Analysis Overview
SHA256
268a3aa9f932cc62f868a101dbf930b29396bb21acdead61e9bb0af527e72245
Threat Level: Known bad
The file 2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
SocGholish
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-10 13:37
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-10 13:37
Reported
2024-05-10 13:40
Platform
win7-20240221-en
Max time kernel
142s
Max time network
147s
Command Line
Signatures
SocGholish
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421510121" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{748EC791-0ED2-11EF-A40F-5A791E92BC44} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3000 wrote to memory of 2156 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 3000 wrote to memory of 2156 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 3000 wrote to memory of 2156 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 3000 wrote to memory of 2156 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | ahlikompie.com | udp |
| US | 8.8.8.8:53 | www.insidethemagic.net | udp |
| US | 8.8.8.8:53 | www.thefloridahotelorlando.com | udp |
| US | 8.8.8.8:53 | pewresearch.org | udp |
| US | 8.8.8.8:53 | www.myhotspots.co.uk | udp |
| US | 8.8.8.8:53 | lpmpjateng.go.id | udp |
| US | 8.8.8.8:53 | yourjavascript.com | udp |
| US | 8.8.8.8:53 | www.widgeo.net | udp |
| US | 8.8.8.8:53 | img2.blogblog.com | udp |
| US | 8.8.8.8:53 | lh3.ggpht.com | udp |
| US | 8.8.8.8:53 | lh5.ggpht.com | udp |
| US | 8.8.8.8:53 | lh6.ggpht.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | bloggercilacap.com | udp |
| US | 8.8.8.8:53 | pub.mybloglog.com | udp |
| US | 8.8.8.8:53 | cdn.wibiya.com | udp |
| US | 8.8.8.8:53 | bloggergadgets.googlecode.com | udp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| GB | 216.58.204.74:80 | fonts.googleapis.com | tcp |
| US | 13.248.169.48:80 | yourjavascript.com | tcp |
| GB | 142.250.200.9:443 | img2.blogblog.com | tcp |
| GB | 142.250.200.9:443 | img2.blogblog.com | tcp |
| GB | 216.58.204.74:80 | fonts.googleapis.com | tcp |
| GB | 142.250.200.9:443 | img2.blogblog.com | tcp |
| US | 13.248.169.48:80 | yourjavascript.com | tcp |
| GB | 142.250.178.10:443 | ajax.googleapis.com | tcp |
| GB | 142.250.178.10:443 | ajax.googleapis.com | tcp |
| GB | 216.58.201.110:80 | apis.google.com | tcp |
| GB | 216.58.201.110:443 | apis.google.com | tcp |
| US | 192.0.66.2:80 | pewresearch.org | tcp |
| US | 192.0.66.2:80 | pewresearch.org | tcp |
| US | 104.16.150.108:80 | www.insidethemagic.net | tcp |
| US | 104.16.150.108:80 | www.insidethemagic.net | tcp |
| GB | 216.58.201.110:80 | apis.google.com | tcp |
| GB | 142.250.200.9:443 | img2.blogblog.com | tcp |
| GB | 142.250.200.9:443 | img2.blogblog.com | tcp |
| SG | 172.96.191.56:80 | ahlikompie.com | tcp |
| US | 104.18.164.83:80 | www.thefloridahotelorlando.com | tcp |
| SG | 172.96.191.56:80 | ahlikompie.com | tcp |
| US | 104.18.164.83:80 | www.thefloridahotelorlando.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| US | 104.26.10.22:80 | www.widgeo.net | tcp |
| US | 104.26.10.22:80 | www.widgeo.net | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.200.9:80 | img2.blogblog.com | tcp |
| GB | 142.250.200.9:80 | img2.blogblog.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| IE | 172.253.116.82:80 | bloggergadgets.googlecode.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| IE | 172.253.116.82:80 | bloggergadgets.googlecode.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 216.58.201.97:80 | lh6.ggpht.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 216.58.201.97:80 | lh6.ggpht.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| US | 76.223.67.189:80 | www.myhotspots.co.uk | tcp |
| US | 76.223.67.189:80 | www.myhotspots.co.uk | tcp |
| US | 188.114.96.2:80 | cdn.wibiya.com | tcp |
| US | 188.114.96.2:80 | cdn.wibiya.com | tcp |
| US | 192.0.66.2:443 | pewresearch.org | tcp |
| US | 104.16.150.108:443 | www.insidethemagic.net | tcp |
| US | 104.18.164.83:443 | www.thefloridahotelorlando.com | tcp |
| US | 104.18.164.83:443 | www.thefloridahotelorlando.com | tcp |
| US | 8.8.8.8:53 | www.tealdit.com | udp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 172.67.174.110:80 | www.tealdit.com | tcp |
| US | 172.67.174.110:80 | www.tealdit.com | tcp |
| SG | 139.99.69.164:80 | bloggercilacap.com | tcp |
| SG | 139.99.69.164:80 | bloggercilacap.com | tcp |
| US | 104.18.164.83:443 | www.thefloridahotelorlando.com | tcp |
| US | 2.18.190.81:80 | apps.identrust.com | tcp |
| US | 172.67.174.110:443 | www.tealdit.com | tcp |
| US | 104.18.164.83:443 | www.thefloridahotelorlando.com | tcp |
| ID | 103.30.180.77:80 | lpmpjateng.go.id | tcp |
| ID | 103.30.180.77:80 | lpmpjateng.go.id | tcp |
| SG | 172.96.191.56:443 | ahlikompie.com | tcp |
| US | 8.8.8.8:53 | s1.rsspump.com | udp |
| US | 8.8.8.8:53 | x2.c.lencr.org | udp |
| BE | 23.55.97.11:80 | x2.c.lencr.org | tcp |
| SG | 139.99.69.164:443 | bloggercilacap.com | tcp |
| US | 104.26.10.22:443 | www.widgeo.net | tcp |
| US | 104.26.10.22:443 | www.widgeo.net | tcp |
| US | 8.8.8.8:53 | mc.yandex.ru | udp |
| RU | 93.158.134.119:443 | mc.yandex.ru | tcp |
| RU | 93.158.134.119:443 | mc.yandex.ru | tcp |
| US | 64.98.135.66:80 | s1.rsspump.com | tcp |
| US | 64.98.135.66:80 | s1.rsspump.com | tcp |
| US | 104.26.10.22:443 | www.widgeo.net | tcp |
| US | 8.8.8.8:53 | widgets.amung.us | udp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| US | 8.8.8.8:53 | maxcdn.bootstrapcdn.com | udp |
| US | 172.67.8.141:80 | widgets.amung.us | tcp |
| US | 172.67.8.141:80 | widgets.amung.us | tcp |
| IE | 209.85.203.84:443 | accounts.google.com | tcp |
| IE | 209.85.203.84:443 | accounts.google.com | tcp |
| US | 104.18.11.207:443 | maxcdn.bootstrapcdn.com | tcp |
| US | 104.18.11.207:443 | maxcdn.bootstrapcdn.com | tcp |
| US | 8.8.8.8:53 | arvigorothan.com | udp |
| US | 104.21.30.34:443 | arvigorothan.com | tcp |
| US | 104.21.30.34:443 | arvigorothan.com | tcp |
| US | 8.8.8.8:53 | applify.me | udp |
| ID | 103.30.180.77:443 | lpmpjateng.go.id | tcp |
| DE | 138.201.94.231:80 | applify.me | tcp |
| DE | 138.201.94.231:80 | applify.me | tcp |
| US | 8.8.8.8:53 | www2.cbox.ws | udp |
| US | 8.8.8.8:53 | i1045.photobucket.com | udp |
| DE | 195.201.153.71:80 | www2.cbox.ws | tcp |
| DE | 195.201.153.71:80 | www2.cbox.ws | tcp |
| FR | 18.244.28.112:80 | i1045.photobucket.com | tcp |
| FR | 18.244.28.112:80 | i1045.photobucket.com | tcp |
| US | 8.8.8.8:53 | static.cloudflareinsights.com | udp |
| FR | 18.244.28.112:443 | i1045.photobucket.com | tcp |
| US | 104.16.79.73:443 | static.cloudflareinsights.com | tcp |
| US | 104.16.79.73:443 | static.cloudflareinsights.com | tcp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| GB | 142.250.187.225:443 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:443 | 1.bp.blogspot.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| ID | 103.30.180.77:443 | lpmpjateng.go.id | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| ID | 103.30.180.77:443 | lpmpjateng.go.id | tcp |
| ID | 103.30.180.77:443 | lpmpjateng.go.id | tcp |
| DE | 138.201.94.231:80 | applify.me | tcp |
| DE | 138.201.94.231:80 | applify.me | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 30ba39f0d9dfc242bcf5a13148c65714 |
| SHA1 | f35a36a5dd87eec68ee6d1e621224995838f30f2 |
| SHA256 | 6cb7722d1559158bb31024e172b224988f0963e043cb8f60065c94c0e9f5b0a8 |
| SHA512 | bf732a235af263d14562f0f10495e910f18affdf4dd1f1f0507c470de7e9cc0d3f122f4e114962ab3342c434d71b20e97ee78dde7339a42300cb5a394f500a45 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | cb53b0039b109b98a67fd18a468bab5e |
| SHA1 | 6d186e96489850c3808815628702d4859b7b26b6 |
| SHA256 | 9ba581edefe0b810add43e4561b53a9087c38d9b8973b18e7dbb92dbe8a562b1 |
| SHA512 | 692ccca4c50403395a09132fcbd8e71c479bfbc0a4e0c61c5697b58377941f86707e6bb32ca603196a5a4dfe18a2cbe6bdbfe8d98c0ef4912bce71fa37b2e9e2 |
C:\Users\Admin\AppData\Local\Temp\Cab279F.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | ac89a852c2aaa3d389b2d2dd312ad367 |
| SHA1 | 8f421dd6493c61dbda6b839e2debb7b50a20c930 |
| SHA256 | 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45 |
| SHA512 | c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | d02d9539c07f8160f0d2216ce159192a |
| SHA1 | 3476e487089f9684b27386036b1dd80700be9d50 |
| SHA256 | fdf4e07877e0dfddf4706e5ba8cd7854d5b2ff13a0977010c2e7f1fcc654659b |
| SHA512 | 6d572a077864c4da31d8d8c2850f40cc90ab13c4941001951de4ad1a76a79fb3f17c2a16b16f09ab6cd065208f70cf9403fc5019d7c7b85d406e09786117d035 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_F82FCC341F124F6AC9D153F6ECE89FFA
| MD5 | 43ae1240e82a88c27729aa2e43fdcd18 |
| SHA1 | d3d075e4a91481cb936b162a4aef36a7ec25ee70 |
| SHA256 | e3502b118ac5ee1eb32690694f604b973f3d5c4a8bc00c7a41e71c63ed96bdf2 |
| SHA512 | b41079e60d4fc1c4640a119dc1fa47bec6efadabbc0e5f4e4a3f4c89abb160e74914531088e273feaa670d3a92b00a0e6380fd94fa480913709f34ad1c971a5a |
C:\Users\Admin\AppData\Local\Temp\Cab288B.tmp
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\plusone[1].js
| MD5 | fb86282646c76d835cd2e6c49b8625f7 |
| SHA1 | d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0 |
| SHA256 | 638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109 |
| SHA512 | 07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9 |
C:\Users\Admin\AppData\Local\Temp\Tar28ED.tmp
| MD5 | 435a9ac180383f9fa094131b173a2f7b |
| SHA1 | 76944ea657a9db94f9a4bef38f88c46ed4166983 |
| SHA256 | 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34 |
| SHA512 | 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 84fdc84ce145c467a735a566f3e7d47b |
| SHA1 | 34ac98fc236e0e6f2c71cc8468683acd5fdcc3dc |
| SHA256 | ae96294b5a3be3c83175f3c5aca5759d2a6e5e871f1e8b0c60125956dd325de2 |
| SHA512 | eef5ba11ac548abbfd3f2d003f9d370551dd674f2d02814f5586567b2386df8f15bb2dfbc69b0af2ef8b41d12d1aaa32a2cae29f9c4620c86faa01abc6fd3c37 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\cb=gapi[2].js
| MD5 | 4d1bd282f5a3799d4e2880cf69af9269 |
| SHA1 | 2ede61be138a7beaa7d6214aa278479dce258adb |
| SHA256 | 5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693 |
| SHA512 | 615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b2d6c2a0ddbb4f786f6e6cd37324d9a1 |
| SHA1 | 01ac2b26c306169a6cd62a57fc87ed7f6824d2d1 |
| SHA256 | f41dac8871334f4e9ae7c6fb698ff21846d10ab450081a6251d5a8781099cc69 |
| SHA512 | 01fa62b604267f31799bfb682f2ec5dcfb40757d33e7b1ab874d35af169e3bc69c5311da6f2b9522eeac880dccef115fcf41f961d2b298a7eb84d5875a729a63 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719
| MD5 | 8054872b37200a510f4c5402c9bc8613 |
| SHA1 | 3134db147434a201795bb804ff6f71cbe7c60b0d |
| SHA256 | b949dfd054405ef3e4d0f1764cf2f14352b53e6bd6e10012681ffc484756c813 |
| SHA512 | 219f3968e6fdc10338973ca4c622ad46d8ef8c566e8ed641b9a2f5c70e5754618a90428db4782b31af99e92573b79a9eba2f1d274d6fa8eaa006ce951cb929f0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | bc94f5dba9881dfad3a0077b4e4b5af7 |
| SHA1 | 631ccb79877ea217a6272cbaf4dcf9eb99e61d60 |
| SHA256 | 8f69c55fe48a6b0f4d12309be671caea589ffb46be7b921004b5cae032e805ed |
| SHA512 | 74bc39dae632e2e446286e6223407c08075006a4c1776be28bc88a805b02507838a3fd34fa9acaae6288257c77a708a2876492696d07ca62c98f0558d6761e92 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ae2fcddf52b383f5b1d81715645db92d |
| SHA1 | a1f8172d58e433feb2e0c7948902e8f99e953e04 |
| SHA256 | fe54956071c05db4cbfbe72455a7270a229980ac486305ee4a8cb38817c3c512 |
| SHA512 | 85000a9da7fd2e241825724133c1c4303ea4e4d827393d6522179346e4765bbfe7bb12dd11808536e28ae99a8de7108c765751362f8d4df80e0f5289d098c03c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | bcc8a49fc1d9224f3aba2492ec3ca10d |
| SHA1 | 45ee447a306db578ca634268d46344d0ea8711f5 |
| SHA256 | 57197cdef50f665f599a35e4fb537b6bb3a2a7962593126aa2ef42a9bab7ad0e |
| SHA512 | 84acdb9d11a5c4f0474ff2e11bc4c34988b7cbdd023ed367f6e7d78c4146e5f591a2a6121cd24433a56439e4b13545468f621fbe62202a7b2bc1d9521a27b788 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b986a95708fa5828175347b8c897bf77 |
| SHA1 | 4554b342f4899bd3c95b4a2d9b5aea64e6334bdd |
| SHA256 | f832513c28a3c51606270fe6410a573614d2458a6c1282321f775f7a831ddcda |
| SHA512 | d70ef2f0c2221d5aaca83415a169778d5d7b00da254e8eb07ece6ce2a28c50eaf4555b80f33058e89f4229fb2c7ee8e5045ec838202d02f10063f0963655273d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1de1346c6fecc4b30f823d2a952ac8e1 |
| SHA1 | e65cc4f11e8565e24b07c4de8fee1f026fadd157 |
| SHA256 | 9ef4fc59708417588462e8ef6460ba1ffb1797a39d6d19379ebf4631834d4a5c |
| SHA512 | c5b44e06cf1bab95de8b5a54e8c8fba5309ad9439b0bed0533178793308a9de8c8cef4b54b816d652429e76638d44b6f2e622ef53228a5baeeeefa938ad53149 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d9e5012962c3783dd3c022a6aff84606 |
| SHA1 | 0f615cbe3225e133d0da6935e654497d5c90ddce |
| SHA256 | f6a1c7fde691f774150238c0a4ae2ddb819004fddfee271ccfc594c815a15aad |
| SHA512 | df724bf854f0153541f4fd9c80fd7ef41c13d40db0e71f227ad94bf71648a33b897775ca0acb785d7b204b809c75794b6a292acccbd55f36d05d4dcb06841e94 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 45d211742f2a17dc97af52f298b26d73 |
| SHA1 | 913db012a5bff22795e9bf78df300f659b83fd6d |
| SHA256 | 5471cfd9219f96ee35d13a16bd8066831495d80fe7dcd8b7129b59fdde3ab8c3 |
| SHA512 | 24ee4dc487f5613c06732e54d45c0dca15a25da0114dbd4743d0ea26dd7b6b1abf8a96268b9358e86c9d26747ee6cd886b0cbe76997bac20e5028c4c9c4fea85 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | bfb1de7166ec9ae9eeec1402eb3b8655 |
| SHA1 | 972f61bd2b9cb817053a02fc420f68a09753b591 |
| SHA256 | 08135d309b40f1ba682f20ca2ec1b54c98883b895965a5625d7738bfdd80e84f |
| SHA512 | 53a3efc97766803b9e6e6cd5c57c48a2364fdf6306f91d24a12c73b688aa0f2cfc6216d5cf820db3e1a1e397ab2b395681ccf533040f837e778d649bb9db34d5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d705187ce2322e6e8c96d2d68bea1010 |
| SHA1 | d11e9cec54973261e753095cc3c91f60f792522c |
| SHA256 | 8593b6b04d9dc5df9a6f9f1f4088358976374b382c30d5ed7faa156a1ecad5bf |
| SHA512 | 1b6374a2b0f68f4a7bbf9ece31c2fce08b9672769331613a012146da56741b7a1a30d0ee2352dac9a3820637c29dd167d096940243a765b87014db6a0ae267e3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1efec08b5156b985c1210023ba72f010 |
| SHA1 | 2d4dde369e0a108415253cb11cd852ccf5fcce2a |
| SHA256 | 6590d113f0c9f8b8a70f465b45acfbd160c08c9fcf0ae1a6d118f442d63ba377 |
| SHA512 | 60bddb8e3d0abfafbe0daa1d3aabfe90e1720202bfa74b024fdebbcb8cd464767163b7eef139eea5621bf8b16007dc34a687ab43f787e3fbd13bc12af2987dac |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 93eacbe42ad299696f467c3d693a9bea |
| SHA1 | ef33db616ff02868669b3a111d9d9c63406ac054 |
| SHA256 | b0aca19ce638e96df4b19d5cb71aa882a4f2ebd20f2284f76cc283110b955099 |
| SHA512 | 7dce9d637cfb8e7e82a5b96a64fa7ef2ca90afdb104b5947475f441c8e779871ea187434dde9e8bb4b23f3b26e76cebb08d251c6fb45cdc251016963b8f451a4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ccceef93bca9aeea869b4e67fe40a888 |
| SHA1 | 0b63d5de0aeaf7ce10c00e8aef73afa75c00517a |
| SHA256 | 87f5fe530b93ce4c04892a5dbee2b41c2ba49595dbbd80768345abda258c2254 |
| SHA512 | e0646d0217f38028b768a3a6e6ca651ae0aac7f4ee8c14c851d8ce923b27643cc65b18f9772671482e17d6f2fa0ebe5bea45bdc50ed64a3b6d8de3f11c6a62d9 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-10 13:37
Reported
2024-05-10 13:40
Platform
win10v2004-20240508-en
Max time kernel
134s
Max time network
139s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c15146f8,0x7ff8c1514708,0x7ff8c1514718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1492 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7992 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7992 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14145490590184851648,5354474910365875888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5528 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 216.58.201.110:80 | apis.google.com | tcp |
| GB | 216.58.201.110:443 | apis.google.com | tcp |
| GB | 142.250.200.9:443 | www.blogger.com | tcp |
| GB | 216.58.212.234:443 | ajax.googleapis.com | tcp |
| GB | 216.58.204.74:80 | fonts.googleapis.com | tcp |
| GB | 216.58.212.195:80 | fonts.gstatic.com | tcp |
| US | 8.8.8.8:53 | yourjavascript.com | udp |
| US | 13.248.169.48:80 | yourjavascript.com | tcp |
| GB | 142.250.200.9:443 | www.blogger.com | udp |
| GB | 216.58.201.110:443 | apis.google.com | udp |
| US | 8.8.8.8:53 | s1.rsspump.com | udp |
| GB | 172.217.169.66:445 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | www.widgeo.net | udp |
| US | 8.8.8.8:53 | pub.mybloglog.com | udp |
| US | 8.8.8.8:53 | cdn.wibiya.com | udp |
| US | 8.8.8.8:53 | bloggergadgets.googlecode.com | udp |
| US | 64.98.135.66:80 | s1.rsspump.com | tcp |
| US | 8.8.8.8:53 | ahlikompie.com | udp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | lpmpjateng.go.id | udp |
| US | 8.8.8.8:53 | www.thefloridahotelorlando.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | www.insidethemagic.net | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | pewresearch.org | udp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| US | 13.248.169.48:80 | yourjavascript.com | tcp |
| GB | 142.250.187.225:80 | 3.bp.blogspot.com | tcp |
| SG | 172.96.191.56:80 | ahlikompie.com | tcp |
| IE | 172.253.116.82:80 | bloggergadgets.googlecode.com | tcp |
| US | 172.67.143.66:80 | cdn.wibiya.com | tcp |
| GB | 142.250.187.225:80 | 3.bp.blogspot.com | tcp |
| US | 104.26.10.22:80 | www.widgeo.net | tcp |
| GB | 142.250.200.9:443 | resources.blogblog.com | tcp |
| US | 104.18.162.83:80 | www.thefloridahotelorlando.com | tcp |
| US | 104.16.150.108:80 | www.insidethemagic.net | tcp |
| US | 192.0.66.2:80 | pewresearch.org | tcp |
| US | 64.98.135.66:80 | s1.rsspump.com | tcp |
| US | 192.0.66.2:443 | pewresearch.org | tcp |
| US | 104.16.150.108:443 | www.insidethemagic.net | tcp |
| US | 104.18.162.83:443 | www.thefloridahotelorlando.com | tcp |
| US | 8.8.8.8:53 | www.myhotspots.co.uk | udp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 8.8.8.8:53 | www.tealdit.com | udp |
| US | 76.223.67.189:80 | www.myhotspots.co.uk | tcp |
| US | 8.8.8.8:53 | img2.blogblog.com | udp |
| US | 2.18.190.80:80 | apps.identrust.com | tcp |
| US | 104.21.72.39:80 | www.tealdit.com | tcp |
| GB | 142.250.200.9:80 | img2.blogblog.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| SG | 172.96.191.56:80 | ahlikompie.com | tcp |
| US | 8.8.8.8:53 | applify.me | udp |
| US | 104.21.72.39:443 | www.tealdit.com | tcp |
| US | 8.8.8.8:53 | lh5.ggpht.com | udp |
| US | 8.8.8.8:53 | lh3.ggpht.com | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| DE | 138.201.94.231:80 | applify.me | tcp |
| US | 8.8.8.8:53 | 110.201.58.216.in-addr.arpa | udp |
| GB | 142.250.187.225:80 | lh3.ggpht.com | tcp |
| US | 104.26.10.22:443 | www.widgeo.net | tcp |
| US | 8.8.8.8:53 | 9.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.143.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.10.26.104.in-addr.arpa | udp |
| GB | 142.250.187.225:80 | lh3.ggpht.com | tcp |
| GB | 142.250.187.225:80 | lh3.ggpht.com | tcp |
| US | 8.8.8.8:53 | 83.162.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.116.253.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.150.16.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.66.0.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.169.248.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.135.98.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 189.67.223.76.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 39.72.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | www.widgeo.net | udp |
| US | 8.8.8.8:53 | 225.187.250.142.in-addr.arpa | udp |
| US | 104.26.10.22:445 | www.widgeo.net | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| US | 8.8.8.8:53 | lh6.ggpht.com | udp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 1.bp.blogspot.com | tcp |
| IE | 172.253.116.82:80 | bloggergadgets.googlecode.com | tcp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | mc.yandex.ru | udp |
| US | 8.8.8.8:53 | bloggercilacap.com | udp |
| US | 8.8.8.8:53 | maxcdn.bootstrapcdn.com | udp |
| US | 8.8.8.8:53 | platform.twitter.com | udp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| IE | 209.85.203.84:443 | accounts.google.com | tcp |
| DE | 138.201.94.231:80 | applify.me | tcp |
| SG | 172.96.191.56:443 | ahlikompie.com | tcp |
| US | 8.8.8.8:53 | widgets.amung.us | udp |
| ID | 103.30.180.77:80 | lpmpjateng.go.id | tcp |
| US | 8.8.8.8:53 | arvigorothan.com | udp |
| PL | 93.184.220.66:443 | platform.twitter.com | tcp |
| US | 104.18.10.207:443 | maxcdn.bootstrapcdn.com | tcp |
| US | 8.8.8.8:53 | www2.cbox.ws | udp |
| GB | 216.58.201.97:80 | lh6.ggpht.com | tcp |
| GB | 142.250.187.225:80 | 2.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 2.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 2.bp.blogspot.com | tcp |
| GB | 142.250.187.225:80 | 2.bp.blogspot.com | tcp |
| RU | 93.158.134.119:443 | mc.yandex.ru | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| US | 8.8.8.8:53 | i1045.photobucket.com | udp |
| DE | 195.201.153.71:80 | www2.cbox.ws | tcp |
| DE | 195.201.153.71:80 | www2.cbox.ws | tcp |
| RU | 93.158.134.119:443 | mc.yandex.ru | tcp |
| FR | 18.244.28.58:80 | i1045.photobucket.com | tcp |
| SG | 139.99.69.164:80 | bloggercilacap.com | tcp |
| ID | 103.30.180.77:80 | lpmpjateng.go.id | tcp |
| US | 172.67.8.141:80 | widgets.amung.us | tcp |
| US | 172.67.150.119:443 | arvigorothan.com | tcp |
| US | 172.67.8.141:80 | widgets.amung.us | tcp |
| FR | 18.244.28.58:443 | i1045.photobucket.com | tcp |
| SG | 172.96.191.56:443 | ahlikompie.com | tcp |
| US | 8.8.8.8:53 | t.dtscout.com | udp |
| DE | 141.101.120.11:443 | t.dtscout.com | tcp |
| US | 8.8.8.8:53 | glakaits.net | udp |
| US | 8.8.8.8:53 | www.cbox.ws | udp |
| SG | 139.99.69.164:80 | bloggercilacap.com | tcp |
| NL | 139.45.197.242:443 | glakaits.net | tcp |
| GB | 172.217.169.66:139 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | developers.google.com | udp |
| US | 8.8.8.8:53 | my.rtmark.net | udp |
| US | 8.8.8.8:53 | yonmewon.com | udp |
| US | 8.8.8.8:53 | sr7pv7n5x.com | udp |
| GB | 216.58.212.238:80 | developers.google.com | tcp |
| NL | 139.45.195.8:443 | my.rtmark.net | tcp |
| NL | 212.117.190.201:443 | sr7pv7n5x.com | tcp |
| NL | 139.45.197.236:443 | yonmewon.com | tcp |
| US | 8.8.8.8:53 | 30.179.139.118.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.191.96.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.203.85.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 207.10.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.153.201.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.134.158.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.8.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.150.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.28.244.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.120.101.141.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 242.197.45.139.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.180.30.103.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.201.222.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.69.99.139.in-addr.arpa | udp |
| IE | 209.85.203.84:443 | accounts.google.com | udp |
| GB | 216.58.212.238:443 | developers.google.com | tcp |
| ID | 103.30.180.77:443 | lpmpjateng.go.id | tcp |
| SG | 139.99.69.164:443 | bloggercilacap.com | tcp |
| US | 8.8.8.8:53 | syndication.twitter.com | udp |
| US | 104.244.42.72:443 | syndication.twitter.com | tcp |
| US | 104.26.11.22:445 | www.widgeo.net | tcp |
| US | 172.67.69.193:445 | www.widgeo.net | tcp |
| US | 8.8.8.8:53 | ssl.gstatic.com | udp |
| GB | 142.250.179.227:443 | ssl.gstatic.com | tcp |
| US | 8.8.8.8:53 | static.cloudflareinsights.com | udp |
| US | 104.16.79.73:443 | static.cloudflareinsights.com | tcp |
| ID | 103.30.180.77:443 | lpmpjateng.go.id | tcp |
| SG | 139.99.69.164:443 | bloggercilacap.com | tcp |
| US | 8.8.8.8:53 | twitter.com | udp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| GB | 142.250.187.225:443 | 2.bp.blogspot.com | tcp |
| GB | 142.250.187.225:443 | 2.bp.blogspot.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | udp |
| US | 8.8.8.8:53 | 238.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.195.45.139.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 236.197.45.139.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.190.117.212.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.42.244.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.79.16.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | connect.facebook.net | udp |
| GB | 163.70.151.21:445 | connect.facebook.net | tcp |
| US | 8.8.8.8:53 | connect.facebook.net | udp |
| GB | 163.70.151.21:139 | connect.facebook.net | tcp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | static.addtoany.com | udp |
| US | 104.22.70.197:445 | static.addtoany.com | tcp |
| US | 104.22.71.197:445 | static.addtoany.com | tcp |
| US | 172.67.39.148:445 | static.addtoany.com | tcp |
| US | 8.8.8.8:53 | static.addtoany.com | udp |
| US | 104.22.70.197:139 | static.addtoany.com | tcp |
| IE | 209.85.203.84:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | cdn.viglink.com | udp |
| FR | 18.244.28.18:445 | cdn.viglink.com | tcp |
| FR | 18.244.28.122:445 | cdn.viglink.com | tcp |
| FR | 18.244.28.110:445 | cdn.viglink.com | tcp |
| FR | 18.244.28.25:445 | cdn.viglink.com | tcp |
| US | 8.8.8.8:53 | cdn.viglink.com | udp |
| US | 8.8.8.8:53 | whos.amung.us | udp |
| US | 104.22.75.171:445 | whos.amung.us | tcp |
| US | 172.67.8.141:445 | whos.amung.us | tcp |
| US | 104.22.74.171:445 | whos.amung.us | tcp |
| US | 8.8.8.8:53 | whos.amung.us | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | kepingan-hati.blogspot.com | udp |
| GB | 142.250.200.9:443 | www.blogger.com | udp |
| GB | 216.58.201.97:80 | kepingan-hati.blogspot.com | tcp |
| IE | 209.85.203.84:443 | accounts.google.com | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4158365912175436289496136e7912c2 |
| SHA1 | 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59 |
| SHA256 | 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1 |
| SHA512 | 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b |
\??\pipe\LOCAL\crashpad_3532_DAHJKAJONAGHYAHE
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ce4c898f8fc7601e2fbc252fdadb5115 |
| SHA1 | 01bf06badc5da353e539c7c07527d30dccc55a91 |
| SHA256 | bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa |
| SHA512 | 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | bba78cb58d24f4cab6635448f07da924 |
| SHA1 | d9c878b33ca2553ee70a5dcf1a7ab53c9a53d56d |
| SHA256 | 4cddce4ad949bb5cf58cc9eb263c16759c9500f5c638063030cdd5acfcb7b5fb |
| SHA512 | bdd198d518a11cd9b59fa9c70f8d1e7caf923935c2fcb3b7e4c91fa329c4628f60b08027789174dc61d2c34dbcb19baa82a282edcef328f88e6ebb4fc9b191fe |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
| MD5 | b6c8122025aff891940d1d5e1ab95fce |
| SHA1 | a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4 |
| SHA256 | 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e |
| SHA512 | e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
| MD5 | 88477d32f888c2b8a3f3d98deb460b3d |
| SHA1 | 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c |
| SHA256 | 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8 |
| SHA512 | e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | d09e152809581955de3d5c54ac4a88da |
| SHA1 | a9517340116c59934593e67e898db78256a70d63 |
| SHA256 | b959de61959fea39441a9b764098e75cd58aa39e2f68cc9499f8dfcdb76b6f31 |
| SHA512 | 4014982e8c3711180c54d3cf1d0009270e9a04be29b2434826ce01b08b56e7345c8183b1cf3adf40bd9fad38974740b28d5181d044ca3d1713598ce2fefcd195 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 61ab4fbfd75ca38694be739df90714b2 |
| SHA1 | 5b4f1b48735c3d21a5b85255ad5a043d1dda6f73 |
| SHA256 | 9411405392bd0992bf9c1a7f05372b94e0f848decd93cfc2dcd5bb3a1e072af6 |
| SHA512 | 0c8519b48eaac7dd9105253e616a4ba2f4d2154ea3fd60ebcc514bcd60576e361c6c9b5b9ba9bb25ba2a7a51dd6356cc7d930c26cf3b3b02ea778e4b3fbdfc1a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 01b7156b5201a7c9c5e2a6dff74ac7c3 |
| SHA1 | 249b60cfc02bad967322e470695118e5343cee05 |
| SHA256 | 2aa7f4807b6df208c12b6b33e6c923c8ed187ced9c213e5e3f4482c70a2467d9 |
| SHA512 | 9d002f3aeb6a7f0521a148dc72e7a1d658b13b67b290bf042eec817b7bcd0704eefa066b59353f683bf29ddf4d9a29d310fc29aaca648df73ca6220d4992cfdd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 27c8f888996f8aa36e9e780487320145 |
| SHA1 | 6bf5c7e8262cd18fcd65b2465e67e26dad4a5ee3 |
| SHA256 | 4b9675b20a2036b20be00dfc9973547062ca61cb54018e6ead8b1fb5caec599a |
| SHA512 | 472ceb41c97c5ef1e0df207205c2e7e2e2f0fe13eb77b18831fc288a2f58d5e05fb47e908900f8039ee7810819926febf7f4d26b79d89932bffa7e53587f6090 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 20080cb285e9f1731f4866e5bdda622d |
| SHA1 | ec8d8bf1d6d04357c72f22b6d663412435ac3376 |
| SHA256 | 47aff29a8bfd2e3c017b66cde9a6cf623f9fb97554d543891c2c35b6113ec8dd |
| SHA512 | f943e8a54e36f2e86a3c0f03e8400c9b3945269de548c4433782b917b505c2821835522f53ae59f299febaf26e114a69772f2dae8e7c7ace86d3807a7167c071 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 1689d3bf7f4915d9de44d06f263d2a8b |
| SHA1 | 0ad5b12e8998740717512a56412e82f15691d941 |
| SHA256 | adfce1fa0828188608ddebbe775fa8e1d62a4147298a2e54c04ab634540919db |
| SHA512 | d06179556972da6429daedcacbd0ffc1d87f343038c45b2baf3a56da3240511762177fb35358e3c51a0916f53dd604463938f3ec029c70dc20f11c1382b37a3f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8b2d7c599e297381fb833bc5449b66b4 |
| SHA1 | 8c8117d6175121e70bdd2088e224b92157764e7d |
| SHA256 | 54dc6015e5caa03c664fda9cf2913f5b60e417976b8ca9f2ea47822ae3e5ba71 |
| SHA512 | 9cd9add7191598e0860996909a034c8814c998e7a09f4bd1fdb82de90150090e5e03f15e20dbe49ebce675194bc565b4cf891b1baee7d9360466715098a92c61 |