Malware Analysis Report

2025-08-10 21:21

Sample ID 240527-ns69maba44
Target 7907c1bc981d264015b0cf4b63e02357_JaffaCakes118
SHA256 1a68ad26aa7f6dd23491d656c9fee80ddf734c17ad09a00b1b156be7c73ca87a
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

1a68ad26aa7f6dd23491d656c9fee80ddf734c17ad09a00b1b156be7c73ca87a

Threat Level: No (potentially) malicious behavior was detected

The file 7907c1bc981d264015b0cf4b63e02357_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 11:40

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 11:40

Reported

2024-05-27 11:43

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

144s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7907c1bc981d264015b0cf4b63e02357_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5020 wrote to memory of 4528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 4528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 3956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 5040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 5040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7907c1bc981d264015b0cf4b63e02357_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbd5146f8,0x7ffdbd514708,0x7ffdbd514718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6076 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 static.tumblr.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 192.0.77.40:80 static.tumblr.com tcp
US 192.0.77.40:443 static.tumblr.com tcp
US 192.0.77.40:443 static.tumblr.com tcp
US 8.8.8.8:53 40.77.0.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
FR 142.250.179.73:443 www.blogger.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 73.179.250.142.in-addr.arpa udp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 142.250.201.170:80 ajax.googleapis.com tcp
FR 216.58.214.67:80 fonts.gstatic.com tcp
US 8.8.8.8:53 42.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 170.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
FR 172.217.20.162:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 yourjavascript.com udp
US 13.248.169.48:80 yourjavascript.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
FR 142.250.179.73:443 www.blogger.com udp
FR 142.250.201.162:139 pagead2.googlesyndication.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.178.142:443 apis.google.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.178.142:443 apis.google.com tcp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
FR 172.217.20.193:443 2.bp.blogspot.com tcp
FR 172.217.20.193:443 2.bp.blogspot.com tcp
FR 172.217.20.193:443 2.bp.blogspot.com tcp
FR 172.217.20.193:443 2.bp.blogspot.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 172.217.20.193:443 2.bp.blogspot.com tcp
FR 172.217.20.193:443 2.bp.blogspot.com tcp
FR 172.217.20.193:80 2.bp.blogspot.com tcp
FR 172.217.20.193:443 2.bp.blogspot.com tcp
FR 172.217.20.193:443 2.bp.blogspot.com udp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 172.217.20.193:80 2.bp.blogspot.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
US 8.8.8.8:53 www.noseodavi.com udp
US 8.8.8.8:53 img.youtube.com udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 193.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 i64.tinypic.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 104.131.45.32:443 www.noseodavi.com tcp
FR 142.250.179.110:443 img.youtube.com tcp
FR 142.250.179.110:443 img.youtube.com tcp
FR 142.250.179.110:443 img.youtube.com tcp
FR 142.250.179.110:443 img.youtube.com udp
FR 142.250.179.110:80 img.youtube.com tcp
US 104.131.45.32:443 www.noseodavi.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.179.110:80 img.youtube.com tcp
FR 142.250.178.129:80 lh3.googleusercontent.com tcp
FR 142.250.179.110:80 img.youtube.com tcp
FR 172.217.20.193:80 2.bp.blogspot.com tcp
FR 172.217.20.193:80 2.bp.blogspot.com tcp
FR 172.217.20.193:80 2.bp.blogspot.com tcp
FR 172.217.20.193:80 2.bp.blogspot.com tcp
FR 172.217.20.193:80 2.bp.blogspot.com tcp
FR 172.217.20.193:80 2.bp.blogspot.com tcp
FR 172.217.20.193:80 2.bp.blogspot.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 lh4.ggpht.com udp
FR 172.217.20.193:80 lh4.ggpht.com tcp
US 8.8.8.8:53 110.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 129.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 238.75.250.142.in-addr.arpa udp
NL 23.62.61.139:443 www.bing.com tcp
US 8.8.8.8:53 139.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 translate.google.com udp
FR 142.250.179.78:445 translate.google.com tcp
US 8.8.8.8:53 translate.google.com udp
FR 142.250.179.78:139 translate.google.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 s7.addthis.com udp
BE 104.68.81.91:445 s7.addthis.com tcp
US 8.8.8.8:53 s7.addthis.com udp
FR 172.217.20.193:443 lh4.ggpht.com udp
FR 172.217.20.193:443 lh4.ggpht.com udp
FR 172.217.20.162:445 pagead2.googlesyndication.com tcp
FR 216.58.214.66:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.youtube.com udp
GB 163.70.151.21:445 connect.facebook.net tcp
FR 142.250.178.142:443 www.youtube.com udp
US 8.8.8.8:53 snapwidget.com udp
US 172.67.75.33:443 snapwidget.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 developers.google.com udp
FR 142.250.75.246:443 i.ytimg.com tcp
FR 216.58.214.78:80 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
US 8.8.8.8:53 yt3.ggpht.com udp
US 8.8.8.8:53 apps.identrust.com udp
FR 172.217.20.193:443 yt3.ggpht.com tcp
NL 23.63.101.153:80 apps.identrust.com tcp
FR 142.250.179.73:443 resources.blogblog.com udp
US 8.8.8.8:53 accounts.google.com udp
BE 74.125.206.84:443 accounts.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
FR 216.58.214.163:443 ssl.gstatic.com tcp
US 8.8.8.8:53 33.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 246.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 78.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 8.8.8.8:53 153.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 84.206.125.74.in-addr.arpa udp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
FR 142.250.179.66:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.196:443 www.google.com tcp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.151.21:139 connect.facebook.net tcp
FR 142.250.179.66:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
FR 142.250.75.230:443 static.doubleclick.net tcp
FR 142.250.179.74:443 jnn-pa.googleapis.com tcp
FR 142.250.179.74:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 scontent.cdnsnapwidget.com udp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 8.8.8.8:53 163.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 72.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 73.80.16.104.in-addr.arpa udp
US 8.8.8.8:53 66.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 230.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 74.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
FR 172.217.20.174:443 play.google.com tcp
US 8.8.8.8:53 172.15.26.104.in-addr.arpa udp
US 8.8.8.8:53 174.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FR 142.250.178.129:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
FR 172.217.20.174:443 play.google.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_5020_KLPYDDBUHKIUFUFJ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2bbdc36e3c537c24500ad8ce4f5b4da3
SHA1 78918c054eb3df7031804c285a7d1c89000efb67
SHA256 c0cc189f554cd744cd98b9e01622ead799aad12867c8adba8da0fb2178296c62
SHA512 3b1f56599212183fb758ce7befd2483985ee276d6e87558e8c34c65e84bfd84d70b3e6fc5263f49a0a46d4817c34b21b40bd5f3e6a01920bebed772a73978fb3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a91434e6e0f899b8f33636a4bbf334e3
SHA1 be7bf118cb5c0a04ed47204e656d4318d9e1ce86
SHA256 99fe9731b4004b7f8dee74823ed974f9cdc1ca3cc6bf94b45b90d1da6da6dcf5
SHA512 ece3f874c11df5840420b2d461b1ef8ea4925ec151d089ab5c7029660a7bcacd5509a903c0c62c7c17ee5737c9b4ec32024f8439b874567883e660f3f2938b8a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8ebc08c0080c662391af6c622bd789f6
SHA1 f75ea2900acfbc507e773b57203b0a6be147cc07
SHA256 90cc658f79ae447260dccc71ca15594fd91ea17143b21b9c6b164fb0001e2e9f
SHA512 0dfa0b17d3279d6365c873c544c4b5d7cd9774cb4cfb50d92e48da268103918f38b00edb5932a3e9b1738522c1743b3126fad1443b66fa3e452381b01c87f5ab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 c9b7abb0f15ba64626537dc7a4018fe0
SHA1 2aed3f6a85895a74a5885e58f269a20d6b9e9b87
SHA256 f71c99861da727dcef411dc77ec93acabee77b02bca885c451c38bb1915edec8
SHA512 bd93555224a5ede76a2c8c8007b9cbcc5f43f6afcb5062759b1b835b5eee60da471c575f840e9efd0121045d4c8f61ef0c9d2bb7fcdc2690e6f4793ba3544b75

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

MD5 dce1011360b966da40f760b23df1b72e
SHA1 4a463114391945d341c29c85892a20d1dcf5eea9
SHA256 a5e8a84b045d2b31be72de1f96c9f21afc6cc2d80d361ef1485d3e0697600e9f
SHA512 462a924c0689da10edf417dc9ff7176dab361251d18bd173adf175588c329684ae136ffbdde5a9da459562784c40443121cf5f73b52f86a1431fd4a23da0d563

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 936eff5460aa0cf4b81f4ee7a350668c
SHA1 b99ed34eb00573ebea4a2134bdf1a46a2b7920ce
SHA256 1ff2cc467de8aaf6afcfcfb4f23f51aad6fdd49813eb5679425a6a752725161b
SHA512 141a254899d35168358deaa9e0a828b941441500fee854f981077ec1fcdd991f4ba94b5faaea7c930f3a159fcdc85cb4076dc442c8de83e3497f3fc387d068c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 86a9152ab86edccaac344059e9426293
SHA1 dfe157c9a92ab4d32149118a29574c6e8e865146
SHA256 ad3de2ee52c4de0bdc36647a9b181e7fa5ef15c8d53352213e993676e8a40b90
SHA512 d9b235c877a5ed9f51b52eaeacb71c0937cd9b8e6b014e9773aa4558d50ce3c8bf3fb3356c1c7d8ab1d3e0fd532995a28d120e70d9b243d7eb056b930466cb13

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5912c3.TMP

MD5 f690c005c714e5c956710fb2b1534b40
SHA1 8719c87e207b222618c6f998208ef1a9d74fc36a
SHA256 e6dedb938f1ff5423e85b78c652b836338a5106be1624d5b80b2fabe44cf1312
SHA512 d5b0786f5b407beae94a77ea3ba938bfe1760664d60340e32b800af1c78c880ea4043b993be62aa193e6daee3ab6dd0617492ad104616c7756833cff918bdeca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d1348a33dd57b06f918cfffddd5fea6e
SHA1 898ac7adc63cf264573c0a8f9907db105f263a0b
SHA256 3b4a972dbe0116d28ee29789bb769514a9ec9a086f9ae0127e85d59cc7c0fb5b
SHA512 bf52435dfa52d39a8d96b0896ca009bfa31d4a37bf7d02cc6926395f9e9696b6730c9a786cc492c334fbab800e3f08d8cdcae50a2ed417b5a57968f285c59d07

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 63bf6f80233806ba2a8a2597706151a0
SHA1 b977a4ddfcc6897fcdfd1d100cbb3f21e5233627
SHA256 50a8388930c68ce719d0cdfe9143fa9ab1adeb59c2d8db97b4f1c199031029f2
SHA512 94b525a240d0d8f270a543d78de03572bf5c29db84ca65f672700929c1949dfc58c8c1985534315cbc0e0addd9305aad0a007e680f1986644375bf42d41cb0b8

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 11:40

Reported

2024-05-27 11:43

Platform

win7-20240508-en

Max time kernel

119s

Max time network

127s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7907c1bc981d264015b0cf4b63e02357_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "10505" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e7279af4a9209ed23e3d9de1d0e60628ba564d8feb7d111524bfb820090edcf7000000000e8000000002000020000000ada029d0cdabe22c2cefd023fca12bde724bfa4477a85ea1163d3519125fb4b320000000b8db7163dc0e3af6ab149614c114d960889cec6867bdd2c3f425a8296c131d9f40000000e5ef18fbce19168aa413a621cd990dfb6e3ccda33140d8b94e49ed02a57c784ce963848d9dbd3d9e471fcb99dbaea2b9d9a3bd297a7c71df0166934e4aef6d9d C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F21386D1-1C1D-11EF-94AD-7A58A1FDD547} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422971908" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000363e4313b1d99263d161e134f726f793fea219941aeb7dfb0c173ae2c2496934000000000e8000000002000020000000cf2950bde54073319ae3d0be165644bacad8cc69624e6f5bbc06eea3f7b20e90900000005157a704105fcee344a65874738c19d90f3094747fb51672c6dbfa22d7a3c70e40dad161f16f3ad494a0289b4bf2d1277c11ae4c394404b30dfe6fe2d007176e0bdafad1b73c499a9db5d1b7de1642ef03b3420cf5f2b649db80e8a2ae3c738cc69edec6be067d272d372d7faaea96fcf6a603beb7ba0996de6df91fcc0c9ffd96f2a3f0f34d66d91d84bdd958a74cda40000000e866024fe0a746360bf3dfc061e25a029d344777936a8530686185f024dbface83d60995515c20fe3aff21e578ff9819b5917ad0093b96074070b1aaf1e24723 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908424e22ab0da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "10505" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "10505" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7907c1bc981d264015b0cf4b63e02357_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 static.tumblr.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 www.noseodavi.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 img.youtube.com udp
US 8.8.8.8:53 i64.tinypic.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.ggpht.com udp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 142.250.201.170:80 ajax.googleapis.com tcp
FR 142.250.201.170:80 ajax.googleapis.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
US 192.0.77.40:80 static.tumblr.com tcp
FR 142.250.178.142:443 img.youtube.com tcp
FR 142.250.178.142:443 img.youtube.com tcp
US 192.0.77.40:80 static.tumblr.com tcp
US 104.131.45.32:443 www.noseodavi.com tcp
US 104.131.45.32:443 www.noseodavi.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com tcp
FR 142.250.178.129:80 lh3.googleusercontent.com tcp
FR 142.250.179.110:443 img.youtube.com tcp
FR 142.250.179.110:443 img.youtube.com tcp
FR 142.250.179.110:443 img.youtube.com tcp
FR 142.250.179.110:80 img.youtube.com tcp
FR 142.250.179.110:443 img.youtube.com tcp
FR 142.250.179.110:80 img.youtube.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
US 192.0.77.40:443 static.tumblr.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 172.217.20.193:443 lh4.ggpht.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 216.58.215.42:80 fonts.googleapis.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
FR 172.217.20.193:80 lh4.ggpht.com tcp
FR 216.58.214.67:80 fonts.gstatic.com tcp
FR 216.58.214.67:80 fonts.gstatic.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 104.131.45.32:443 www.noseodavi.com tcp
US 8.8.8.8:53 www.youtube.com udp
FR 216.58.214.78:443 www.youtube.com tcp
FR 216.58.214.78:443 www.youtube.com tcp
FR 142.250.178.142:443 www.youtube.com tcp
US 8.8.8.8:53 snapwidget.com udp
US 104.26.8.123:443 snapwidget.com tcp
US 104.26.8.123:443 snapwidget.com tcp
FR 142.250.178.142:443 www.youtube.com tcp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 accounts.google.com udp
FR 216.58.214.78:80 developers.google.com tcp
FR 216.58.214.78:80 developers.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.153:80 apps.identrust.com tcp
FR 216.58.214.78:443 developers.google.com tcp
US 8.8.8.8:53 yt3.ggpht.com udp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
NL 23.63.101.153:80 apps.identrust.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
FR 172.217.20.194:443 googleads.g.doubleclick.net tcp
FR 172.217.20.194:443 googleads.g.doubleclick.net tcp
FR 142.250.75.230:443 static.doubleclick.net tcp
FR 142.250.75.230:443 static.doubleclick.net tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 172.217.20.193:443 yt3.ggpht.com tcp
FR 172.217.20.193:443 yt3.ggpht.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
FR 142.250.74.234:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
US 104.26.8.123:443 snapwidget.com tcp
US 104.26.8.123:443 snapwidget.com tcp
US 104.26.8.123:443 snapwidget.com tcp
US 104.26.8.123:443 snapwidget.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 scontent.cdnsnapwidget.com udp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 104.26.15.172:443 scontent.cdnsnapwidget.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 www.google.com udp
FR 142.250.179.73:443 resources.blogblog.com tcp
FR 172.217.20.196:443 www.google.com tcp
FR 172.217.20.196:443 www.google.com tcp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
FR 142.250.178.129:443 lh5.googleusercontent.com tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab29D0.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar2A9E.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 123627760fa79d5f879d495ae4fbfef7
SHA1 f85119e5bebe5241f991ee30cf11231721257de0
SHA256 c27d69b18887332ff871ebfcd0a939e676f5a3cc9b80eebdbd6280003c4c60fa
SHA512 b2abc34f7d054053c5283bf7350a28f00fbcca86eee893a58c7a0a272c3577df5a0fdb40e719b5a6bbd08446cef540f28baf4a1379d617abf8e6a1154cc22c32

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 2b79576931f7278028f9fcc700d932d2
SHA1 84f199382ad7efa564324e559dd9d0586d518fd7
SHA256 990697f2eed9d44971a4eaeec7c0ddd2822c683683bec33dff51ac1fcc07b059
SHA512 1aaef7b8a3e8e5e9dbcca8daadef4951b1467d76c4a3cfb39328c5dc21431bf68bfb1660ba403a755504e2611f864a27847a08a5d3dd6b63c7489d230f99ec24

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\css[8].css

MD5 b6167f9e6bcefee0c126bcb7cced6563
SHA1 d52033892c609c9d35df72f4e9e7f73e2a598e73
SHA256 82edca5d24a38ce1f29bb55129cd3aff8e0b4060f657c44dbc3c1f96cedc93f9
SHA512 d3da2baf01ba983ed3a0155c3102c9d176656a3ea5b62d10d03b01db53613d70953c6efee79d2a84669ae8f03a4d68c106dab2429e4808fbef7d08000a19206e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\platform[1].js

MD5 e66acfdb2f1dfcff8c6dba736dd4ab6d
SHA1 36026360b6c8d750488ef2c739e04969f8c5bcd7
SHA256 742841b3cf614dd55ce486a7335018bd1992c4d05ef74b45a0781318075a99f3
SHA512 113b6e50ded2703cb7a484a66250a38d74833ab9a994dc54042abc95500fe7405f9e5f384186c15bf392c613420a19108482d279776f6e2fd00245b8bd892fbc

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MEFTDE7Q\cb=gapi[2].js

MD5 4d1bd282f5a3799d4e2880cf69af9269
SHA1 2ede61be138a7beaa7d6214aa278479dce258adb
SHA256 5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693
SHA512 615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08b280343b76389a117ca02e65ea89a9
SHA1 e7dc624665f35daea32aa7f8bdf715f2714a0a39
SHA256 ec502609608a79a9ca5becd99830ef95b29fb7f3334b554ae990e29b0f534bdb
SHA512 e102fa2c8a8cddbdf69b6842a8dc53a3d74cefe3fa71114a71fd09e24a522ac19688b6c381e9f376fecba0f471d64bf166c50756c7fec93f4cbc7b27551d0a42

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE8R9PNI\www.youtube[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE8R9PNI\www.youtube[1].xml

MD5 8cbb849915c894dc4efe30e858d795a4
SHA1 02fc0a3f5426cdb69f54d38961e5613ccc42ac57
SHA256 5457d32044cd3be93f3d9e78aa4dde9d983fd4e98e56533e810ef39a025305a0
SHA512 17233081f943c8d29cc9a9e2b472cd19d931cbafaff70bbd3e0957077ae6c1b4b5970efb68f94e1e686511df1128fedad79bca65cafa54ba9c2aa2ee14dafbe4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e0f25dfb0fe83c775102b70026f0500b
SHA1 845286ccdef7efc621ceb16d4e42c0f596946c96
SHA256 d562a3f56d697d3f1e1d50cf2352422e0aa573bc4e51a2021c7e9b68d6f5c3a4
SHA512 a1bafe22648a4a579efe94c3d06b4c07122700181c8ab0686e4efd469e503fc5fae966ac252a347a1f7a88c039bb64570e63fdd37f1f7d05251b442a4837d2e1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52G8PVLC\analytics[1].js

MD5 575b5480531da4d14e7453e2016fe0bc
SHA1 e5c5f3134fe29e60b591c87ea85951f0aea36ee1
SHA256 de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
SHA512 174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2370d00277f4392f4e209ae35893102f
SHA1 d5889b86e8586b1baa1038bcfefcba4e021aa445
SHA256 e8ca20eeb8f879ad115232b103c38eff4e56b2281f2fa6f097301d42e9b93537
SHA512 93c6489900d489c15507e3a046782277827a84c8ea4acc3dc796bc8ec635812c9ee845b9723a137e2a46e13e5ee4d96b9418ae792e7cb049d21834ec9ca13130

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a0a623ee475567e7590748c50c797f97
SHA1 83ac8aa6221dab78b36f672fcc0411d50c37bf2a
SHA256 1777ac24ece49b7e11122b5b6ba8f2db135debe055f063186f1ed25c1c37aa98
SHA512 81e8a9f578917c1eaafc89aca3fc9172f36be84b732bcc9a7ddef6e5ca9e2e328cdee9d1a132b9403ede2ce83389301cbdb202fe54af728c610452a745435612

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 43c6d09f6b44efb3ef6b07c1a36ebda7
SHA1 8a619cc8ae8a40c5eddb246cd65bc1043b52b65e
SHA256 2557bf52327c66641eab012cc15b4052d1c03a48eb89b13d95f54d7949824d27
SHA512 1aa87436594fd04a6c93e40ce23b69723873787b62db8664e29734e1c03ec8334e412c49ed5b41efd2ae4a17fff5cee19ba4cb972745db78cd3d240569fb0fb4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fe7e4383974ce1c2f83361108e7be37c
SHA1 519a9703f5ae6feb7a67366465b74f55f65645c9
SHA256 9fe57d703aacd74dfb9208259d504d2cc3bcffaa41de995da7d2defcf5991046
SHA512 fef894d4eab26843e090685ee16201e2b6b1de816f780948661c56bac3e758662cb64575cd5f26fa02d0d787eb9e28fc9b7e8c7b40e821da5d235b2f67a79519

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE8R9PNI\www.youtube[1].xml

MD5 b220f8f31c206b46c247fe091ca6e0ba
SHA1 d084b6465a73cf3cfd404b73183e7e5b97ec0665
SHA256 c251ad7da39d34e992ac0863fc170bd6faabc3938d087dc4ed5a01fae9b5354b
SHA512 9526026686fac4f6fec91e477c54f390adf63e390fe52f38dca783a4c533be988ae58d54e787014ce92542e3388d80b33b6c86f895b7928bd43a26e61e2909c7

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE8R9PNI\www.youtube[1].xml

MD5 7239b8763d738fffc3867b9763e404fd
SHA1 33830f30ab3da6f596e009c17655df8a5be8f5da
SHA256 f0bf6fa1501572bf9f4f9fc87c86063b87a5a8c197a78305bd44e2d887fc54cc
SHA512 02f89338b6d21924607b3fe2216fc968ce6a5821e517ad459f2355ed59df7ace4ec1810e23e413c8882f4ebac969c8c82abc20c22a60c75da045ac189f25aa95

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE8R9PNI\www.youtube[1].xml

MD5 e1c402bd267e4e6296dd6d173e411835
SHA1 a8d0639df479b900174214bcd26cc9cc52c6815e
SHA256 fa976c16abe974a0f69ac2f185d9261f251a6f99e1e643e64662cefda335a403
SHA512 391629be9f7da6a3f01f75b1ce8cd0c1fc3ba967315efba37d40027e53d99d1b4f37e4746dd13574c95587062cf72cc5fc2591ff10390e85ae96f4937958f138

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE8R9PNI\www.youtube[1].xml

MD5 d4da71e74c2ffa3aaaea82874df14d63
SHA1 b4344a26520a0795d4c7c030baef32ea8ddaeeed
SHA256 7cb625d63edd727faf9bce6b606ca8882ed040a6485039a256198fee14ded7c0
SHA512 d928a059f74b5bf50d1128d718329ae81197bbeb5a6fdbaaa50602ad6d67e8ed03e2e7904ca8e39c99a05d179573460faff6e60b4f6f2bcbfbd0bd43d967eac5

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE8R9PNI\www.youtube[1].xml

MD5 ec41f1518950941b5c3f1b6f046cbf80
SHA1 df22783f205bc9f921e420d2815e0adbdc8ce78b
SHA256 e7ee66ee40497c6514501d12e6be7b612aa584380228fcb18909ecfe7175e0b6
SHA512 1b809283161482fa086bfbb29d259ecd8908f62d76acb11d4f6f58fbdde037655421fa2592541e11a93ad700c65d517a3e720e9ac60e4a6da6b7ecfa068a88ca

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE8R9PNI\www.youtube[1].xml

MD5 73785fec224f3c3227b379bda80e0d73
SHA1 1702e7032840ced1c3e3ee654152ded66affe3bd
SHA256 95ce39e5605158b1daf4850fbfd5c7fc58d1409fe64aa4b1507e0c352c3bfb6d
SHA512 4e0cc93583ac35c2c7d958c9c52b37241469c2cb1aaeb7633e30434ce145789ca5892607473caeddd68db36f179f8d0e31e9a7f262122c1996c1c3587894ff4a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 209dd73bb3ca964446c770c5b35e83a8
SHA1 19c1b6021fc954a98361ddc7324169f2f130847d
SHA256 d145d9dc3d4f227b0e7de78f3a5c7499cf4f2f197648cac5f51633ca59fcf778
SHA512 a1618b8df2619e43802e6bb82448405e567fc5d7861af0b2e6795fdf09553eb680921dc271079d1d13122cb75e28ea6c771366ace72c3866f06f728ac75b0f7a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e1b8fa23d0fe86979386fac8bbeedcf9
SHA1 a03d358d2f8d29994f007dc5053dba487fbf3d4d
SHA256 c97564f2fd200cffc750b526f6b4e53cc7a816e06eb1f8463e53ffa0b2516059
SHA512 18661732d58dbc0db51ea6d752616e8d098e427bd08a72fe35bd67c111d0851c622ccabeb1d2f438f3ebfddd06c84aa914246901a696fa69104a9cb79c00f3a0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ee04d770442cac2a70ee9568c3e12262
SHA1 83dc8d6343f7946db501103b2acddb4a6c489e20
SHA256 07e6c8f49272c3f0d91fee470e3979b5cb93a3240ab10e5c356f2a10515f5dfa
SHA512 03328a420696a983761528d806ab7c3cbc6fcf8c4e91efd2fe21637f0bbb9c01e3893a9f23da112d07f1aa9c1ed694e9855cdc52eca181f115c8a92ef75886d2

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\UE8R9PNI\www.youtube[1].xml

MD5 9f94039986c738b8be5aa44061ec2774
SHA1 eff98bee2a229ca0e0a995a73b6bc0879effc8b7
SHA256 8b3bbb0efb13de67aaa530ebf317c9019f7a8ecca344ab0fab19edacaaee3edf
SHA512 b5a35133bedf4ad04d10ef14f72404b6e9cd8dd7624cc1d4fff6128acf878ce9c08f07450054237b8b108a21bd95381ebee0b60686221385e46504cb77da57e1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3a5e330a432b05fa2016ff346212d69f
SHA1 53cd920705fc5b31618293f929208005726b89f9
SHA256 ba72d4864257170586d25f3feb7e4d6436bc2f2485deaf6ac225acea43fd8ffc
SHA512 739ede5f5bf595383764ca700c69cd37047533878546f49d2369c3961b770ac745b1438b52fe11d0d798901a219f2f7dc26c5b036deb525eb84f95fb9f8326f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6afcb0e8cbfec3e0609cb6ccf73cdb12
SHA1 12435e20d0262ca64d6dee595a9d18fc1a6c25b9
SHA256 e211faefcb14900929cd214d5ee3f42c796d7cd819cb288059119b4e0a5f0c89
SHA512 c367a9304f5df04f4ec05595a775d47881efb1e0b6d4c00d2556e2c9e48a5155ae7c6f79ed7b2be41dba253ea2b28578b1f091f798bf513ec8dae519e78312b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 deadce53e9f2064b4cd3972dc4146705
SHA1 959af4a0be27d9cb6044cc7b3d9efa49fc10a1e0
SHA256 fd7480f13cbf79e8452e9394b173eef9283bf2b2abf4993b9bd5293d16bf210c
SHA512 a63c14228c052a9abc413bb10d24d1baec1b0449212ec9ae8951693677f06faa2f90735d00503960bb9ace3ec0f03ceb5cd6dc9b6f9fbcdc67e708b918dcbb15

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9da89c6f14293f143be71cc226e8a143
SHA1 aca060cba13300fff974e2105af64bfe3b012e4c
SHA256 e7f45d371e9a690ba560aae6d804a0999a0d0d8ed906f16e498f4ec3747454f5
SHA512 ac7274cfc151739523908de99a6ff9da9c56b6737d6385a973d763ecd170c2ef34977f100abb0f357cb828e9791dd2f978830141bad33545ad4df23f4d3b2f83

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c41fdbc5f6658b6ac4ceb4818ebfffd3
SHA1 9eae864437dd6b0e5c3d04798dafa0ab7f569138
SHA256 3e134e51fb90a540250c0e9ec7b34e35ea3897a572eb4b0a0857cb55adfa3008
SHA512 4fe526a5d746cc71424538e3709f5fff86ff2ead9e155d463ebc4718e728d82d583a291b5b181ff49e9dd0bb9c6f2edd6fc0a1f9ebfc36bc6c41c062e4fb0460

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e8ec2159263d3cd1b50f55c16a2bd5d9
SHA1 d2e083810c8c21606e0dbf62c4ea512750195e03
SHA256 cd82e4a613fcd65326a081d4f4f88bee1ab5ebb922831a440ab91a46a153a5a2
SHA512 83345b781b62516aded44e6f0a8cae7af971ffa02ec4f4d02b6380a50243e3df4999246e3a45927c8c793b13bbe27fe5022cbe580ef0ac7f2b349a8db2e61e9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ca00fe59ecd53a87994061d348ab332
SHA1 6a1c952c163ff26475230d1f740c8b3a4437894b
SHA256 188ada728e41da2d2139b142ad05598f40468fe01beb4b4ffdfee150a787b0f9
SHA512 c40fb60561d90b9195cfbf8164b8434ac661a7d7c9786fbf29b6c1089d6dc6433563f865fa1416f1a12e4301956b4df7d8c35741bde6f593f49dd195f5b0b177

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 910241b0dc644904d326eb531c5916c6
SHA1 65106012ec263d3761bee653cdfcc5bb4a4a414e
SHA256 5957948d9d8c33688840513123358ed537602e8e60eae8a313fb3fae37ef81ae
SHA512 8d2a958108d554d53801b55eb8afe1582f97444cbecdfd76d97f8748c057b34409575853a7d8de6210926ea2c3d7b5d97e9ede0914be4af740dccda577e48933

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a4668b6e280ef6d454c180650c5fcab5
SHA1 e167b9a040ea86eb28ec5f44876f61edac9e64ba
SHA256 195c550a4b7c82ccb76ce58584372b8053a5640cc41b66a6dc6c0457129f0a22
SHA512 2ef5457b76142bafbda160ca8e720db2449ea99c3fde9d8d5c2956766fe6d1c8d0832d69ffe40ddce503130e060633426e119dd713459aae6429289661c6a7d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 06479d51d2e8aeb9fc70533485e66ffa
SHA1 5e3cba780e3f2f4236ee249c9ebaa143ffa8344e
SHA256 fbcb231554d2c70740b402114dc515bce0e06d763d94892a0be39a0cf816014f
SHA512 5ff7d1fe1236fcd7fb67b7d546edaed62d7bbda2f0d2ff6b2d23f5a2f596f791aa3bdb1dc3d8d3f0138b8c0fe31c470bf2e2a8f91f8f1a6db5de132203b1821a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d64ad490ade69d4643ed6f08b0da8851
SHA1 04b3b24d40536631fad52d7586ced50902a6162d
SHA256 ef59cabfce938c63448a34ba682da9d6d8f26af0fd460f5a2f239641a7f6a050
SHA512 af0de343afad9808f1fe0c706e62cb6ca0b3911f360fc9edb67eb0ef7e351f01c3345cccfb04073dd22d6ba99646aa153af59b4235687b0b631865e698b5237b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 01f671da2502106a263914e0469739e3
SHA1 66c90a743376ea5120760ed18e26cf3ef4ebe0f5
SHA256 84a2abecc4a59e2174ca09fd3a8440fd29752c2bfa39448d60eada9aa31c9671
SHA512 a9040d4220a8a1964462faea1698f3897cfbab8b6873796ef7e2434b224d9f1273af870ba27be727767da0336db00bb01fa65687deef99f3720197f47676d352

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f6ff6ec57c676ac2ae9e077738d76db
SHA1 ceecc1f11444b8ac9e1987bb689d4384da7cb4e5
SHA256 6f0729c718bf827f1f2150ec3bf049d05e48bb9b3c0aa9461e3004abcb3918cf
SHA512 4d5eeb89679b7422f3ac339a77d4b7669955df24e19a90e6e59c39f885052fcf214ba897ee85f5bf25a833d74ff516debd9083b42263a0f7cb34f8b43184e3d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aba1ba38448773ff35d1d722a2b12d54
SHA1 34824636688547735d5713fc354a891c979fc97b
SHA256 2c88f1cfe62a524fa2264094773ffb9e8e8451ce4ba1c47c6f21bf01ece82191
SHA512 946408db14ab0c85e9bd3683f3751d653bb5af7f8b3f5bbee0b0761aaa0c4e449e200b57498fcc5634bdc07ace34bae2b163eaa5384ffb9a844cd68af7525a3b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e0cbe3501824511f77c06f0f1af945c
SHA1 b7a6ffbfebb830686712e6ca82137bb9efec5970
SHA256 06d4858000326900ed5eee5a017cb4c3e108647108f596010da75bc864eedd12
SHA512 1be5cb7e3b36cc91a29283b0c0d1ed35a76ede8974e0ce08b33ce0688ac42a78eba17e1ac955d916613f5341974e7845f42912d5be15370b6f689780c523eb02

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec1d165f398304ce4cba77f06cc406cc
SHA1 1b22d3709401dbd991a63864f9032f29faa44b23
SHA256 96ef3d04b1f259526df50230e429b148d0e1904f02190d350dea5b07fd166df8
SHA512 e59a55ec72f021f22c8a31da013c5b299e5efebb48f51cb158801294abad3b92ffef149b1ef19ec7122ffc3a695f21d4991961e88d4b2cff991186587efe6b1d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd66b65c7b0d74f3fc90ace53bc056f5
SHA1 492543abb8cdd3f8f57664465f461cccd51894ff
SHA256 2eb4f1158ed56e9db04ddd1f7acaa8053d00e53ffdaaede258f3bff34774ab81
SHA512 9c15ae590be3e36e6700e0ade28c3e6ccfd72636a12a6b9660d9b61e097db95d541700a64c64311ba6362e5abd9a7dfc2f9d69a6af8f5c748336d52ef9cca0cf

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\rpc_shindig_random[1].js

MD5 23a7ab8d8ba33d255e61be9fc36b1d16
SHA1 042d8431d552c81f4e504644ac88adce7bf2b76f
SHA256 127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5
SHA512 e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63