DE 157.240.27.63:445 badges.instagram.com tcp
US 8.8.8.8:53 badges.instagram.com udp
DE 157.240.27.63:139 badges.instagram.com tcp
US 8.8.8.8:53 pixel.wp.com udp
US 192.0.76.3:445 pixel.wp.com tcp
US 8.8.8.8:53 pixel.wp.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

\??\pipe\LOCAL\crashpad_744_SGSRFENIRHKBGJNV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 973a918934a8e1ca2c8d9f8a5aa45982
SHA1 8b3c9bf4c74de706d82b4f6acc7aae9f4254d927
SHA256 a57dee7c920b27b6f3769d953cf39709fc68efeb0bc4983e9aa542e45a89e8b4
SHA512 a03dc804704c55b5aac6a5c0b717d241d5cc0d2c3f2bd5ce0e20d8f6da478503e4b8eb80bfcf739b648dfe0e0e6439c96311370dbfd0ef775bf092b198b9b8de

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 016e8ef78ef61ff33edb44e2c4c547a0
SHA1 10159bc0e4887f408c332d22a11d9c3fead0c776
SHA256 fd52083e77b0dbf9ae19a044f0167e5f5dd3c40c42000da45225f871fcb6caa6
SHA512 5f02fee75c9e29fcffcffc1e959fc840c24137577db692e510435108028f71b24852846e80a4bbffa7d0423e39fdfede50f5c8c55a72a275b2abe94b80dab281

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 734891b691ffabdf6e83dc281259900c
SHA1 a2528bcb93fd4149b3be44d6acba6b1739fb39f2
SHA256 2791e51b3fba2a833dd7a027df81c62fb0987ea84414b3a2d65525d9b22fffbe
SHA512 cb451f78aca3c7d49115683848d8e34c793796d36ef58c55e5ddc411c1fc9edede0cd28c8e54098bcb3151168bfc817d63217ce2950f83270f7183d3ae00ff82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58217d.TMP

MD5 32c447c268a9bb9090e99cfb715ef257
SHA1 ddb915756649d4dfa4a542c6be0a879079c5afe3
SHA256 080fd99efddcb9c739da6c8e1dbd81bf738765f38492f9ddfac5626fe8cdaebd
SHA512 e7d84fb875af6c3a06d5bf845bb6bab316a553dea9d0bb7b3646569e13cbbad1ef470b0fde6e23b73c72887ee8a3463ad5d4c603da05d395dd3268db528552d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 78decb9b57941ff3949440bad65a0cfb
SHA1 d5c9aa3440a7857dc297507732538d83f1e9d1dc
SHA256 a431526fea4e6ea67456ad39047f71b66584248c829e1e5dccb37f2c1cf7774d
SHA512 5c8054ee4ca98d2344cbbc52eb67a645dc2854218e28c0165a332771950516308a617071b35bdbf3c140a4bd6d8bf476a5666359559f0548b6d4e031e58d7e6a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8e2980ddff1dff0240ec6e78861281f1
SHA1 88a3b2ded3d4962383fa91544b3e171cb80985e9
SHA256 a9b4b5e5f3fd0a909e395828fc76f8558138f61cc764f6a50e66b9fb2c5ea9fc
SHA512 0164fa9025e51a2182cd430176ab886a3f30e19ea4f7088e9c13f4b673682c74b297601e20d84dcf7fb2e1659d49a889e77ed5fc8943818aafb33ee5e61992d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 44f04d9defdf68bb01ff4f48271ad9f0
SHA1 f73162290c31913fbccdd98e3e4bbbc7ffb0a1cb
SHA256 a288137ebfd3961fea1be311465960d099943299994cd3c7de194b08a6d72d45
SHA512 5b3e67f75346a52da609d0a392c558e040b8208a102a094bf8ef51fa8206e7b946cd8fcc9957662a0409f08922ddedb6f19d33ab0c2c6ca5c7db6d0910d4db20