Analysis Overview
SHA256
392c7b2e863988b135d852c3b50a2b299de1a93a266ed874ad4186bbf7f9c711
Threat Level: Known bad
The file JaffaCakes118_4fda3c9b5bdd02c2d6d19af359c370e7 was found to be: Known bad.
Malicious Activity Summary
SocGholish
Socgholish family
System Location Discovery: System Language Discovery
Browser Information Discovery
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-01 09:30
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-01 09:30
Reported
2025-01-01 09:33
Platform
win7-20241023-en
Max time kernel
146s
Max time network
147s
Command Line
Signatures
SocGholish
Socgholish family
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf000000000200000000001066000000010000200000009fb83e95ce5e575c1126f43b69e30843ed1635406aac87010f5f869e47a6a13d000000000e8000000002000020000000f30dc9a6479d489d77bf858a7dd3d75442f3e036c992884191138a693bbf555c90000000be7d13ab107301f03e7e2453c068259bc849135631b36d7c6ef3a5de15507bc9502c87f012f6b206718edcdf8443175c7c41bde65d2e20ef7b4297b635f9547934768da5edd4b9a67c92e12091f007cd30cadd4ee1c7a6c429f0b40e3e3cae6414c218b97c7880faac24e10e1428e8aaaf6713b921501e0b72d309a99bca9ad77dc6ea499f05f51d8004f0a7f40590b3400000001711e0a9bacbe98827a223c3331fbbd92d14754dfe5d763280a5194bc9a92f55f8385b181407840bb22ad2d5f59320b693e9f1baf9a12d375fcedaa8fa7664b8 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf000000000200000000001066000000010000200000007d8189c46e1ec94c44fcd911062b624ff2ff14f32b6c40f3c2de26dcaf02146a000000000e8000000002000020000000128912f94b7469d2a761bec381d73c1be20a0e40f412adaf9e2da8727a569de520000000763a094538452aa441e2ed6e553c740e9d33813d631b589392fbb607f94cec3640000000257c1f8397037a688727f3db52ac6966103e38f6dc5904f7a26022f2da32fa72e17b55739e8786d5564bb5259a7c389c56452b9c18ffb2b81826b9473b804560 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441885715" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1466F121-C823-11EF-8FB4-EA56C6EC12E8} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400094f42f5cdb01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2764 wrote to memory of 2792 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2764 wrote to memory of 2792 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2764 wrote to memory of 2792 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2764 wrote to memory of 2792 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fda3c9b5bdd02c2d6d19af359c370e7.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | googledrive.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | www.lovelybooks.de | udp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.214.169:443 | www.blogger.com | tcp |
| FR | 216.58.214.169:443 | www.blogger.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| FR | 142.250.179.97:443 | googledrive.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| FR | 216.58.214.169:443 | www.blogger.com | tcp |
| FR | 142.250.179.97:443 | googledrive.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| DE | 195.160.160.89:80 | www.lovelybooks.de | tcp |
| DE | 195.160.160.89:80 | www.lovelybooks.de | tcp |
| DE | 195.160.160.89:443 | www.lovelybooks.de | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | r11.o.lencr.org | udp |
| GB | 88.221.134.137:80 | r11.o.lencr.org | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| US | 8.8.8.8:53 | maxcdn.bootstrapcdn.com | udp |
| FR | 216.58.214.169:443 | www.blogger.com | tcp |
| US | 104.18.11.207:80 | maxcdn.bootstrapcdn.com | tcp |
| US | 104.18.11.207:80 | maxcdn.bootstrapcdn.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | w.blog-connect.com | udp |
| US | 8.8.8.8:53 | snapwidget.com | udp |
| US | 8.8.8.8:53 | booklikes.com | udp |
| US | 8.8.8.8:53 | cdn.abowman.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | www.shabbyblogs.com | udp |
| US | 104.26.8.123:80 | snapwidget.com | tcp |
| US | 104.26.8.123:80 | snapwidget.com | tcp |
| US | 104.21.69.222:80 | booklikes.com | tcp |
| US | 104.21.69.222:80 | booklikes.com | tcp |
| FR | 172.217.20.170:80 | ajax.googleapis.com | tcp |
| FR | 172.217.20.170:80 | ajax.googleapis.com | tcp |
| US | 172.67.133.250:80 | cdn.abowman.com | tcp |
| US | 172.67.133.250:80 | cdn.abowman.com | tcp |
| US | 192.155.91.172:80 | www.shabbyblogs.com | tcp |
| US | 192.155.91.172:80 | www.shabbyblogs.com | tcp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| US | 104.26.8.123:443 | snapwidget.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | ssl.gstatic.com | udp |
| FR | 142.250.179.99:443 | ssl.gstatic.com | tcp |
| FR | 142.250.179.99:443 | ssl.gstatic.com | tcp |
| US | 104.26.8.123:443 | snapwidget.com | tcp |
| US | 104.26.8.123:443 | snapwidget.com | tcp |
| US | 104.26.8.123:443 | snapwidget.com | tcp |
| US | 8.8.8.8:53 | static.cloudflareinsights.com | udp |
| US | 104.16.80.73:443 | static.cloudflareinsights.com | tcp |
| US | 104.16.80.73:443 | static.cloudflareinsights.com | tcp |
| US | 192.155.91.172:80 | www.shabbyblogs.com | tcp |
| US | 192.155.91.172:80 | www.shabbyblogs.com | tcp |
| US | 104.21.69.222:80 | booklikes.com | tcp |
| US | 8.8.8.8:53 | bookjunkies-rezi.blogspot.com | udp |
| US | 8.8.8.8:53 | booksandsenses.blogspot.com | udp |
| US | 8.8.8.8:53 | booktastic-world.blogspot.com | udp |
| US | 8.8.8.8:53 | bowsandbooks.de | udp |
| US | 8.8.8.8:53 | buechersuechtiges-herz.blogspot.com | udp |
| US | 8.8.8.8:53 | durchgelesen.com | udp |
| US | 8.8.8.8:53 | www.damarisliest.de | udp |
| US | 8.8.8.8:53 | www.favolas-lesestoff.ch | udp |
| US | 8.8.8.8:53 | www.hisandherbooks.de | udp |
| US | 8.8.8.8:53 | ich-liebe-fantasybuecher.blogspot.com | udp |
| US | 8.8.8.8:53 | katja-welt-book.blogspot.com | udp |
| US | 8.8.8.8:53 | inflagrantibooks.blogspot.com | udp |
| US | 8.8.8.8:53 | lenaliest.de | udp |
| US | 8.8.8.8:53 | lenabosblog.de | udp |
| US | 8.8.8.8:53 | lesefee.blogspot.com | udp |
| US | 8.8.8.8:53 | www.leselurch.de | udp |
| US | 8.8.8.8:53 | levenyasbuchzeit.blogspot.com | udp |
| US | 8.8.8.8:53 | lielan-reads.blogspot.com | udp |
| US | 8.8.8.8:53 | maaraavillosa.blogspot.com | udp |
| US | 8.8.8.8:53 | michasbuechertraeume.blogspot.com | udp |
| US | 8.8.8.8:53 | www.mybooksparadise.de | udp |
| US | 8.8.8.8:53 | bookaholici.blogspot.com | udp |
| US | 8.8.8.8:53 | sharonsbuecher.blogspot.com | udp |
| US | 8.8.8.8:53 | www.sheerisansbuecheruniversum.de | udp |
| US | 8.8.8.8:53 | spoilerparadies.blogspot.com | udp |
| US | 8.8.8.8:53 | scherbenmond.blogspot.com | udp |
| US | 8.8.8.8:53 | blog4aleshanee.blogspot.com | udp |
| US | 8.8.8.8:53 | wonderworld-of-books-from-hannah.blogspot.com | udp |
| US | 8.8.8.8:53 | buchgedanken.blogspot.com | udp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| DE | 109.237.134.8:80 | lenaliest.de | tcp |
| DE | 109.237.134.8:80 | lenaliest.de | tcp |
| DE | 64.190.63.222:80 | bowsandbooks.de | tcp |
| DE | 64.190.63.222:80 | bowsandbooks.de | tcp |
| DE | 195.30.85.220:80 | www.leselurch.de | tcp |
| DE | 195.30.85.220:80 | www.leselurch.de | tcp |
| DE | 172.104.149.86:80 | www.sheerisansbuecheruniversum.de | tcp |
| DE | 172.104.149.86:80 | www.sheerisansbuecheruniversum.de | tcp |
| FR | 172.217.20.179:80 | www.favolas-lesestoff.ch | tcp |
| FR | 172.217.20.179:80 | www.favolas-lesestoff.ch | tcp |
| DE | 85.13.164.33:80 | www.damarisliest.de | tcp |
| DE | 85.13.164.33:80 | www.damarisliest.de | tcp |
| DE | 85.13.147.197:80 | www.hisandherbooks.de | tcp |
| DE | 85.13.147.197:80 | www.hisandherbooks.de | tcp |
| US | 8.8.8.8:53 | was-kostet.net | udp |
| DE | 85.13.147.197:443 | www.hisandherbooks.de | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 172.217.20.179:443 | www.favolas-lesestoff.ch | tcp |
| DE | 85.13.162.62:443 | was-kostet.net | tcp |
| DE | 85.13.162.62:443 | was-kostet.net | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:443 | buchgedanken.blogspot.com | tcp |
| DE | 85.13.147.197:443 | www.hisandherbooks.de | tcp |
| DE | 85.13.162.62:443 | was-kostet.net | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| DE | 85.13.147.197:443 | www.hisandherbooks.de | tcp |
| DE | 85.13.162.62:443 | was-kostet.net | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| DE | 85.13.147.197:443 | www.hisandherbooks.de | tcp |
| DE | 85.13.162.62:443 | was-kostet.net | tcp |
| DE | 85.13.162.62:443 | was-kostet.net | tcp |
| DE | 85.13.162.62:443 | was-kostet.net | tcp |
| DE | 85.13.162.62:443 | was-kostet.net | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 88.221.134.146:80 | crl.microsoft.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 392b7cb419b91ef273b4b85bc12ceb47 |
| SHA1 | 7f1f5dc5fa575a204bd007bb796465eecf654a47 |
| SHA256 | 83efce1919aeae1d2c9b916a967aaa234187dce1c0635279bce646b2df018970 |
| SHA512 | af8a1025a60e6e63a4595209d16a45acf7a599cd911c430d3ee35b4bc7e819993189bca0ea8343654e5799d80bea06b07f76f6d665e5c613365993edbda1f7b3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 2770ced3aae4c7bc04ff84025141ca70 |
| SHA1 | 29f20ad0cddb0822b52447c3ee9e1252965810d9 |
| SHA256 | 81f092361e5ee8232689dfd94cee407d95bd2374937411ce0bc4760c2c8c4fee |
| SHA512 | 1ca3ad8e421c4ebc4655cc63187145b9c9e336cf5051ae2dd6f9939bb1aef1f3835b64a9e5b7c8c4e115b7b1a09ab8c32a7adedafde1510a2097085768f3c50d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | e672700abbdf0232be24aeff88d0b182 |
| SHA1 | b835e61892f297465a0be1787f2b18037af80df9 |
| SHA256 | 9ab517a780fe9cc82156e95d82bd82705c63e27f320d240b6237f252a888fbcb |
| SHA512 | b0a507760f9a53a90f9542b9dc002c7bf4c82e5ee0aed4a0f568a626da9002a97fa6e24bf973424988f2aa03c0590a31eb35a2630ea353c49ba4ee7390fb0a47 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
| MD5 | e935bc5762068caf3e24a2683b1b8a88 |
| SHA1 | 82b70eb774c0756837fe8d7acbfeec05ecbf5463 |
| SHA256 | a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d |
| SHA512 | bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
| MD5 | 5f08ad7a688023d7a4bb9e2999b9e9ac |
| SHA1 | 9e096fd6d9546e0a82238050ec7f0487b7334fbd |
| SHA256 | a9ff6399b28fe3f087d3897e93ea35055f63cff07d686fe2967403910a35007f |
| SHA512 | a42cb5d9cac5c6f6fe09ac7cb4ac5ac295f93bc215d7f8d09fbc6547dd24206171a2200c31b89c2eeafe8ef1680089470eec70dcdbc76ed8db30b5a7a6848ff4 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6J4GCMD\cb=gapi[2].js
| MD5 | b103bb58d9e7cecaa60bdf377d328918 |
| SHA1 | 0f094c307bceef833a64f408d2f749a10f79de44 |
| SHA256 | 81dcd274347bd909cf132d3c8bcc9924e41921c33eca07fd6fe5e2a59ca4f5b7 |
| SHA512 | b1a4fa329b76df7c861771e1dc36749155895dff623cd916811f2af8c95f3bcf9fe75a3b9a56833f066a227444982ff4883459e24f7eead79b521c2ffdcaa844 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_191023D640896A0CAAB6B353590277DC
| MD5 | 90958a8933537034a0ec934a8ecf7dcd |
| SHA1 | 6f185b8d7c2ec0041b22332ce456e0312d4e9fbb |
| SHA256 | fdcf82ec8f0e5c32bd6bc0b5ac31e4d1e91fb2b84c226750b78ee1778314fc47 |
| SHA512 | 05dbffd2a8f435bec62ce25748727796b045ad93e774c816ce376b6bb9923f43525377cf4dec27d65383f3d1d4be524a73783c5105cd4917dc57c129c0019b9e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_191023D640896A0CAAB6B353590277DC
| MD5 | 7e1f96cc33ac11c86f5a56f5de6727a5 |
| SHA1 | 957fc6dde662f3293d62ce78a22a58f063b0533f |
| SHA256 | 43012d8c16002725c4a69edd96f850c70464756ffeee482dde4c6e2da5d6011b |
| SHA512 | bb2004b37280e2a114c90958c03870bcc58dd4309266ba730727475029a38c0c5301c2ec0b1571bcd270517d6cd01d3973c00c0b1e7a57b53301ee32eac2e34b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_191023D640896A0CAAB6B353590277DC
| MD5 | 3405098cbc603d5f473ec0c36a14166c |
| SHA1 | 1572c6a56b9e43d26e3403d0bdb70f523476f58c |
| SHA256 | efb66750a4f90cc5dc31cfd82e58ccd628497494466b85f8237a0e6983d2c061 |
| SHA512 | d3d67a30db575cf81288ec7cc15c4e73c51a21718c39bf1b6323eb85550abe0a37bbf41a953f9ea173608ae760e5527e28831d23333acb60018f664e8a0e3179 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a29649e12408f1f7aa548dda72cdca44 |
| SHA1 | 670c8f2f77d7e8b4a92c7876e6af28d30159ba5e |
| SHA256 | 49940c424f6077004d938669122fe77d2dc1876d1cb194b210376abe6992f02e |
| SHA512 | 7c3e0231f1d64746df2376420ac8763bd92e7568175601a4e34dc5f1c3d42e31c28b0b9046c1fd314cee3a1d6b48d16cc22173861462e0efb2154b8a47963ae5 |
C:\Users\Admin\AppData\Local\Temp\Tar9D3D.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\Local\Temp\Cab9D3A.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 39aa9949e0de378daea6546db7ec7433 |
| SHA1 | 6fc6b9851c2bcd00ef0bd405ad47a911956af233 |
| SHA256 | b56ae4782af186b75822984c9535bdc2c993b0ad98ce63c823d8525833999523 |
| SHA512 | 97e7c73adc8f58f534d36c095a931206035d6d085c9dc6853fcd128961cd50fa59cb3f4e8f513c4b72325b82758a9f870d8b4bcbe2e4bda735a831473c2247fd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ec422a8b74baeee137290f951f499c15 |
| SHA1 | 3760f2f93faff12191f9465f44292451a415b793 |
| SHA256 | 6b1c21ffcac91ad49ccd5cc960fb52477e797c3383e1cefd9baf6441ccb6cb90 |
| SHA512 | 1a56085b82323950b937f6deae5fc821fa5b9c57ab7769dffa0ba0e08a4c04ec9b9765d128a3ce65a84a8456a61b3e304de13eb4c399216bc8733a788775a7db |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 96941bb47b13ff406361f20683c83f7e |
| SHA1 | ba2a3baa4f00f4f9b91d05dc589fba60989dd4e2 |
| SHA256 | ba57448c5cb90bb410edb3d94ff76d40299de51ff4efab9350eed5c6046c533b |
| SHA512 | 6b26bbb525fef2d36265083547b86e4afc6681ed3729ad5e3a0fbe89601127be1e1b4c7c4a01dad509506921e9beeb4083aa8ceaa7fc6899e40f0e0efc5bd395 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cb0dc22d19a509e2bd54c10d14139eec |
| SHA1 | f1f6f82e5a28c8c1078e29269603459ffcc95b6e |
| SHA256 | ad39b70d4111b507ed65e5b7536717d60dd7c822eb1b317614a324c0ce2ae39b |
| SHA512 | 9b3202ca79ec2f1eaeae7013950cd5a5738191a4fead1f6a30dc7457b5c2a8d4dd5dd402251162d0ff907932879a3acc0488c6b21a97ab948451b57983e78f47 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f82b15177bef5426bb216de7ca5c7e0b |
| SHA1 | 98ec6bb57d6a0b2b07d852af9b57d4a6ec83b427 |
| SHA256 | 7ba1bc70d7e8a189ba2e92c4d9a238aa271364dade494905da663db512b6965b |
| SHA512 | 18d55964d7ef1a4f26717ed7a2d2068ed097c5f3feb2290464aeadce0a08058537c2f3b41aacca9c622c50f310845664c1bcf57d87d688857634562c220c55ae |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 82d9fb436f12f3744b61127746d2b672 |
| SHA1 | ed56f3ced03a08b7f18e29c1547b76b79b9113d7 |
| SHA256 | 8e273f425c4f4056deacb77ec594b209972f27464aa6449c9d2c1ba45cbae81b |
| SHA512 | 6a6394ee1fb8d2b98e18533b6b4a31e6ed3e94651e685b8238c2694fffc819987b23f3f491bf1ba13ea2e22efd5b0dadfa3f1e4b876a78c0e9d5fdf644a75dcc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bdba9bf3cd18c3859f6c10a324c7bd23 |
| SHA1 | b191360bd3005c3e2df08c1880794102f8e0e255 |
| SHA256 | 3c3232ccc9f6016cb82717204254a25fb8195ba1a68db6ec43e4abbf02c757f5 |
| SHA512 | 5b2fae1143686cd411d6f1666b2d91dff5332c13f66e0313dca557a7fedf41de731043dbcea73c657a760725ba281778cfd92124dfe5bef2620ec1d28c3d437a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3d6601e81528ee5942d4b77aac065a6a |
| SHA1 | ee33472bc4d82fce1838ae17c064795d6c17a55a |
| SHA256 | 145609a96dc7e36ff697e677e82f5a81e385dfba40b7e92ecc2869d48eef5bec |
| SHA512 | 3ff87c0bec848cbc0b9ac0e0df58e9d59434d792b1566f624bdfa36735a7079f68655430fc82621758b69cb5f189db8b0700285112840d8ff8c618efa47bde0f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 25cffb81ccd9a3fbd36bb0dbb3278e01 |
| SHA1 | 50bc970ef6e651b4104aceb530bb688d28aff595 |
| SHA256 | 76f9434bde07450da87461907ffb37ca1bdcf65e2edfedfe14dbf2089eb06c58 |
| SHA512 | 1f9f2f713c5c1669d68b851f9666d7f8e70144daf7cb29db08de54b25235c388c300c500960ac70cad691b62860b010e8f87669b03ad3e60c13c91f091158132 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 801bbc6f2be48ed87eb862faa96d57f9 |
| SHA1 | d1e361c8f7b23384b13b4ba23a56ef9c9c4c754f |
| SHA256 | 605bb869ec22accb40ab5cafb0e5b14120e1b75ebbf6ffa458ec06c0f992be61 |
| SHA512 | 6bdecefea5029a7358962ac88286daede2c1e59e48bdd821b6d8dcebd61fce7f0261c9e5391f0e602692a38f1fb3196141aa80530af1719f21b28d3fff861eb4 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\2254111616-postmessagerelay[1].js
| MD5 | c264799bac4a96a4cd63eb09f0476a74 |
| SHA1 | d8a1077bf625dac9611a37bfb4e6c0cd07978f4c |
| SHA256 | 17dce4003e6a3d958bb8307bffa9c195694881f549943a7bdb2769b082f9326d |
| SHA512 | 6acd83dfd3db93f1f999d524b8828b64c8c0731567c3c0b8a77c6ddcf03d0e74ee20d23171e6ceac0c9f099dce03f8e5d68e78c374da2c055973f6ac2db4e4f9 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6J4GCMD\rpc_shindig_random[1].js
| MD5 | 25879c1792060210aabb2cc664498542 |
| SHA1 | 349848a5e88088b22fb4762ca2a619d1a7f40d97 |
| SHA256 | 1c0dff80b0111b04f387f0c39fe8d199e909c285f5471da80d6da78c79f9fc79 |
| SHA512 | 845cb435d102d39b001e7f00d7528dbc3f8505809f5fbca039587ed82d9790b16c9179de8877fd48f2fdab11e7308ad003303821217213a2b99e60d9915a9c88 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 46d1929b39515ef56c1a7a2b4670500b |
| SHA1 | 498639f7aa06d0b555f76d8667b7d502b6a4ef86 |
| SHA256 | 96d0466e24d24de5d5fa8aa9cc81c722d00c29d6a7ef5a4d5e6562dc85f8f709 |
| SHA512 | 3a906881136287155ce0c14abcf36f3a4b79c856c588ef03f4840e8768dc312ce9c0769d6996b22eabd987185b90141099da6b142330cb2b4d977cecac84fea6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | afae92b4257d0e86447d78e0312afa17 |
| SHA1 | 3aaf1bb5e30834ed727206be1cdec20f4a567e24 |
| SHA256 | 49d620b002b0b27cb64ca3de57c130c0e70bf7c374825eff0ee17977e4d7ab46 |
| SHA512 | 6333950a0141666591ab6d5744368423733e85224ba94f713e330e002e24082a8b9f5daf33c7f723afcd8f99d837d27518cb2dc43192cbe874f653efe95e6d6f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | d9abc981273ba0980ec456438d2035d8 |
| SHA1 | acd83191371b0a5aff61320ed24fad305b5b19c1 |
| SHA256 | 48162d120666daf27db0662bf07ceda3fbefc4eb0166888358aa58ec837205f3 |
| SHA512 | 54f58e2bc96a50a4a4fd35966a43c7361c085967234dd99ff90783e3ff3a44a746b7d434ab36c2b863c88ef7b2da0d6c1d5edb0b57684b28cc230235cce0ce7c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | af0ec034de5c846c3eab86a235dd2abc |
| SHA1 | 19c8f68541640d23ea47c709cc08a1f39ba4ecb8 |
| SHA256 | fc510439428d0eab766ada4eafb21e37cc6eb652496ef88672f3745ff41b0e2b |
| SHA512 | 1d8156448ec94be1d989596365b0859bb22416d6606af69fee526fa95d2704997252c7c59e6cd81ac8072957c1636131986f2deaa61373ec0a08f895b6327cd5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ea268e3d09c446d7d8df1b6f913fd292 |
| SHA1 | 86b17e92cddcca71e72c5ac18a6a55b6d5b9f82c |
| SHA256 | aea644125f07441cc7ea7afe4bfb11b943ef2fc4d53abe00e351c8d882934553 |
| SHA512 | 8f556865c029ed15c504b9db2a78cc2c4bc3e488595f3606be7dea61ee1892823734bcc562b5713946c1344ccf495212863e506304dababfd0b1ad428fd46d28 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 35d5f0758d66911f5f4036ba5e738ac9 |
| SHA1 | 38eba1abbd78b8d99d0775f500cf1b66ef74ba01 |
| SHA256 | d685bfa565dae46bd73b2e2260609685029a5321f735269d4255d75c2fccd25d |
| SHA512 | e91e601da8994cc0bb32aed07c242d2ab27cc760f54dc34b4e4ec3c1d10a6b4e45a8d5ff32c40d96a7558b778738ef01b4a935a423c7c53d48d373b25386d556 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 68edeab8efb2dfe68d29861af4e2af19 |
| SHA1 | 63f43d8481b300f5c055c63e324c72bd26eb9b84 |
| SHA256 | 0a3013d8a9c66726e77c3847453e7b4b3eb0f443851adfc6d3e194f80c48db2e |
| SHA512 | 0f239e543589fe26bb7fb1a24a9b7c0cdbb198825915015b18f582c683cd4ae90a4c41f0ce2b716c98f6ab196835122f6b5b94628fcc32a3263f37bc59ab33a6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0b311fac7cfe7fcf1e59bf27c1c548bc |
| SHA1 | 1215d83c2fd5229cc37995029c90248ba3c46718 |
| SHA256 | 051cd7db1416b7573edddde1b28a04eab0573a9527a9e954374bee81c82ca22b |
| SHA512 | 742b7404738e4084d0b7b9e3c8dcd9ea5f900c1f3ca362b1e933216d6436fe7f4509d71e9e7bfcabc98e8f307c06f35452690870de9dbff16446f61a61dc1928 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 7fbc83a1cefe92a90a26e33c19735bb6 |
| SHA1 | 082d2450ffaf56d97a53ba493fe7e7e79357c35e |
| SHA256 | 0b8c4652bc0666f9d02fd9625b7f5308a0e43873852012b813137760e8ed03d7 |
| SHA512 | 13092bfc38028a434b20d2bedec9aa6f095bb9255992ac59a903d41a422ac5fc90d50144e92163a2dba949558a18ca7d80f2a850b96cde8f7f9886b875fee4f6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 291a1bf1ea68a82abf1c32b30975d77b |
| SHA1 | 5cd03dcc3da6bc5a1788fd6b04d7beaf8b1edde1 |
| SHA256 | 4443f970cd24b11cda2d648f5cad007b99bebadafb22949c6768aa40972471d9 |
| SHA512 | 8652d349d42d5fa947ed16a875d0eeed1ca674fb350e477234bff9934a592346423197260afd54e9ff1398c2e0b79eb04675bc8f34332f039c28dc1efb36a29f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 30db003f5334aacce0c4a607803160e8 |
| SHA1 | 1044f38b8d73f453488130c013e0dee93c3aa3bc |
| SHA256 | 833281681f8ec655e1bbb4512d172f8420364efc34ce75a02acd7356678c8716 |
| SHA512 | 0179f62a13b7a52df1eaff350b7b5e41ab9b2eb34819ad34ecd290f182b7a4163ac44c6140d97e9d0c0d76c6ab3735ef1ebb4c027500629b9b29ec560b126481 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | eabc8ec0ee4109f3ae76ed857ee606c9 |
| SHA1 | e870f589782ef2fdef5913502514688c641bad83 |
| SHA256 | 148d298c5dcce0daa9fd30c9ecf09c991651d65e6d8c3586d6979ef1ee0c05dd |
| SHA512 | 9bfa5d82320c22f899770068065113dd48ca618b53fa99bb128b422ef8b349874abf33bcd2522d408d5bb0dd08e12387ae1a88efab24af41d103e23e4af0094d |
Analysis: behavioral2
Detonation Overview
Submitted
2025-01-01 09:30
Reported
2025-01-01 09:33
Platform
win10v2004-20241007-en
Max time kernel
145s
Max time network
148s
Command Line
Signatures
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fda3c9b5bdd02c2d6d19af359c370e7.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81e1e46f8,0x7ff81e1e4708,0x7ff81e1e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5952 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | img1.blogblog.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| FR | 216.58.214.169:445 | www.blogger.com | tcp |
| FR | 216.58.214.169:443 | www.blogger.com | tcp |
| FR | 216.58.214.169:443 | www.blogger.com | tcp |
| US | 8.8.8.8:53 | googledrive.com | udp |
| FR | 142.250.179.97:443 | googledrive.com | tcp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| FR | 216.58.214.169:443 | www.blogger.com | udp |
| US | 8.8.8.8:53 | www.lovelybooks.de | udp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| DE | 195.160.160.89:80 | www.lovelybooks.de | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| DE | 195.160.160.89:443 | www.lovelybooks.de | tcp |
| US | 8.8.8.8:53 | maxcdn.bootstrapcdn.com | udp |
| FR | 142.250.179.78:443 | apis.google.com | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.214.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.215.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.160.160.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.179.139.118.in-addr.arpa | udp |
| US | 104.18.10.207:80 | maxcdn.bootstrapcdn.com | tcp |
| US | 8.8.8.8:53 | w.blog-connect.com | udp |
| US | 104.18.10.207:80 | maxcdn.bootstrapcdn.com | tcp |
| US | 8.8.8.8:53 | developers.google.com | udp |
| FR | 142.250.178.142:80 | developers.google.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | snapwidget.com | udp |
| US | 8.8.8.8:53 | booklikes.com | udp |
| US | 104.26.9.123:80 | snapwidget.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| FR | 142.250.178.142:443 | developers.google.com | tcp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| US | 172.67.213.133:80 | booklikes.com | tcp |
| US | 172.67.213.133:80 | booklikes.com | tcp |
| US | 8.8.8.8:53 | ssl.gstatic.com | udp |
| US | 104.26.9.123:443 | snapwidget.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | img1.blogblog.com | udp |
| FR | 216.58.215.33:80 | 2.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| FR | 142.250.179.99:443 | ssl.gstatic.com | tcp |
| FR | 142.250.179.74:80 | ajax.googleapis.com | tcp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | www.shabbyblogs.com | udp |
| FR | 216.58.215.33:80 | 3.bp.blogspot.com | tcp |
| FR | 216.58.214.169:139 | img1.blogblog.com | tcp |
| US | 192.155.91.172:80 | www.shabbyblogs.com | tcp |
| US | 192.155.91.172:80 | www.shabbyblogs.com | tcp |
| US | 192.155.91.172:80 | www.shabbyblogs.com | tcp |
| US | 8.8.8.8:53 | static.cloudflareinsights.com | udp |
| US | 104.16.79.73:443 | static.cloudflareinsights.com | tcp |
| US | 8.8.8.8:53 | 207.10.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.27.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 123.9.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.213.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.79.16.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| FR | 142.250.179.78:443 | apis.google.com | udp |
| FR | 142.250.179.99:443 | ssl.gstatic.com | udp |
| FR | 142.250.179.65:443 | lh3.googleusercontent.com | tcp |
| FR | 142.250.178.142:443 | developers.google.com | udp |
| US | 8.8.8.8:53 | 168.201.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 65.179.250.142.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | oceanlover.booklikes.com | udp |
| US | 172.67.213.133:80 | booklikes.com | tcp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | img2.blogblog.com | udp |
| US | 8.8.8.8:53 | img2.blogblog.com | udp |
| FR | 216.58.214.169:445 | img2.blogblog.com | tcp |
| FR | 216.58.214.169:139 | img2.blogblog.com | tcp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | play.google.com | udp |
| FR | 216.58.214.174:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | 174.214.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| FR | 142.250.179.74:445 | ajax.googleapis.com | tcp |
| FR | 142.250.179.74:139 | ajax.googleapis.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.blogblog.com | udp |
| FR | 216.58.214.169:445 | www.blogblog.com | tcp |
| US | 8.8.8.8:53 | www.blogblog.com | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| FR | 216.58.214.169:443 | www.blogblog.com | udp |
| US | 8.8.8.8:53 | bookjunkies-rezi.blogspot.com | udp |
| US | 8.8.8.8:53 | booktastic-world.blogspot.com | udp |
| US | 8.8.8.8:53 | booksandsenses.blogspot.com | udp |
| US | 8.8.8.8:53 | bowsandbooks.de | udp |
| US | 8.8.8.8:53 | www.damarisliest.de | udp |
| US | 8.8.8.8:53 | www.favolas-lesestoff.ch | udp |
| US | 8.8.8.8:53 | durchgelesen.com | udp |
| US | 8.8.8.8:53 | ich-liebe-fantasybuecher.blogspot.com | udp |
| US | 8.8.8.8:53 | www.hisandherbooks.de | udp |
| US | 8.8.8.8:53 | buechersuechtiges-herz.blogspot.com | udp |
| US | 8.8.8.8:53 | marys-buecherwelten.blogspot.co.uk | udp |
| FR | 216.58.213.65:80 | marys-buecherwelten.blogspot.co.uk | tcp |
| FR | 216.58.213.65:80 | marys-buecherwelten.blogspot.co.uk | tcp |
| DE | 85.13.164.33:80 | www.damarisliest.de | tcp |
| FR | 172.217.20.179:80 | www.favolas-lesestoff.ch | tcp |
| DE | 85.13.147.197:80 | www.hisandherbooks.de | tcp |
| FR | 216.58.213.65:80 | marys-buecherwelten.blogspot.co.uk | tcp |
| US | 8.8.8.8:53 | inflagrantibooks.blogspot.com | udp |
| FR | 216.58.213.65:80 | inflagrantibooks.blogspot.com | tcp |
| FR | 216.58.213.65:80 | inflagrantibooks.blogspot.com | tcp |
| FR | 216.58.213.65:80 | inflagrantibooks.blogspot.com | tcp |
| DE | 64.190.63.222:80 | bowsandbooks.de | tcp |
| FR | 216.58.213.65:80 | inflagrantibooks.blogspot.com | tcp |
| DE | 85.13.147.197:443 | www.hisandherbooks.de | tcp |
| US | 8.8.8.8:53 | was-kostet.net | udp |
| US | 8.8.8.8:53 | katja-welt-book.blogspot.com | udp |
| FR | 216.58.213.65:80 | katja-welt-book.blogspot.com | tcp |
| US | 8.8.8.8:53 | lenaliest.de | udp |
| US | 8.8.8.8:53 | marys-buecherwelten.blogspot.com | udp |
| FR | 216.58.213.65:443 | marys-buecherwelten.blogspot.com | tcp |
| DE | 85.13.162.62:443 | was-kostet.net | tcp |
| FR | 216.58.213.65:443 | marys-buecherwelten.blogspot.com | tcp |
| US | 8.8.8.8:53 | lenabosblog.de | udp |
| US | 8.8.8.8:53 | lesefee.blogspot.com | udp |
| FR | 216.58.213.65:80 | lesefee.blogspot.com | tcp |
| FR | 172.217.20.179:443 | www.favolas-lesestoff.ch | tcp |
| DE | 109.237.134.8:80 | lenaliest.de | tcp |
| US | 8.8.8.8:53 | www.leselurch.de | udp |
| FR | 216.58.213.65:80 | lesefee.blogspot.com | tcp |
| US | 8.8.8.8:53 | stefaniehasse.de | udp |
| DE | 195.30.85.220:80 | www.leselurch.de | tcp |
| DE | 85.13.147.197:443 | stefaniehasse.de | tcp |
| US | 8.8.8.8:53 | levenyasbuchzeit.blogspot.com | udp |
| FR | 216.58.213.65:80 | levenyasbuchzeit.blogspot.com | tcp |
| US | 8.8.8.8:53 | lielan-reads.blogspot.com | udp |
| US | 8.8.8.8:53 | maaraavillosa.blogspot.com | udp |
| FR | 216.58.213.65:80 | maaraavillosa.blogspot.com | tcp |
| FR | 216.58.213.65:80 | maaraavillosa.blogspot.com | tcp |
| US | 8.8.8.8:53 | michasbuechertraeume.blogspot.com | udp |
| FR | 216.58.213.65:80 | michasbuechertraeume.blogspot.com | tcp |
| US | 8.8.8.8:53 | www.mybooksparadise.de | udp |
| US | 8.8.8.8:53 | bookaholici.blogspot.com | udp |
| US | 8.8.8.8:53 | sharonsbuecher.blogspot.com | udp |
| FR | 216.58.213.65:80 | sharonsbuecher.blogspot.com | tcp |
| FR | 216.58.213.65:80 | sharonsbuecher.blogspot.com | tcp |
| US | 8.8.8.8:53 | www.sheerisansbuecheruniversum.de | udp |
| DE | 172.104.251.198:80 | www.sheerisansbuecheruniversum.de | tcp |
| US | 8.8.8.8:53 | spoilerparadies.blogspot.com | udp |
| US | 8.8.8.8:53 | scherbenmond.blogspot.com | udp |
| FR | 216.58.213.65:80 | scherbenmond.blogspot.com | tcp |
| FR | 216.58.213.65:80 | scherbenmond.blogspot.com | tcp |
| US | 8.8.8.8:53 | blog4aleshanee.blogspot.com | udp |
| US | 8.8.8.8:53 | 65.213.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 179.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.164.13.85.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.147.13.85.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 222.63.190.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 62.162.13.85.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.134.237.109.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.251.104.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.85.30.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | wonderworld-of-books-from-hannah.blogspot.com | udp |
| FR | 216.58.213.65:80 | wonderworld-of-books-from-hannah.blogspot.com | tcp |
| US | 8.8.8.8:53 | buchgedanken.blogspot.com | udp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| FR | 216.58.213.65:80 | buchgedanken.blogspot.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | e443ee4336fcf13c698b8ab5f3c173d0 |
| SHA1 | 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a |
| SHA256 | 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b |
| SHA512 | cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd |
\??\pipe\LOCAL\crashpad_3636_JFJPWCIOQOGYSJJV
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 56a4f78e21616a6e19da57228569489b |
| SHA1 | 21bfabbfc294d5f2aa1da825c5590d760483bc76 |
| SHA256 | d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb |
| SHA512 | c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c8adb88fe998aeba5d5984a9e3e81226 |
| SHA1 | 9fb9b0b6e15721b7dd1af7952d6774681db5a7ba |
| SHA256 | a62b5e180c9d0409a7cdf44cc52eb363306ba682f73cace8c73d27b30a710755 |
| SHA512 | 90f1dd7dda5e1a43094a90c36a171bc13ac5a733d034311159e570444265d4ee27b7c6081a6e1304d51fd5b2e6928412a2248fe4ce0fc97fa562c5e64ce6310c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | b96c9d1dabf8a414b0f0bacc9cc8fd29 |
| SHA1 | 9d1df96954b98b10c915d4c3bb3b8241004303ad |
| SHA256 | 662da8758a7388c0b5f18e7ccd913ba76867ffd098574fc9f59b9d135fa87f8a |
| SHA512 | fcc10d8cf393bfa63e4ece78ab7ae5b29fa5b817e5c0abb46fbd9430154a0bdd46f96dacbfb2150a8b904503509e578afb71f87379e978fee66f84244e687e04 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | dbe85f32ec8962f1e3ddf90722841dd6 |
| SHA1 | e5ad2462249ecb179e19a36a761940f21dd72587 |
| SHA256 | b04892327befe77911e7e393541d0ce9d084ee047528270d067617e8e23157d1 |
| SHA512 | 2c17abc6ac475830c487b94af2eb92738ed4b0e9436e52721ce269a9f8cc78b6197298959a298815e0939e721a69682cca5e420424940763135989349c65fce4 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | d25941afb7a1a3562a334b5e4b6674bb |
| SHA1 | ba8b7587f284f6637c79fbfe74f241f9036f11d7 |
| SHA256 | 31714cbb6c60e9971ba5dd765c4a27a321201b9c3b1a06f8b3d0e46a0b0227d0 |
| SHA512 | d9b2f205dcba4f45fa6ff5cb7f85a6347cee9fe3a9669c3acbd9bff8d2b267b5244979c5ef278d451110198ba3252c9ae3dbc176affd0fdefb637066a753df74 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
| MD5 | 2ebfdbd309ee762211b4a2ac39708c4d |
| SHA1 | b002922c672dbe1dd4caa02af24d0b1e7da616af |
| SHA256 | 54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797 |
| SHA512 | d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | db18d71c473f06bcba1c1223a6a3785e |
| SHA1 | 8b39972e7b40bebc7a26129b81542161ed227908 |
| SHA256 | 121cf03316b26331959283ab495dfd231d647dfa9aefa71a0b58dad876112d54 |
| SHA512 | 2e651622e61874011329d516ce0ccaa6aed7ff88e9a04ba0293b34ad786299fb4156b74276b2072cc83ddfd2d3820629a2eacba9969fc1c1a79b1c3dc2dc2672 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | ee821194af6e357ffedb7ad293b2fe6e |
| SHA1 | 6b3783558fbd422bc7b9e5d242e5dc26319c21f1 |
| SHA256 | a9763e944ba89028c490ecdc19c9838fdd8bde29ccb1bac7b571360cbdfa0bb7 |
| SHA512 | 391e3b2dd5b69559eabd3a0e1ffa12de7507099b344647908d910d5809e2ceb43bcde1722d86a4b760bf557c8a4cd3ff041dc13b4d64162f665da12d70c3842b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
| MD5 | 71011f7cbec6f99e7a29a0eadf88e236 |
| SHA1 | c00025d7c3aa33a05f748fc8e8cdb6275a57cb81 |
| SHA256 | 77269383947a34bd640faff6523e50b51d886651dc0bf414cdf11a2b7a8f26a7 |
| SHA512 | 2f1ce2e9f04f5368f5c74a141d80f37b2ae5a000a2906774cfd7c5d2d670830c2c5635f43a95a5d8ed18fb8841607239f1123c2a30b90e1fe73a42c67f37aee7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 88de738a97ab6feca0496706776afe90 |
| SHA1 | 2c90f4c1e6bec9204af7927535bb41d396a35600 |
| SHA256 | bc0294a2e5f2e254732c0a9b292147196572cee1eb960f1ea633fc2aa51da77a |
| SHA512 | 6f788560436a91da6a0380f5634efd7fe940e16c50133828e6d04e8a45ef64aa9118dec7609006944105c0c0bb87481545a8ef150bf08cc58417d14adc9dbf01 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594472.TMP
| MD5 | 31c65d8a0f4cfd2e963d6b78b65ce27c |
| SHA1 | 9f1cc23876c586c90e82dbfbb48e79b5e68447eb |
| SHA256 | 99217674a453444c7d50e81fed3403aa6c04f7752968c5007a0e2d21eb4189c1 |
| SHA512 | 52b9716ca2058294204b31394bdc570c0a01989f90f4ec7e1fb1a2a85c412fee1ddb9fdcccf910df692da720c1ee02441d8d56ea0996682190bd04a15f32bae7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c1839b4d4ed12c53d0cf1858d7578d83 |
| SHA1 | 7fc42b58f6ec5837c2cd0a038277a62797b8303b |
| SHA256 | afbd677cb1eeb3e5d0f5bfeb1651d20a7af990af7406e26ebe1d53a6bfd203b7 |
| SHA512 | dccd16144322af140701c3240a452d3e80b2c27f409e56cf106e4d00b82bc49f99ee12dbf9a7bf70c7a4d72833ff0f6ce855424e40dab84fdfa188ee727fbefb |