Malware Analysis Report

2025-08-05 15:37

Sample ID 240526-nxaffshc8z
Target 756003a7c57e4a8fdbf9447fd78f60b7_JaffaCakes118
SHA256 4efbeb81ac75065b1dba9a772f5d32b420eae909ec4669340dcc3e6f91deb305
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

4efbeb81ac75065b1dba9a772f5d32b420eae909ec4669340dcc3e6f91deb305

Threat Level: No (potentially) malicious behavior was detected

The file 756003a7c57e4a8fdbf9447fd78f60b7_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-26 11:46

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-26 11:46

Reported

2024-05-26 11:48

Platform

win7-20240221-en

Max time kernel

134s

Max time network

144s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\756003a7c57e4a8fdbf9447fd78f60b7_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b48427247cf4045ba567e8c4f82665c000000000200000000001066000000010000200000009f4624264303e02cd07c0bcdc2485e7290c459b4f710e3c94e9e1b4c2dfd6ee0000000000e8000000002000020000000054a0e208ced02ea7854367dd7c5e507637a6f76c911ea215a0dad2e5a409b729000000049fc9076292984d2df070980e54191bf30ea9dab6696a1e6b76275a86dc82e1fdfdbe49e8651cf54134f606903e057dcea5937668bd7fe247d8ed48878de07445e0e8b0c95f85bef274342383259cf73bce1e39bd89c1d3c9f6de569769f20f489998de41ecbb91c820ed99618b9edb047ae634273fc6d9c396ebdaf9a282326de1a4ad49fb3f51bbf2d4564dc427e0c4000000030de4b7e26695a5e98101f05299b1cde3d7f864f4d35e783db279f4a1ca59d271194cdc74ebb564489707744e7a1c75fd4be4cd3ffbb7987aab2f7247f41c384 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92BA4611-1B55-11EF-9F3E-D2EFD46A7D0E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f076a46a62afda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b48427247cf4045ba567e8c4f82665c00000000020000000000106600000001000020000000bcf95a23e754b18988f65b6f46294497d4bb0c1c7b7a67389bdd79973093bc5e000000000e800000000200002000000056b6303fdeac5f74452161126c57344d04130f22b53de4f963c851be9d01de2220000000c6458fd6ffcceba5179532a519f45b1fa750b81f885f2a724038fdc534a324f54000000014890e39f758d781652fec7c738a14d1e3bf0e7591ee4e22aaad6a916ef931ca1ac969bb36bcdad6b4a61b733aec10ddcd9175be524344d2e9e024304b99ef7c C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422885851" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\756003a7c57e4a8fdbf9447fd78f60b7_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1544 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 makingdifferent.github.com udp
US 8.8.8.8:53 sabarmuanas.googlecode.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 cuerosb.googlecode.com udp
US 8.8.8.8:53 www.hostinger.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 mesinjahit.web.id udp
US 8.8.8.8:53 www.tokotigamesinjahit.com udp
US 8.8.8.8:53 img2.blogblog.com udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
BE 173.194.76.82:80 cuerosb.googlecode.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
BE 173.194.76.82:80 cuerosb.googlecode.com tcp
BE 173.194.76.82:80 cuerosb.googlecode.com tcp
US 104.16.147.108:443 www.hostinger.com tcp
US 185.199.108.153:80 makingdifferent.github.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
US 185.199.108.153:80 makingdifferent.github.com tcp
FR 216.58.214.74:80 ajax.googleapis.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
BE 173.194.76.82:80 cuerosb.googlecode.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 104.16.147.108:443 www.hostinger.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
FR 216.58.214.74:80 ajax.googleapis.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
US 8.8.8.8:53 media.go2speed.org udp
US 8.8.8.8:53 ho.lazada.co.id udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 yourjavascript.com udp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.200.14:443 apis.google.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
CZ 65.9.95.6:443 media.go2speed.org tcp
CZ 65.9.95.6:443 media.go2speed.org tcp
IE 52.16.67.239:80 ho.lazada.co.id tcp
IE 52.16.67.239:80 ho.lazada.co.id tcp
ID 103.229.73.90:80 www.tokotigamesinjahit.com tcp
ID 103.229.73.90:80 www.tokotigamesinjahit.com tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 www.jasfora.web.id udp
US 8.8.8.8:53 accounts.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
US 8.8.8.8:53 developers.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
FR 172.217.20.196:443 www.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 104.16.147.108:443 www.hostinger.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab8C29.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar8D95.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar8E66.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 be3f0a04d543b64dfc8f405ea4a5505b
SHA1 897b54fc3338a7d42f3bf579095f061da3eccb56
SHA256 90bd14730c49d9de6f5d78f7d2f744b0645a1f018e44877b83c6bab81d4531a4
SHA512 a0d8c9a7e0914cbebc67773a7acee36090c9fb0cfcadfea8c1cb606ae060d227d5cecea379b483fe8de91f3a2e6c5cdf4141f5be6979444e974ff1e3a24682b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 141a6e04737d3a74496bd01e2bbccb4c
SHA1 45d919e996e16bd2cbb318853864810163d03afc
SHA256 72852564397a7645963af02d13f7c1238943d799e12a5f1031f5641a0340f4cb
SHA512 cd1cb2920800311571f76684966e7b61f9ccfc1112d47f2a62ddd68affbd0f019cdf66567a3af098b39940631f801f77d4942a904e20c6fe19cde1dd6cf10365

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 af51aac5770a6f12559192a140191a32
SHA1 27685d6e688abb508e5fb2ae9d3d5d868192055f
SHA256 7a69156ef9a3ace15f284c1e8870638bf9a892b8e816173ac69754bbdb07af09
SHA512 196a0653b528cb979ef86b905668a487c13d1799cc07d62a6cbc1189809a9df3de5ce1eccb541dcb3cc7058bb3cb746ed5d688e4cc0946e15f21e23f09973dd6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 13a4529d3c98cdb67a5f712e7b712dd5
SHA1 3f29ef2d7d7238a0d14b26a345cd473304807a6f
SHA256 046ccb26002394228432048998218f83aac75a361890f001de677e3c087a8d3b
SHA512 59a75cf678475e390ceaf5c94fa8a7f1fe03772124bf1bc66c6b268427584b832bf35068f55b437cf9828481e0df6d8006cd48dee836adacf747350ab332fffd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3698ca04668a01d50c5510926ec4ba4b
SHA1 98865ca9d0d9da4e7fd25f2d2e454dfc6255fc0e
SHA256 96e0e3ea85c30cb722a7e4e1b7e46086c0a42a3757239ca0a0bf7b54c7f02a50
SHA512 c613b7bf848ff9a911acca6ed25539b5c35843608c9435fef32419b00ae88ee1fc492cdbdb852374374745679f629c6940ca0634426b88fd30f5ba6d1acdaeaf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2ea8734b70660160a83e72c9f9e976cb
SHA1 76665928ad8c9b526a004a52dbb999e86656f921
SHA256 c95ec991cc32e13d92291c9d366cbd08bc36f545dff5578c88e2c4c512eef939
SHA512 9b6202dd42064fd0e73c4553e0ddbd5487e66189ac1c00511962c9878e194976c8d092879de9602d4c3874c73a6ba0b86822a226f625403db28956ae09a11e1e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf6a644903a97402d5d20168be04d545
SHA1 8748d75dad8e7f1509cbcffc4c98c43db0446943
SHA256 b6214378dfbf7b96816420c9593ca27e9e8ca5ac94fe3d237adc2e4601d55b74
SHA512 814c682fba14cabebbbd5785d84635df35c4bb68e4945f8340414a2f34477b1b4dfe462dbafe8ce6a9aef003d9f263f21896bcc4bec01ee77f83410f9730d79e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 60effe9968d4b1bc9cd574616035e7b8
SHA1 a64e9901886ba9b5b50f6ad86c3142c2871e3e0b
SHA256 0e64ce8c6ba41f96e9652848133a6a3ee4dc61a02d7e656d484d9ac6a34e774c
SHA512 5847617504698703bab0f697a0813dfc28c91a898cf0aaadbf69513c01a03890b7aa7416ddde9ba49f3a9a323fad12e5c8ad480198b7a43fc912a79112dc1f62

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53c59f932f37172f8372a36098e7c802
SHA1 218669f03a67fa5fe2a298b4d1e63a9f546ac27f
SHA256 d17a1b2956b0d53f37a91898d5888b72733eb463b12747ad662232e66415c5c2
SHA512 d8a3280e684bb99d4407d2af5281d69af6bdba21388fc6be50c2ce1be1f42da60ded3b1de0a6c97a13d258c57ddb4f8aa8669ff3e527d556cbd2c26dcce35e62

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 66d1cb9c0c201cdf88633e6c6cf5d67b
SHA1 c14a73e41911de0c519e1097bd397562ba1654ab
SHA256 9bbd7225e87dbd38bba179e4be4bd0cfb854ff9c3db884bdf3cd1a08d3a23507
SHA512 552355ee024939aa2e93b18aabb74942e80c046135551a14a678ee7159d01c9e5e0c6c1e342b79da64c5044b7f3f003c36665f209585bad8cc6b771cac42bd21

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\fb[1].htm

MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 681a93ea6062dc97110e0560c9a7ba74
SHA1 08bf412c24eb3a8247301097e4a4ac3f37ead147
SHA256 c2e2e27660597665ab86fc62da668e3bbda96e8216923000fa59854d0fb1ed17
SHA512 ddcd3691cac05cb24845e29b802cae77557fa83fc988519ec7fa8d709a4fd354c41600843b7f3185ac9a75a5adc1c6bf99a47b5caac572e1cba3f1764fd84323

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 371cfec98e7a29420efa19e3bcc3cc38
SHA1 f405109c6114a6acb5f13f2eaad2f0e0327177dd
SHA256 c5c5430d72774fe2c6f40c6102cba9c4b2889a4c6d2b6ce67e9ab4d319da0b81
SHA512 21932049dcc4357c02d566fdf9f2517de801e027146d9894aac7e764b61a2df972cdf44dd871f7446c4bcb0ae3bcc94d57ffc222f793b9740f25a21c44852851

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d4887f348fa8f098c348d3f813f660e7
SHA1 6b503c662c7e37ec25a5c3ffc3b1eb195f848178
SHA256 9757b86dbd4e27e8c072f767b1178dbcef4c9d82c44619a2527bd5c8be2aba9e
SHA512 865e668b19d50f27155e0d9e02c69ae108ab8aac7cced156f30d34384f167c73947504d39fc2bcbc6f1899e70b219f7ec9608f908507ec81ee71e06931b6cf05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6078da337e44be82c95a8a47835dfefa
SHA1 f1bcda3808c6d05c1828ab0d04120e7e6fec6afe
SHA256 d4d078cd7ab4b1b513c6237daa50a1cf3eb0593e4231c9265bbbaa763d72ab3f
SHA512 14cc61909206fd0b4f73d21f1dca07317449f550949006f745c6a18b855864f03dd218a5d91bd18e1715118206e1342bafc34f6fab794b6be31962cd73251ad5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3787089c7b58c3f3ecf6b428a51b482
SHA1 3062f47314018c826f786311fbdda41b333d273a
SHA256 9d447cfd414b39579aa2e798e49edbdc0b038872d982e57e987ceb4f1b2940e8
SHA512 823ff433fe678925d6081bb644c80a7fc07cf3d43f921fe19d802be82c8330692eae662c878d33cf46f7419a0735325e496229f3bf81939d73267eeedc5e040f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\cb=gapi[1].js

MD5 63e5a0b45632b3dde3694ffcaf0e3f7a
SHA1 923736d0cdc308331d5cfaa0ea159bfedc83d53f
SHA256 889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db
SHA512 5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4b716b360493b880c6680a4b028bf1b7
SHA1 a24dda9e8bc1a8ee8b445ec7558bc66e276a91e4
SHA256 c0e4eac4ea35f371703b696ffdbbcf196d8f0109e2205961db3812c53a59b078
SHA512 8636271b29f3744dfda77c2e461ec8dfaaa0cbbdc5df0bfa479749d556d351da042aad1864e3aa5775c0f14a1783e09f57ae552a003d7a67d645914cd17bc26e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11589bd1009ded066c4a5efe104eadba
SHA1 b7a1ebcf63fae686aefe1893d66a7bdc427ec45e
SHA256 ff6d9c33b7e9d50968a40b4a9862374eb16ee4392ca16457e5188bd46c6356b8
SHA512 c6f88122cfadfd89260b51fefb09cdf16e9209e44b2cca4327a7a5a0f65ab7809e9688c5da30580d2cc7a6b54caa03ec41dd5d06051a0f834baaa49d3b35098e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 139ae80043e41eaa420f0a38b79ab8de
SHA1 62907d0c4dbe18ecf104e44ab95fe931bee1ac17
SHA256 5b2e8f08a63a73b127a1cbcff06ccf41eecd87ea216345a00752e4c73b68c49d
SHA512 6cacca07b219e898cafe7624615df9ab63e5b0b041c18133f2cef50c64731db15aee0e2cf90025d56d9fd521048eb61a9d2ba26eae5e4da2d081cd07a5dbe031

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 454f9e590513fb463bb236b8c7f9a4c3
SHA1 a650e9e419bf599681619a14f7bf06af690f8b0d
SHA256 b37155fb601bee40976395e8531a0d833e6f39881216269301c04057005b2227
SHA512 42ad0882f950107faf02d49dfa813b58ee4a7abc48e3ba26630de1c46c04f42a6f119d5c10eed5d0d6517ce82c817672ba0ee31ee4c9303bc71fa07f81a01219

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 741b7097ed3cc662225bbf3ec3402010
SHA1 a10a400592229d28509c699b235b85a4186bddba
SHA256 1d45eb283cf0ce85912d96639ca83e2b6843f73b54ae6d82cb39f1b13fd1829b
SHA512 9afc8ab3c1a32301b4de49163be87d251e9bb4ec6f4eb4ff94b70918373af4de6670ae41d7c5abdc28839a2b314683c78d6ca7637e281894221cb8f3218060ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be21e15eecc5dcd1331ea6e8074d5bcf
SHA1 ef56782abff80411ad36b23e5e19075d34b5cb2e
SHA256 52b8f8e19bb363280d5b50a143a9a7102feec5c4deb5a576832d923f1cbba534
SHA512 9add02415ef0355c514c85234a8acbc1e64b86cf2ab4cb280437a7f74e25dba80e5204a0ff70e9e3bcfc4c4c450ac20e70ef7f42b6829fe3e30c49b757df24b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 36955a7334858a959a8ce14bf4f02960
SHA1 eea426ca20ba9828506af15fb360759e4a447816
SHA256 e686598cf8f335d9caad8d7c444b4951a9af314ad30aa61001d8ed8b04f1b481
SHA512 6824dd09f7fb709d99ff3281e4edf7fc7c5c7c393d1a70d119c8627ea3c239654d706dcbc2a1a85949ad8973bb372e2934836fc243cd4d7ea01735e30a8931fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1d6a5b46e973dd7c7f2fd30485b6bc71
SHA1 77cb7a9959507160b66f32c4e396eeea68995eeb
SHA256 33be76557fb7a75a93a855f97cc17fccbe5d0553b7ea9e2279134db506df6a74
SHA512 b3f291886b7c743e0a90e9b40c8cd4a05a8651e2fb5e804273d9956fe81e82db9eb27bdcc9184fc282fa9512459f2fe8b6689dfedfec9a90d819a1056c77121d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 670849da1d8ad4febabe0693eb4414e1
SHA1 3fc08bc8cc143b83af7670a16287c1e09752a5dd
SHA256 90818dd5aa2a0da4ef9d13d9854aecb4b65e67e1011ae90fc8f1ea53d180d322
SHA512 51af87f7f156523ab30cfe9595e971dc5ec1e3fe771cd3fe1a0390e03543d7b939c78dd507fc1f3d648b4efcde253dea112ddb1efe5993f82f1d5ac9018cfd5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d8e24b952e4b991595d0ef68e794b4e9
SHA1 23a8f8c8f7e95997b643e6a2d697ca3a09c67c07
SHA256 80bd14f6ea67fc8a2be9c66f8c632baef53991ba318c34c2e584d7f28ef2b816
SHA512 9b925a4f28e2c5e96ce3ab41198baad3b6a681076b88d4fb1362a47fab70299c2d496e7364236ba0b46ea46cee88a2c3bd08c2f0b1ab168a6ff0ba41cd2ae407

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08f1f915cc4f3c741c51b66f3a73ac0b
SHA1 826fb44544099419fc3a1d9565e4c97df8a219c7
SHA256 c2ffd402dc3c5817a1de370bd98ea78bee14ada52f950c06c5f68e1543e4b363
SHA512 3c6aa7c5184993ea831f850f115c6f5ca707ff7aec459d7a2ac121b4cff9bdd703ddb92b440ba2ddb8e416d071190d6c58fe7e67feda4fa62517f10dde76c0c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c924a0da22acfcd75597ce41e2212923
SHA1 0b3bf4d9310b645c697830d3bc59583e6a12b981
SHA256 df178da73e3814efec337f7cab7be22e03f2334f721b394834459308bae4fd21
SHA512 c211e3d527ae4ded16e37536405afd60745052254b09a2f5dc4c674d4c95de960169b9d7f4aabcfc8c602d7154d948c2ead64af7cec4f679bf0dcc7885615a56

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99ea2552469e1c13a80e9c8e5d3d9b9b
SHA1 15658fd3e9dd991fbd8186baffcd4904b59b6194
SHA256 a3b93bb90213feba173220af8b18f424ef05d95cbdeeefbec5002cdc97881f67
SHA512 d4c4bfa77804d1d532613a27dc1005e1898098e49fc07e59cbb38d01664eee0f910190c7d31e1ee8f0ce6a152c2e9516e7bfed9ba73cc53b2d9e6bc72ee5b282

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\rpc_shindig_random[1].js

MD5 23a7ab8d8ba33d255e61be9fc36b1d16
SHA1 042d8431d552c81f4e504644ac88adce7bf2b76f
SHA256 127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5
SHA512 e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7634ca7293dba6b1d6ee1f3e834c04ae
SHA1 fa2b4338620ec24dfd056ff2681ab9aa162c7589
SHA256 d2787de5e18e44aa3a1e743d665bc752c3ce63183ddaae2843da9396f83ef3f8
SHA512 0b40b5b063969011cc4ddd77c39217c2e2869de60b566f2a120692dbee3cf08dd5aceac2086cfb02863ae51cb2059717f4de4cd4477fc1d8431bad13c252ec5d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 605fb2257b01c094e93184629d44eebe
SHA1 1e0939e354cc0bc6830624e8c4eaff5e4c3edd06
SHA256 ae05e073f4b05783d18a283822c2d0ce92b28c3d42855932a5dd22edfa37bc3b
SHA512 aea5fa6aa068e38df6faf3834308abb47e95eed5a3cffcb6c18b68a8223b78250b9289c43606c7b9c92e5188076399b54f28e0bc3f9a985b7bc55f68751678c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 1b7d43a64e651a7ea64d76673a149ec5
SHA1 c0e61ba247e1e656b23b03c880e0330f5fe43b01
SHA256 efda8f17db23d1c8696c398c2dab62e3a0885b874384f3be1e53edddbf101944
SHA512 6c06ff797dcb60fa6c4d7f5a1ec4c066721c357f6b69a9fa3665b1dfee7b62f393ae17100b518a5fc9c484274ce62fbfdb209ef14588dd6704fe2b9432597835

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 959629928161216595cb7a58f8dd0a2e
SHA1 2c8229f8ad50c3526c1ed260bad5a5871a34291b
SHA256 08db54e2df82b36efa8eb3623f7c37286833c0fe7c2495f56a37806828ead676
SHA512 f29df46c449bef38f782a1d363c7efa45bf9418ff860e078fbf6230f13c9adcfc21f33b541da8707894e9e4998ebbbae064ce703e12b4c3b6e1913d21eb1352f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20d67b8f6d847ea15d45fc7986377d7d
SHA1 bdbafa4c8f96dda8f9c23d30dd76559b9b67a4db
SHA256 27378138bfe555537fe4b58ef6deea9129704221d30dccfcab3956b633c96552
SHA512 e097dfd3c49e492f8f4239bb202269badb64316be3c1942d1b87a222e999f63913ab0382027fc7a206d0e98f637b12f302800347285f7a80feb90c92e0e14e14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1d9a51fb3ebc480142029fb0a6ecf05
SHA1 8f6cd3441ca310dadeea602da709849c1d5f28fe
SHA256 cf7e0fa5b0ab47f9c099ae6f0adf10f510ac6af6f586283c5b421fdd6eed8045
SHA512 9be79b27e10fb6a3e14478e9ac23a78d0bc3b2e9ee1040c4a9813b9988dcc73715202e0bc503afe88310bacb58b9089739e166612d3421db3f7261f90d4bf48d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e9415319e2553451d32d3457eef56fd0
SHA1 d89597bac1d6239c1a90ee57c991ae1d4909062f
SHA256 4d091e967909433bcc7927b2cc2f129dfe3e2508a0ac5e6d02b8b1b1db87237c
SHA512 9633be970c436bcc0f42e87522e5db21e33252af17be0bec4695c99dfd6ab0a001b154cf516fd1cd6a36b129533765f07cb14247cc32fbdc0dd66959148d2a01

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f035b1e83d93e795b10c7e9b148aceb
SHA1 f9c3c29dc0f3e28137bc01a745bcd96b0e9656fb
SHA256 cbd43c3ac7504a403efd3611744592df293fafa818f4b34d70594817051b6fd1
SHA512 c28bc051718e956807671fc4bd19766a365bc89923af201d7c65bb99c1845a1311de053136cd8bf75c17939a532fbe3290b7c6a6180237e5ab8a5663f956a0b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e89346aab3086fc016494a74231c4c6b
SHA1 10af9c55a44cf922daeea0467b290375998253f0
SHA256 b8e36e3b4e2a3833e2c5f226f18896d8445f4f4a264d48716534f96c0a642dfd
SHA512 5e98710806ed9ee0dc871ed8232069ce5512f3388c089f8e9149dd04990f2e9b12025bc905dfc6bb28c6f4ea532b7738a82c08dda8117b2c3e1e5030d67fd9e4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 8b16c648be575e3e30c32f1174229f46
SHA1 2ec263e3fa6a8ecfa93d88648dffaa89b75724cf
SHA256 9f6d3c0c741afe7de0d3c9d8c334313625cc6d242427c6d61aaa2dd2264c3932
SHA512 087f23b4c0b35554d7c014b3e34561c6fcad604809c7ab8325c5f825125d493778713f6d68015f4cb7a99db995d3c538c8b61c3a9d042f677537a739f98b32d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9f31aabdd5f791ccc131b70851b97ce
SHA1 25f061484fb59ec6270000ba44e097e188841054
SHA256 019087190c9478566fc2baa341e2cac87a72f4b01b38dd7da6fe3f76cbecf4f8
SHA512 4313f6dcb685c40e34aa23548ea1557ae74bd2c1d5782c0d7541beb18f01f021a725249250cb5114dae2a015ed076e001507a5c3f4047401640924fdc22f7a40

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8cbde3bf501802dd3561ce7a83c169c2
SHA1 f87ab0bfbdc5e05bbd4cf0ef6b441c22e63de19e
SHA256 93e6e1768cacca2f7ed149af302ade7ef210beca34b931042cb87a6993203746
SHA512 26fb381cc6c7408cfaf74c61d6abc7b6e975b371244238c177ec7eebe940268535f1a6ffd533799fb8c190e33bf9f7f64b02899f029a6b2e06651d4a35c35832

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-26 11:46

Reported

2024-05-27 12:14

Platform

win10v2004-20240426-en

Max time kernel

117s

Max time network

120s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\756003a7c57e4a8fdbf9447fd78f60b7_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4784 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 2424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4784 wrote to memory of 4608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\756003a7c57e4a8fdbf9447fd78f60b7_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb55f646f8,0x7ffb55f64708,0x7ffb55f64718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1645687948616052998,9256187467616883036,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1645687948616052998,9256187467616883036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1645687948616052998,9256187467616883036,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1645687948616052998,9256187467616883036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1645687948616052998,9256187467616883036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1645687948616052998,9256187467616883036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1645687948616052998,9256187467616883036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1645687948616052998,9256187467616883036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 sabarmuanas.googlecode.com udp
US 8.8.8.8:53 makingdifferent.github.com udp
US 8.8.8.8:53 cuerosb.googlecode.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 142.250.187.202:80 ajax.googleapis.com tcp
US 185.199.108.153:80 makingdifferent.github.com tcp
BE 173.194.76.82:80 cuerosb.googlecode.com tcp
BE 173.194.76.82:80 cuerosb.googlecode.com tcp
GB 172.217.169.2:445 pagead2.googlesyndication.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
GB 142.250.178.9:443 www.blogger.com udp
US 185.199.108.153:80 makingdifferent.github.com tcp
US 8.8.8.8:53 yourjavascript.com udp
US 13.248.169.48:80 yourjavascript.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 153.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 82.76.194.173.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 13.248.169.48:80 yourjavascript.com tcp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 www.hostinger.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 104.16.147.108:443 www.hostinger.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
FR 172.217.18.194:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 108.147.16.104.in-addr.arpa udp
US 8.8.8.8:53 mesinjahit.web.id udp
US 8.8.8.8:53 www.tokotigamesinjahit.com udp
US 8.8.8.8:53 img2.blogblog.com udp
GB 142.250.178.9:80 img2.blogblog.com tcp
ID 103.229.73.90:80 www.tokotigamesinjahit.com tcp
ID 103.229.73.90:80 www.tokotigamesinjahit.com tcp
US 8.8.8.8:53 media.go2speed.org udp
US 8.8.8.8:53 g.bing.com udp
CZ 65.9.95.40:443 media.go2speed.org tcp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 90.73.229.103.in-addr.arpa udp
US 8.8.8.8:53 ho.lazada.co.id udp
IE 52.19.123.128:80 ho.lazada.co.id tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 40.95.9.65.in-addr.arpa udp
US 8.8.8.8:53 94.95.9.65.in-addr.arpa udp
US 8.8.8.8:53 128.123.19.52.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.187.202:445 ajax.googleapis.com tcp
GB 142.250.187.202:139 ajax.googleapis.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 www.blogblog.com udp
BE 173.194.76.82:80 cuerosb.googlecode.com tcp
GB 142.250.178.9:445 www.blogblog.com tcp
BE 173.194.76.82:80 cuerosb.googlecode.com tcp
GB 142.250.178.9:443 www.blogblog.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
FR 172.217.20.193:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 185.199.108.153:80 makingdifferent.github.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 www.jasfora.web.id udp
US 8.8.8.8:53 www.facebook.com udp
GB 142.250.200.14:443 apis.google.com udp
GB 163.70.151.35:445 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 developers.google.com udp
BE 74.125.206.84:443 accounts.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
US 8.8.8.8:53 193.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 84.206.125.74.in-addr.arpa udp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.9:443 www.blogblog.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.blogblog.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 172.217.16.225:445 lh3.googleusercontent.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 172.217.16.225:139 lh3.googleusercontent.com tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
GB 172.217.16.225:445 lh4.googleusercontent.com tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
GB 172.217.16.225:139 lh4.googleusercontent.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BE 74.125.206.84:443 accounts.google.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
GB 172.217.16.225:445 lh5.googleusercontent.com tcp
US 8.8.8.8:53 lh5.googleusercontent.com udp
GB 172.217.16.225:139 lh5.googleusercontent.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

\??\pipe\LOCAL\crashpad_4784_WIPUZQSJACTEYILV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e5a91f60a24d5b495488b8c5e08f7c17
SHA1 236a681b45dab06e95569752763c4817e645a117
SHA256 c1ff4b95423b09af09be8532209d67ee4e62a91960aff30e63d4e8ecc0ad2fc9
SHA512 823f5fde37fa743e8b0cb8051291f1e9c31db71be43d99c1fac1f20c6d9a091aa3eaa83a171c8eb4f39745a3ff37a65619a251b68d65441a7ea51adcfa77b2b7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 26475bc00d64d2345c2a49e8e61a87fc
SHA1 7cb4dd2285e9b1067a75721f0067608fa9e1c451
SHA256 268f1ada11b5fa528c66496c1d4f75c2fbb9138a62e6d0a753d32f19778b840e
SHA512 d3beb3b547d414e48fef3df2acbdb1b36f60dcb8726b12990213f3a8721e18a393d55491d50308b361f24e77bf34cff49407350116c51abc136580955b483814

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 98bb9e37f5659df050ad02515a9ab319
SHA1 2ea5c07c023447c92c1df61b1044a36419903845
SHA256 f469d25f172f681db0ee2165d90b9ee11ae1011aeb4d40f0f2794392a0aa356b
SHA512 9e299f518121c4c7ac750a2f53543029bc1ea23487e0f2f4560c2b68af0fa43ff5c746a0c75285d0c58b44926d5bc3987caddd5d80d8eac98f214c9726bc1771

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 13828163a0d77139a98a23be0be70c5d
SHA1 e6212487b7adafe4c2e41cfdcf5773f110918a5b
SHA256 37e5d6cad806a925fc7dff3d333cbbfc2968245bb707520c12dc248362f18ca2
SHA512 aca801f112e9b51eef3ee7cdaca8777f407371ed3b51d5190054a43655af3128f381601dfd2ae46eb87433c7d3bdac47660637ad782910f8a1175c6cf6528c42

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580829.TMP

MD5 a881fd01c60708230d2fb9c02ec9ff3c
SHA1 1171aa8da1cd3edffb34cdfd0b0b1d73ed089436
SHA256 ea767eed983e6505a28929c89bca553eb5263b4a287c75567b5871f8ecf19070
SHA512 264bb00a1a34918657c2a1e2aee4fd88fa415dd259ee2a772f4b28df2ed6195ad6bbdbed1104a021dc8ef6f0b4dc487b7c1adbde71fd21b2daa71a7a27e542d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 873d5f80fc0ac5a66d13784ebb8864d1
SHA1 ce14bd168fda2a2d4a8769734839d98c81daf915
SHA256 acf8d762edf136670fd97043d26ce660496ed7e0cbb67b346b05517508231e9e
SHA512 f849ccb32790d97844603e9bb4aecfa0c26b19967e18070f45b9212065cf1277b7449cd79da83cc437466c86faafcab62e76278f04fc70ed71fb96095859dbe7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 5a802e1775fca5c5e4c7d7014b9ffd93
SHA1 fbf3e02498a375ff7582d0fd1cde611376733cbe
SHA256 41552c20f7e0a347fbdab0f1538d75c8c06b8e0325fc2397aa8f7d2591ef4dfc
SHA512 159da6672f2951ce5969d57af9efa8fe190e75234faaeaf915b889774b78b5389e8491e7f19ebf8a35482e36e6e87cf2ecdda4d4d9bb43ded84c49948d23e469

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5