Malware Analysis Report

2025-04-13 11:37

Sample ID 241231-qkssdasjdv
Target JaffaCakes118_1e164f7677608cf2b7e02cd278d32910
SHA256 26c91c3a87677f6dfae28a4cabb40de0e6b8d629c012940e27487009dbf9ed9e
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

26c91c3a87677f6dfae28a4cabb40de0e6b8d629c012940e27487009dbf9ed9e

Threat Level: Known bad

The file JaffaCakes118_1e164f7677608cf2b7e02cd278d32910 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

Socgholish family

SocGholish

System Location Discovery: System Language Discovery

Browser Information Discovery

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-31 13:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-31 13:19

Reported

2024-12-31 13:22

Platform

win7-20240903-en

Max time kernel

142s

Max time network

144s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e164f7677608cf2b7e02cd278d32910.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007756420daf2e344b9d9ef025fbbb8a94000000000200000000001066000000010000200000007a4cd8ff3946d0ea91e9c2661987888abd420776f2be7b592a427f78fc5bfd8e000000000e8000000002000020000000a1592fde817efe36571b4270ee7c289dac7656184a4410e2ca8440ab47591b98200000000d65f86846ab9944a7688a7dbcff397be1109235a6e48e1c743c428245820f03400000009dd009263c1a5f702039d887a3237b55db8eddc668c70e54693c6b6528fa7e1c86392b6fa55f15eb0d6f9134cf62322c59167d84b03228c43a3dd3cfb23c9d5d C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007756420daf2e344b9d9ef025fbbb8a9400000000020000000000106600000001000020000000c8a699e6b596b2fe43ec96c830d373059af2cdf75e17e79849332839322c5fac000000000e80000000020000200000000c6f3a0532f3cd85041e3f8f1b6edd8ea7b6bc7e166c0ae1fa2774d62828f92a900000000252553ceb62d09a88ace537d0d93a3b2d8a27dd964f6845a193a3fb1a3cdc4aeb2f5568246b53a2b5d18a8d2fb4da81d787b977a5fc97407dd2af7cc8bed4c0e941af96eb14e6ffb83e97203903f769412eb909a5e492d492302f2cba5d3655e558ec5025d3d3783beb5db1b18257d4384824c41e3c71f4482541e103fa0b174c2525adce1f1c89c0b4df1e9e02871640000000b5cc386fc120391e7586c3342bdc6f88ec3bb84d2fe1f05b42bc1c1fd7ee00863e8b51cd78ca342616aafd7fa29e16c3bc5c2bf1ac6e4a1a198f339885b832c4 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441813043" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705d70df865bdb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E07DAE71-C779-11EF-A27C-4A174794FC88} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e164f7677608cf2b7e02cd278d32910.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 nusacode.googlecode.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 bdv.bidvertiser.com udp
US 8.8.8.8:53 domassistant.googlecode.com udp
US 8.8.8.8:53 javascript-share.googlecode.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 drooid-today-script.googlecode.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 images.dmca.com udp
US 8.8.8.8:53 www.blogtoplist.com udp
US 8.8.8.8:53 xslt.alexa.com udp
US 8.8.8.8:53 stats.topofblogs.com udp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 172.217.20.164:80 www.google.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 172.217.20.164:80 www.google.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
GB 143.244.38.136:80 images.dmca.com tcp
GB 143.244.38.136:80 images.dmca.com tcp
FR 216.58.214.169:80 www.blogger.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
NL 142.250.102.82:80 drooid-today-script.googlecode.com tcp
NL 142.250.102.82:80 drooid-today-script.googlecode.com tcp
NL 142.250.102.82:80 drooid-today-script.googlecode.com tcp
NL 142.250.102.82:80 drooid-today-script.googlecode.com tcp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
NL 142.250.102.82:80 drooid-today-script.googlecode.com tcp
NL 142.250.102.82:80 drooid-today-script.googlecode.com tcp
NL 142.250.102.82:80 drooid-today-script.googlecode.com tcp
NL 142.250.102.82:80 drooid-today-script.googlecode.com tcp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
US 54.241.51.109:80 bdv.bidvertiser.com tcp
US 54.241.51.109:80 bdv.bidvertiser.com tcp
DE 159.69.83.207:80 stats.topofblogs.com tcp
DE 159.69.83.207:80 stats.topofblogs.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.110:80 www.google-analytics.com tcp
FR 142.250.179.110:80 www.google-analytics.com tcp
US 8.8.8.8:53 i1259.photobucket.com udp
US 8.8.8.8:53 www.facebook.com udp
FR 3.165.113.116:80 i1259.photobucket.com tcp
FR 3.165.113.116:80 i1259.photobucket.com tcp
GB 157.240.214.35:80 www.facebook.com tcp
GB 157.240.214.35:80 www.facebook.com tcp
FR 3.165.113.116:443 i1259.photobucket.com tcp
GB 157.240.214.35:443 www.facebook.com tcp
GB 157.240.214.35:443 www.facebook.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 img846.imageshack.us udp
US 8.8.8.8:53 i50.tinypic.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 38.99.77.17:80 img846.imageshack.us tcp
US 38.99.77.17:80 img846.imageshack.us tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 142.250.179.99:443 ssl.gstatic.com tcp
FR 142.250.179.99:443 ssl.gstatic.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
FR 172.217.20.164:443 www.google.com tcp
US 8.8.8.8:53 resources.blogblog.com udp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
US 8.8.8.8:53 s10.histats.com udp
US 104.20.3.69:80 s10.histats.com tcp
US 104.20.3.69:80 s10.histats.com tcp
US 8.8.8.8:53 s4.histats.com udp
US 8.8.8.8:53 world.popadscdn.net udp
CA 142.4.219.198:443 s4.histats.com tcp
CA 142.4.219.198:443 s4.histats.com tcp
NL 190.2.139.23:80 world.popadscdn.net tcp
NL 190.2.139.23:80 world.popadscdn.net tcp
US 8.8.8.8:53 www.blogtoplist.com udp
US 8.8.8.8:53 r11.o.lencr.org udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 88.221.134.138:80 r11.o.lencr.org tcp
GB 88.221.135.99:80 r11.o.lencr.org tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.146:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 104.20.3.69:443 s10.histats.com tcp
US 8.8.8.8:53 statinside.com udp
US 104.21.57.149:443 statinside.com tcp
US 104.21.57.149:443 statinside.com tcp
CA 142.4.219.198:443 s4.histats.com tcp
CA 142.4.219.198:443 s4.histats.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 b983e034726c96cbd74bbae44ff3087f
SHA1 c124bc5843682eed7ef8e4c676b035d280b65e30
SHA256 87bfad7e3eee4555da2c7bedd90bd8c3fbe230756139e89d5f960cca836a6b16
SHA512 e9dc5de2c3dea630c015515cdcaace22c6d3e8104d13f52eeee5cee784af875756d451fec3ed962031fafb33346000d1dcca329c5f809d514bcf11e6125fcb70

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 084dd453af2385b582be833afadc64be
SHA1 a3afdab8872a190e71e44e237535fc917d61eb4b
SHA256 8c94d185a9d8bd6ded8bdd1aa9769c05e2df7f7bddc126972967c9c4d1ec12b8
SHA512 a11be7bd7699eb946fc9efbc1ee10052ba1147b23650127d7ae98acd73c79f928f9ddab02442e169ac76ab9bfbc758f744cc0a42aa77cc03d3e3e2ec5a9fded2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a7168f2f79461f86c8201580d38b291f
SHA1 d00b157b530d51dcb59f1590dc289038001d8cc7
SHA256 033765b34ce2b764b9f1839d0c39c692b0ec8b1ac0eb2182603e45ed400ae5e1
SHA512 d8d588ab786e30d69cf51be6d32b3f73172491c0215249ee8fa9386398bf354d08d8bbf9fff38ea302eac1da1ffc34684304dac9c5155daed9ad433dfde0dd2c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 4134562488bbe0bb13677b43f208e006
SHA1 68e67b162db6a8a9dc3b448b413a725984344557
SHA256 52a5c064b412cc7331ea4e4e4b0653f18fb4e217617572be96e657662509b2ff
SHA512 4294b79337ead6e2bd2f294beacb733523ae9e634bcbaa2c4abc7e7fef00cdf6432e40864baf4d28776ad1babd543545e8ad2a1af0ed2df404e32e51ff706f0a

C:\Users\Admin\AppData\Local\Temp\CabBC9B.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarBE74.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6dad0d594850a90f83d1c7eee082ffc9
SHA1 23016440ca48475718641bdde7ff736aa8da06ff
SHA256 f3a0b282b3994b2f627618d7362d78ae90c8888fe7d5da867697e2f416197d53
SHA512 4af48ffc7a5cde925c7adc8f92a067ade5778dbfb7d486be3e1c77197fd49121827e0cda8458b1e282441f980921515e9d0e21323dc71d8cc29f5391559f74da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb8c0d4d19e7eb07d057a58d9e633697
SHA1 27717482c7990f64a60f3a5f9de66c8ccec0f8f1
SHA256 2c52f5d7012cb401a705d9e7238bb4c43071fe6501c6258849b248a46c4ef2f2
SHA512 39f0691389501a194396e6150d5d4f18753c7f91c3d325b221dd0f9d7b3ffaf957b152f9f004f382fac919a845c95194721ddde89dde7252b09a180d955a68b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 c0be88e60ee850d1ba55c732be726372
SHA1 6c11f7a352bb3f9ea1982dffa8add2a4431aad29
SHA256 43cb62bca10b8bdd9e0337c0cccce6bb4e4f8164cbc14ff40fc941c0023372fb
SHA512 ca17c08b49cf768e274a7869cb30efbcfb0efb956bf8508c551fc7f6d3b980b94492990ce02c3cbd1affc5bab3f7e759aa3e7e13e136764004959a46493d876c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9a04c9cb6d01593f64a9131b3ca42c7
SHA1 a1bfad9d7b9bd47d91076c029eb63c1ea37e3255
SHA256 4cd43f218fbc33d92abef11043c76fe4c640e7b3d73c6bd3d930fead257425fb
SHA512 c6101a641768c738148ecae99d95f380f92b96f98caab51691678383beb06b974f70466d82b18a55a0a99be3a7c161b1ca6fc70399b0d212bdea6aceca3ee54b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QS2MOPHD\dnserrordiagoff[1]

MD5 47f581b112d58eda23ea8b2e08cf0ff0
SHA1 6ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256 b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512 187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1738IZL\errorPageStrings[1]

MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1738IZL\httpErrorPagesScripts[2]

MD5 3f57b781cb3ef114dd0b665151571b7b
SHA1 ce6a63f996df3a1cccb81720e21204b825e0238c
SHA256 46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA512 8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8dde7615f42edc4cbe7d5d63ea6871e2
SHA1 a3ff6ccf99d84b3d04cfaf3e38f307d7fb3865ce
SHA256 3c6f450c0932d37813cb02a8bfc5ba738033cc28abe92653ffad5538110e58e1
SHA512 a41c08e4c7fc71f054643c2d9748dece7c9f522b4171b40ae2bf9d8af5e2f3646bf31efb0830a0b70fb6c58afd1a8fd48aa57908d4f62f13536cbb1d563b3ac1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 6ae5674bbfbee680868c448ef329b2f3
SHA1 609a586f492175273d755b712a67f81dc025e854
SHA256 e1f11f0dcb06958c2f9fef9bf1cf067c629bd4466ba56cb235b1d00462161bf4
SHA512 c1224a9051f7575c3722fdaf4c42c202376818c1917d3387e9996c88126c88019f4adb70d52b48b03f5b7a8e0e9de4dfe560bb1bce2d65f24e12d618adf2bce4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77c884a6c08106b6503d5e12e45add77
SHA1 faa611b6e4bb1c0fb29b32f6f81b4d0c27f169c4
SHA256 62854785e81cd187036d8d4e75fc228c65e53f51d89dea61008ae74441f7e7af
SHA512 370425c1f813a3e8624983d398903ce55fe8b1719838cbf75a4f589200e549001ce97cd039c73aa803947fd927c2c83f60f9f72441cf95fc2e7100792998ef3b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 359d6301f4a0ef82d0715bce4383d00e
SHA1 a2ba4a0fec51ef97356eb8ebcf372f1aea89b7b0
SHA256 d46813f93c71f3bb3fb6c31eeb1ef559b2ce620c63300b79c66ae055270863e5
SHA512 35dad63cb9ebe0e1a136b220d6a5d7bea069cfba97b57becde64473621f16df0edd78454278f704306594fb9ea2a5ae016b795592ed0770f06ed553b24aa1018

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6bfe518c1d0b6f5f2806beae2a1e30fb
SHA1 29ee17159907a7004b3ba9209895ce820a2d32dc
SHA256 c42687d4509a07918feafbebd8e2d67e3b6e231bede0a349cd3c8e1df915f8ee
SHA512 af3876df997cad2468a681203bfa5eb514578059ec1de82f98b0de5f6c9c447e80c9ff1ef31f5bfb205cb2d4d1737e1252fd92bd1aafc3ba4efbec511cb9609c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4811ce6fd39711520fea1281f2d4edd2
SHA1 b13be91b8076ac01e291c393e4c8f9cd75e0f8e2
SHA256 ba891edae5929a5015ff71a7d5bef65d867561823c3b7efe542d52ffefec50fa
SHA512 0fb83c4995be45822f8292a2a7c925d538a079096a8e893c6287de0d61ab2a6887473dd9fde77a24c330afe012a8eb78785b8b0451e116b50ed8bb73d1cc6e68

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 32284073a3357372734cc28298304b95
SHA1 613819dae42836af6628b6d5cb82564a2f47b59f
SHA256 ca9835c43758b83d9833c94f1be7aedfc8dc578903ea3e146d89652800219044
SHA512 62c2e319f1c0c85902f8c26a99a5d3e081277304ea0ef6660d94fe4c627ee912f18a3ea5fa92ba49a51e00df64368e08f96f2b1b32e9687ea648c5ddaf642187

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 97c4af6f30c8436d9d296dee10658dfe
SHA1 6b5cfa567b886361430b47bafb257fec8de517f3
SHA256 41a69d240daaeeb345336dc6862691c9b33acde9a9376e174ce8ef2c5b185d7a
SHA512 1acd8cc2cfbe63b633a878839880aabaeef7d0aa8b4f4e20322bd779058d0cba35cda38da4fd0eb7b0420cc7cde1c4d9c46f6a74feff26b73a8a844084df3a3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 4e43657781926a9df21008b605c8355d
SHA1 1047ad0940b1263cbb7dfd79cbf8826153241be5
SHA256 87669dcb0fa0a593900756886e0268d41fdde0f7a05dc7142e96cc7a297446f2
SHA512 de22d350b924c321c6ebc1fa83f57322de79f7d0a9272f71fa7d9d882ff3c16d52ef9a2574dbd280cfc896e7cf195d5c5f96c9ef67874288ec4f642664e714ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce6753f9616c8bd8a50cc80a3de1e419
SHA1 75e016bf9f06ac1eea6f84d4c4582fc8106129ae
SHA256 26d6a7c02365283aefeeec0f06b863f2c7e6285934977c3983352f9adfbb7802
SHA512 b424439c137e1ab1714d7420e622dbbb4363f4e735e86d327cf3d43cb174d9f4c44a88547112d1268400bc6363c49ce3822dea1ba191018d620a24319dc7f768

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ac4f5088e617b1bba3766a784d230e85
SHA1 dd361c635bf025ec7ccfb4a87af77508f452afad
SHA256 8355bf887e3eff8bbdacfaa1145fd20d35aa82563e9e03fed7044d7008f74e1a
SHA512 fdff9e40348c26be2de975119e3b6f57e344d18fde40c3e7afddc79d0cb4300c75983e2241ecae5ad27b110215a42eb43e3c31429aad6d3600ca69dbbb1fb32a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ae11ec37c3550ef58ae5e1848d377e07
SHA1 a78bebc2c5691a3aeaab431a82dd75f5b34538ab
SHA256 472107701f352063f1ad7c00fb74d41ec1359c6be0bbb5849d4a3d6a789795af
SHA512 db97508aa78eac8a9d3cda6cc9ec42fc7d60de3d0d90ffdfad4f1438af9701b1c0535aeb1d3606eccbea2f11a3820c718cc056a3977b64859383b096b2afcc75

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4a21dfed8b235ba89934d45de83cc634
SHA1 5e8d5258676bb24afcd197eca9bfc1899bdbc210
SHA256 e0da6be6115540910b078c515ca5f3efe4f6c0c081191d81a92cf598ac17c3e0
SHA512 682a9e283b5745222ec7b180f37511e07e19fad6fa9f846caa93c47da441d655b176763485ad998366b520a77e07ea0e78c4eb69f56528f9b30cac9001d6bca4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f1dfc342545028ad651f18c8253341e3
SHA1 84bc1d7c4d745519a41db33d94e948ce1a8c36c1
SHA256 56e66d3a56d214eec75b0176e94969bba1a9a7c609de962b59c58dbf47bf4fac
SHA512 e04c88a820bffe1eeb4c1fb4a6e6c1d6c6d18466219b96156d7895475274c391b3c87726f46cbfc071a7a5ddf02953c01b05152178b108d2192857457792c720

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e2f24d053127c321e8c24e992820e94
SHA1 53a0a45582983b9562391c3698bd6dc0e44244af
SHA256 878b2fc9e756d2a33d99cbbf6ab6563b560b9bd451090e20962d29d05aa296c6
SHA512 0dc769ca33c1861735bcac9760974d67cd77f55aa1f5ac3f0b3ebde836898a5df451745c1b596596a026f35f8d87fd6fbda765edba2271758c03783ab306cda1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca2b531d3ccab3a746a1d92804ecd25d
SHA1 95146cd7e310650ed0280030432389c1ccc7940c
SHA256 4d4fd6e2a9dbe5ba2ad9d9cd5ef0d8fa95aa3b2b165ff36e2c1c09e6063b5cf3
SHA512 5984f8fea3dba23791b00181bfaac2836d3aa54556b8fb1416077b00450c3a34006792baf14a9f3010c8b55489ec53e30a981a28858ffcdac2437bfd43766515

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 49ce9153ba8c96adeda5d74d5b4af858
SHA1 9e685ca14fa89cbcd26c71f604a8850201fd3cd4
SHA256 ad52b51bd315c147635d8217b452c9ceca7af5b05806ad5e9c178b59b182deef
SHA512 e6ff2b60cf12be9b97644ca772a26c5ae6c43b773318ca2837ab6e41b10929cb0f2b0aa931acc68038a5b84111c01c04381472a637e23f47216523763c0f035c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ef5336004360473f4d50505d6c8ac256
SHA1 dc01cdeef55d8fe3e724f6c6fb6414ba02467534
SHA256 dfb6a9e6e7ef4ec47fa9175358f004b8b8a5c87d29a6801cc5a88b0412b69b8d
SHA512 115ef51573bf29e940c74a2f97e2616c71c5dcf831b4247f6a128b90ac2c8f39e3e43a18b562df06ff09f1cfce6448f6655e98b8cb5c09d136ef86271f4c41b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7d2bfe838ce6adbf190bebd8ecec479f
SHA1 a262daa0c631dc4abfec02659682b0cc54e287ec
SHA256 b5bdb7249afc15e6dfdcdb547a348f23e1ecbdf4dd6f3e6d7f272a912271fbe1
SHA512 5bf1729609b9f1ee607dd0106908e9a05ce60ef95e819ea6e88511958f299adf4751d074541167b7b34bd46ff5587558c7bfa3727a018851226ce24d9e4fefb3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9883a4157e73884a15f8f01fcc12bac2
SHA1 31a6f56ebbacd50e085f18e6547bbbe543884fa4
SHA256 ddcc89542e80b2d2019fc4eec6ad2a80612009539e883aeab71bef55e6f88b0c
SHA512 6cf96905781422c57fcfbcf566ce358561820feda2a21422ad5bdd2d6095307b9ae471abeabe99c6a95ca8335568cb3dd4d0b049416eb61768937b76088f367e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46a8f77b95f30c23b700bc5ed13803e7
SHA1 844ead329f681e3b20686929e09a04d88efdfbea
SHA256 9195ebc7f28fd5a13d5608c9afcb75d8ef199c0ba743daab2da82447c03c632c
SHA512 d69e3179a01fc1b420eab29cf819e352f47ce0f3de92c5ddb35cb1ddbce5bf3051aed132538d4b0c670e9f1163549b88dcc7b71f54437a21b5d2f723c7d7d522

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 df19e760f4e7d01394ca600052fa9419
SHA1 1a2c43d3c2a006c6314400379da8d94b8671dffb
SHA256 398b4935648cdffd2f8df86725100c294774fa8bceda5917f98cfc126dc5be2d
SHA512 5812af0c49d01448531406c083a1985e519ad9eb83ef6667d93ee7efce2ef042e668195f0afd759f4ea33a11969a6e6a55220f745ec9d60b5c39f2d490a3d7e5

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-31 13:19

Reported

2024-12-31 13:22

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e164f7677608cf2b7e02cd278d32910.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3780 wrote to memory of 740 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 740 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3780 wrote to memory of 2180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1e164f7677608cf2b7e02cd278d32910.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa98a646f8,0x7ffa98a64708,0x7ffa98a64718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,3312786377923438852,15167685503774165198,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5380 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 nusacode.googlecode.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 javascript-share.googlecode.com udp
US 8.8.8.8:53 drooid-today-script.googlecode.com udp
US 8.8.8.8:53 domassistant.googlecode.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 bdv.bidvertiser.com udp
FR 216.58.214.169:445 www.blogger.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
US 54.241.51.109:80 bdv.bidvertiser.com tcp
US 54.241.51.109:80 bdv.bidvertiser.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 109.51.241.54.in-addr.arpa udp
US 8.8.8.8:53 169.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 82.102.250.142.in-addr.arpa udp
FR 216.58.214.169:443 www.blogger.com udp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
US 8.8.8.8:53 www.google.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 172.217.20.164:80 www.google.com tcp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
US 8.8.8.8:53 resources.blogblog.com udp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
US 8.8.8.8:53 xslt.alexa.com udp
FR 216.58.214.169:139 resources.blogblog.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 164.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 195.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
NL 142.250.102.82:80 domassistant.googlecode.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.214.169:80 resources.blogblog.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 bdv.bidvertiser.com udp
US 54.241.51.109:445 bdv.bidvertiser.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 www.facebook.com udp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
GB 163.70.151.35:80 www.facebook.com tcp
GB 163.70.151.35:80 www.facebook.com tcp
US 8.8.8.8:53 images.dmca.com udp
US 8.8.8.8:53 stats.topofblogs.com udp
US 8.8.8.8:53 www.blogtoplist.com udp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 i1259.photobucket.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 img846.imageshack.us udp
GB 143.244.38.136:80 images.dmca.com tcp
FR 142.250.179.110:80 www.google-analytics.com tcp
FR 3.165.113.116:80 i1259.photobucket.com tcp
DE 168.119.245.137:80 stats.topofblogs.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
US 38.99.77.16:80 img846.imageshack.us tcp
GB 163.70.151.35:443 www.facebook.com tcp
FR 3.165.113.116:443 i1259.photobucket.com tcp
US 38.99.77.16:80 img846.imageshack.us tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 65.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 33.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 110.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 136.38.244.143.in-addr.arpa udp
US 8.8.8.8:53 116.113.165.3.in-addr.arpa udp
US 8.8.8.8:53 16.77.99.38.in-addr.arpa udp
US 8.8.8.8:53 137.245.119.168.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 i50.tinypic.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 s10.histats.com udp
FR 142.250.179.99:443 ssl.gstatic.com tcp
US 104.20.2.69:80 s10.histats.com tcp
US 8.8.8.8:53 s4.histats.com udp
US 8.8.8.8:53 world.popadscdn.net udp
CA 149.56.240.132:443 s4.histats.com tcp
NL 190.2.139.23:80 world.popadscdn.net tcp
FR 172.217.20.164:443 www.google.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
US 8.8.8.8:53 world.popadscdn.net udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 17.201.222.52.in-addr.arpa udp
US 8.8.8.8:53 69.2.20.104.in-addr.arpa udp
US 8.8.8.8:53 99.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 23.139.2.190.in-addr.arpa udp
US 8.8.8.8:53 132.240.56.149.in-addr.arpa udp
FR 216.58.214.169:443 resources.blogblog.com udp
NL 190.2.139.23:445 world.popadscdn.net tcp
N/A 224.0.0.251:5353 udp
US 54.241.51.109:139 bdv.bidvertiser.com tcp
NL 190.2.139.23:139 world.popadscdn.net tcp
US 104.20.2.69:443 s10.histats.com tcp
US 8.8.8.8:53 statinside.com udp
US 104.21.57.149:443 statinside.com tcp
US 8.8.8.8:53 149.57.21.104.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 e.dtscout.com udp
US 141.101.120.11:445 e.dtscout.com tcp
US 141.101.120.10:445 e.dtscout.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 e.dtscout.com udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
FR 216.58.214.169:443 resources.blogblog.com udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

\??\pipe\LOCAL\crashpad_3780_SAJWYQSTNAOXSUOX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d257cb6634e22ec7ddc09a43d4ef3cfc
SHA1 590be50b838bd3909a30bacd744d777369c0afd9
SHA256 abb145555f597c2a835d21aa67e2e4bb7eeb30ae4a581df49a2a35ec8b71108c
SHA512 3e0c8a4ccb20a009242dafaac00d5f91e37c063612abf9e52132de2d80cff32b4ad79b2c11e4b7d01259f08cb0117282b9ddee0fe8a4a36d4c0f9bc41fde5401

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 96e7934435e02d7e73f46b829c3fc96e
SHA1 07c9a60b162229037c754cd6a2e8768bb8460e2b
SHA256 4d5afd4b5ad85371d5e4f4110434371ff9e90ff1f0c21489e373c205b7682b97
SHA512 1753d731eb73a2e28f57695664e15b81e13f22e6eceb29c7e53d4b0a7d6eefb74a05526a47378557409eed7503a6f67a7cd97585e9e29176ff8261a498ad257b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 fe34818e84c2ecd791d5688626430808
SHA1 7835600f930b13371a6e207235c73fd9c2557879
SHA256 7c58138d353bf8be624af93d121b6c36248c52832241ff1ceca54b31b5c422de
SHA512 f9686a362200e20596fb78f412a0f286fa5cddb96bb6cef7b73c4df784eaec1668222ed481d8e1070422ebc506349f1953e48cf20a04429c08ed86f182bca31c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 83b96266a89b77900170e79672140769
SHA1 09c264b7aa491594876863c8c1d44e04327621f6
SHA256 9749a14e0ad75a687ee6221bd1fcfe831c84e998059e8f4c748a3a1e9490f61d
SHA512 b71881e8164e72a7ff34c879d6c537f8a1f77e5ac27efda04783b82b28c4f9c4c83d4219275ac6c141f22405150cbde84841c6e057415d3b3c7e450242f502f8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5896fb.TMP

MD5 5b4a5026df2a3a091eef33eded09e0bb
SHA1 32c2b9f149da86f73d7df21a59abe136247def4b
SHA256 7cd758e5d35b3cc862616cc83514e45a99ae86c07119a76532c744f764a80cd2
SHA512 2373faca05925001f5dd51ee9cabb564836d4c70bfc3007d406b030a4468e26e8400e5b0cf77614a9a058ec123d38a8bb03c0403cbb80cc8b21c660d61b2cd41

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 caab6d4a0ec85fd2ea8b81c4f7a62c2b
SHA1 73c71329c2f07bcd2a6ec0341ab579581e4f3fb8
SHA256 49762dcca7b1ad9f20dba21faaaee4fdd2859bca7ee2dd6cf868460c47d85eb2
SHA512 60deddc5e6569f0999c2a0b2de00a27cc6fe9bd1282c7d8caa6d039e9b7e88269b62ad667d4d9968a0347ac687bb4e2cf9abb4cea517c2b07a48d17703c833e9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 1fd781492eb3d0e3d33733bc3e7be269
SHA1 5e4faece5050ec71f591c197c98fe67cd61df0fd
SHA256 4f6538da92a40644a72f3428540b44c033f0df978723376410425ef69b7faea7
SHA512 fbc28745f50fc4825257481214345961c1cb8791b585c6c1f4fe99b48a9563c23b3ddbce3e2a061c960fee4a7eb347de879d4c2e888048125e86a3aa7054b6ce