Malware Analysis Report

2025-01-18 01:00

Sample ID 240613-lcyw7ssfme
Target a4d5688232f2bfb397bd545e42935a7c_JaffaCakes118
SHA256 10d2c80b331d37ac4274795bcac521d1c0254c737666b1ee0c1fcbd231b0efad
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

10d2c80b331d37ac4274795bcac521d1c0254c737666b1ee0c1fcbd231b0efad

Threat Level: No (potentially) malicious behavior was detected

The file a4d5688232f2bfb397bd545e42935a7c_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 09:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 09:23

Reported

2024-06-13 09:26

Platform

win7-20240220-en

Max time kernel

140s

Max time network

141s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4d5688232f2bfb397bd545e42935a7c_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005948aaf99dc4084bb30c9b04bf71700c00000000020000000000106600000001000020000000b2af619955c96b863ecd22b7ba8f66d036b8ddb65f44b981c5dd00d4df991b10000000000e8000000002000020000000b818718a46cdc22bb01bda319312a7a7658a34fbc7bd3d88a678f50cb0ef050690000000cf0700d5fc1b4843dfcd47e12d4e8b2866b09f8a47a83cd1c6a9f03a8730e000a7db3e5627c1a7e459acbee3dfa1f50fc790acf63083e04e6ad9c2d08334c5f9c39ae83e693acd2e2be55c22c6b8ab8a3298a8e4ecad456a2cb285c4fbda30e68c7080836a7d592e8cf7781d06e1c32d36cb401be478acde10f5a078920e32243f103376bdfe7645aff09497b380a5e740000000c5ab51e9a99546cfdeb03801505a30bcc4ef810207818e0a2e6de7acb4753a78d28b29e732021ee570a71287543c91807ad013810e7c562c7d29befb0277837b C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\mangobaaz.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mangobaaz.com\ = "65" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mangobaaz.com\ = "66" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mangobaaz.com\ = "67" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mangobaaz.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\mangobaaz.com\Total = "67" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\mangobaaz.com\Total = "66" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "65" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A888E6D1-2966-11EF-8B56-EE69C2CE6029} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\mangobaaz.com\Total = "65" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "66" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005948aaf99dc4084bb30c9b04bf71700c00000000020000000000106600000001000020000000aaeefcbe16414b49c1bdbdb13de9eef271a87abefbbda0c8a693f4f8b169a10e000000000e8000000002000020000000ca8ddc05e30e92a57f18a0438b5613c24d7943ad71c84e15098c6fee11afef1a200000001b2c718c2361569329034fd8196d1224a54de3de627c04a57cdf92fda6fb66514000000079db7b3de8de45bfee853619abaf5243c9d158362be4bfc49317c00d3abe7d09c0cb07d376afaa312801513307e757eeb135a6d13e48b3aafad1bc6eb43267a4 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04ee78873bdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\mangobaaz.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424432504" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "67" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4d5688232f2bfb397bd545e42935a7c_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 cdn.hungerist.com udp
GB 172.217.16.238:443 apis.google.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.180.1:443 1.bp.blogspot.com tcp
GB 142.250.180.1:443 1.bp.blogspot.com tcp
US 8.8.8.8:53 cdn.mangobaaz.com udp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 8.8.8.8:53 www.mangobaaz.com udp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.gmail.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 www.howtodoseo.win udp
GB 163.70.151.35:80 www.facebook.com tcp
GB 163.70.151.35:80 www.facebook.com tcp
GB 142.250.178.5:443 www.gmail.com tcp
GB 142.250.178.5:443 www.gmail.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 mail.google.com udp
GB 142.250.187.229:443 mail.google.com tcp
GB 142.250.187.229:443 mail.google.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 8.8.8.8:53 asset.fwcdn2.com udp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 8.8.8.8:53 secure.quantserve.com udp
DE 91.228.74.159:443 secure.quantserve.com tcp
DE 91.228.74.159:443 secure.quantserve.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 8.8.8.8:53 connect.facebook.net udp
US 34.160.100.207:443 asset.fwcdn2.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
GB 163.70.151.21:443 connect.facebook.net tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 8.8.8.8:53 rules.quantcount.com udp
FR 18.244.28.120:443 rules.quantcount.com tcp
FR 18.244.28.120:443 rules.quantcount.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 8.8.8.8:53 pixel.quantserve.com udp
DE 91.228.74.159:443 pixel.quantserve.com tcp
DE 91.228.74.159:443 pixel.quantserve.com tcp
DE 91.228.74.159:443 pixel.quantserve.com tcp
DE 91.228.74.159:443 pixel.quantserve.com tcp
DE 91.228.74.159:443 pixel.quantserve.com tcp
DE 91.228.74.159:443 pixel.quantserve.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 cb85f3fcf86ef0de7ef258539cae87de
SHA1 c73288fff07885a62f8c7033b348863ed3b8cad1
SHA256 7430a96d94b1faa5363b7656b323ffa416fd262e0405e498bb143dc93443963f
SHA512 dc152f2e8c8f7e316e84f7a1f3996e02c08d582d6d0e40b8bf7171e359ea952a80b7452e56690b30fe98b4655d4744e8529a930449ef1cd853e377f86294b2d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f312b2b20ff3c9f93309653edda36a98
SHA1 600bb394f5f069c27391c89e72f7d39441f41c92
SHA256 f4190f9bbaf079a54561a577bffa33c221a2ccd90411afdf7b61253cc038fb5a
SHA512 e67ae2c349b4ee4348aece07eab511ea48dfc51c5836b0d4465af564603b8b47e7d953f3d5e5e487b3a37c37dc8e213c9838695793799af808818f9622df063d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 4a05c35aa8d761161ea6736987ff50aa
SHA1 2ea134d143c56180b23e2f19804a56429214369a
SHA256 ec20324f7c46dc795cebb6b548f5be232fcf0a85a2b9e794f72f66328e90bb46
SHA512 17d17342ef624dc66f995d477ebad307d747d1b2ae80f25f418832c7acb2f007211f7d3230f9cd4c30c211e78094f58afb78891fc4a0d962d2e52676d5399f39

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 e7d5a77ed5e5e906fa1169ab84aabec1
SHA1 f0bdb4669a8b32c2480b2b66b5e4538271eed42a
SHA256 62a3b1f3d144af4c2532d58f19cf1469bad0a9bffda18c52fefc259971b2ae7a
SHA512 44b1a2e0a23549621ca0cadb81cde4a089e3f3683d90aa00b0f1f9abb6ddc268b7c6649a891f07d58e4776ff8e0bc79e15a757879bd9fb0f6f12d990fb2eb58d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_DACC52A1882A05AED14688828CFAE295

MD5 6b337683b6aeedd5a7b43835e132a0d3
SHA1 f8ee7c5b0a000511c6c439a1336b9e1bb5c3e2d7
SHA256 f54ba5a9312b7cda4e953a19833e5d91b0aeae19c9cb7a47c7c21e09d15ceb97
SHA512 3ac4f336be0a071daf309db2edce56a85d517a24164579dc5aca13c4ef5a0bc214e1175821031e54fb33402193c45b557d9b635a2f156cad388c8c72ca9e309a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_DACC52A1882A05AED14688828CFAE295

MD5 a4c3e4b3f212ccf9719236eaa8f728be
SHA1 e017a18974a9969ca60ca2499ac54b464d91a2ef
SHA256 0641546fbe6a6bf201d918796cf5efa992632208053037f369a6173cc2afd39a
SHA512 c4c229eec604f4022ab0d439eb8b95bbdbb554d809d4571745957f0da5dc740e4ecb13757273b9dcf9f431a5b1ca40d53a539e2ccfaadbf7c161dba6b8b2734f

C:\Users\Admin\AppData\Local\Temp\Cab144E.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\platform_gapi.iframes.style.common[1].js

MD5 682c26af19b240f98d2cb951721fa54d
SHA1 18e58b652c7f82a55ab4b1910693686049e25d62
SHA256 96428f0f585a874c185d560538ad83ebfad0365d760fcf9fcefe80add9e3c980
SHA512 078aeef086271b7f9cf0f6e3a1e7908d7e38465a1a7a4de6f2a785147e9130551a2995e80600824da9341d58e5425d4505518e90eea9ffe1c64f4f41825a9660

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\cb=gapi[3].js

MD5 f9255a0dec7524a9a3e867a9f878a68b
SHA1 813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b
SHA256 d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d
SHA512 d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e

C:\Users\Admin\AppData\Local\Temp\Tar15CB.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\NIA4CA6F.htm

MD5 1a7d7fa0a408bcffb99af1006d69a161
SHA1 ac2ef2a2d75cda7fe4af4719de42139956e8ea31
SHA256 e7845a0ff7cd3baac29611a717a05692b680271979e51118875ee391dd1d963d
SHA512 6fcbc5179ec7129684df09506d82141a34cc8b16c64f6b9efec811f04852b3177973cde07ea2846c403cbc32b13e7c9bcf09dd4eef51988aba5770d3db89ab23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 303a2a2137a3c5fc013b8229466a7a5b
SHA1 b4afdd58f0025ae44a79592971ea9783bde39edd
SHA256 7496026d2a43107bde029df75fe4b498e1ba6cbb2cdbde6ba44cc2f6e71811b8
SHA512 ebb56faa380fbb5851f0dd8b9e596de62f26a26492f96e583495b0ba513df48e58a97b67430ba02c3b4e3ea73e8d3e9b3558e893eee94e834465d39fe03f3471

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75ef2f0b55e848be5fd20a3751550d7c
SHA1 5b2173f974f2e5f5a4c173bcbfa0f39317f02d23
SHA256 a2671d486a3e3004ea9415698441c2d1c9adf29d502800584962f7e1ed4ad7cf
SHA512 bbe3762a52785ab3530ae88cced37c2cd78216f226285de6b61ce272fea49e56fae2537d654d8b1443d1831b4f48e5ce8c1d641c1abe81fc5df5ea4616496fd5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b70607b0403d24600fa1aa84c8d0778a
SHA1 9172e72808cfd728648859214830d58e43852347
SHA256 7fd509f40b028206ac90bafa4bf36a4397ffe9604620f1c05cdd79d1afdcb335
SHA512 5683a98f5e731dba8ce8876375bde4b5aea2701001df196526ea216ad80a3d047c46e66681603665ba8829f97d1566c6264ca84e944e920ef9ae95452505aff9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 47b12281d90b1df7c184d1ade81d6f23
SHA1 f770d3d1610866cae934fe410d489fd777566bb4
SHA256 660140f14e94c57da4da58a3af697f33190061aab4ffe29661ed4a25b64795ab
SHA512 323fd20a5c024045438180ba28372d1a1cb85a96f5aeb8f257931d278e0884471abb9a3b4d2d002be1bfe711b92233168b183978f8456317b9c87fdbe0a4ef75

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 764f7c79708baa73912360507d0f1f88
SHA1 44224cf30b1caeeed0372d9784350983f5cc927d
SHA256 54d0a79b541efcb47dcd5970712e5ac20fddc367f9e4ea6eb9e25714492b58c6
SHA512 ce76e43aa4d8634deede1734024b3408aa5a7adca369e83d0c162b6a26b65234d366b7e10ede7a8ebac31b3c7250ca05e748622fd3343f77bab6a7e5e88b5c9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 41b7ff00064a214d429fddbf39481d77
SHA1 415f81277cbd080a94cb15c0c61465a8fabc0228
SHA256 8d1a28eb275ef41f3edab8418bc1dfdce748d6bf38d015c65cd4f5a324bf40e2
SHA512 80e89ab285b4159f15cb2392d0bde6dd83d049ff2fdd797d3d45b33877f4fc2eb152bf3b4bdb001f7ec46ecc1851cc1d65df09da5a52e16373c92b9ced162568

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 10b5823d56a905f11fc52a393f5d4627
SHA1 b036ca4a7a5a2556e09914dcd53a6cca0c41132d
SHA256 cf673923e1beef6df4bfe73b9ae359e9ef0fbb63265101e03fdd1aaaace74059
SHA512 698de4bbb748e2bd715fce30452e3c5f9e46d8714e06e76d99615ad9ff8d91cc88c4a7cc31f0b9a519d0a32dd5a47161427ac2a61cf3e74122f92c9552ddcaa3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1fda0e81051df5326d9446adde4298e7
SHA1 2577d4d77d316d4b705bafb71fbcf59ae15ca615
SHA256 a378338b59e6a02cbe1969838c49e3db2dda1f469967f05815dd09a508f9692f
SHA512 27d5f479342869fc87d5a9168a2993a637911f1e51ff78b8fed6a7a3d566c1989480ba3e0b8a79a54c63443f69d2339e569f5116f481b617610afe2c8f918619

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 004a6f9e6a02f36758595cad590a8192
SHA1 d26b4d3137cfdf0f53c30937e8e0990d6b2cf3b0
SHA256 bd4410f5d15ad98230a4abcec8c1ad8995f986831a48d06cbaa0b38fedeeeeff
SHA512 298929365808531cee76c43526737f6916cbd912264cb2d4a0cd0de85a34df972f0f1820a7963a417aa7312f828d24b2cf239ac7894c9576e6cdc190732944b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1eef943125e4666bf613e6605b1b93e0
SHA1 a818be77f631cc3a9827bbcdadcf66ce3e0278b4
SHA256 1b5b8a2b18210eb755ffdb04e2a8588dcd1ca35e2e544f8ae39da831b1055137
SHA512 70f238de46734fff463772ec755e449a9d8e9299cb97e0fe576dbfbefba6bee60dc1d07be51b0cbf7ab197b1e025bcbaeb1308874b19763970850d28d2bdc3ac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0065072714641957aba7373947c0e405
SHA1 d00d579e88ba0816fc8c36ad9d7b9fa4d27a9a86
SHA256 e7e185421b9bda4a97e4ba8331e9ac75f90f2ccbf5b7346245a2b4071a5dbc34
SHA512 2e845208d71dfe469afef4ad0dc867d4314cae7b5bfa2e3516d17149ef844b49ee427015df957927ccaa8e4977e80b07d86271d0ad85b270248c79f322d26f7e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 40b76b08b85de10cb16f483a1d32d374
SHA1 3835c0db550df95cdd101864b71dadf0b9d53182
SHA256 d40982c1b6ddbb5d17ed194ce5e88cd8854ec6ce638756c9dcbc8207951c6001
SHA512 f175f963552d946a798e6746e7944c57edc550928c215f92728dfca7ae12ae46e0e80ec9c001b540a36ac6ae9ff1a3a19dc8a810439c8ea1d1a3c72a1fb6b5cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d5c61dbae53f9e6b318d947cb98248b2
SHA1 e6908fd0191fbaf6f4b48bf1dc8166e66bcda174
SHA256 34c2c9d3504a2164e1709486cf3fc86907c9a4af4a38bc694509cc4f76a99cea
SHA512 7890ee010e156bd745f0413c0def63d2a43138d45eeac09475d5de9acdb6f3217a62eb0dd2620039ec78657378ace408bbd95e87f4ac49d63da67b35094f00fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cd8ba987cb210aadd27c04cd5e5e7e1
SHA1 6cd908e790a6f4fe95209cf7c5083fc57d8ed29b
SHA256 8a6b5aecb99ad2ad78d7c3fd9ef8a05b0f35ce496b75dfe3819d51855e32044f
SHA512 36307c05c86dbe3f0386844b1ed0368f7bf4a7ae1e8b29115e7a4b7064dffe8dbfeb27807698bff8ad58fbc6746b945abe830ba80610f56d46bc940d60e8071d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b8124b24df6181a5f7c84851ab10837b
SHA1 eb7a318d0ca666bbf0fbbc7fddf9b64aa0ff969b
SHA256 7aa416a68bd7e94efcbc6954a6ef2b0219aef8cd9d3b531a0c3b2c05b0599aac
SHA512 e2a934de5e367160bb1f59563b53ece51518fc01734669ececcda9b9837d831f03fb420f2db72acb599ef3c593c299b1455952b1768623e16e946e6c21a8b6e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e67a4b677fa70cf257d82c7ed3af915
SHA1 1c983a4eb02bc84c07620624c1f86ca641cd0721
SHA256 e80015d1298ec0242fea33eb8d923aaff58159f87a485d686911314520f32112
SHA512 660540426003cd394eff9f39c9beba0578b7001e57a925f75d069eef6e785a5f3b3ff8ed9798613b58d998c97a11305f78b53846f0910dc2cf519db053268775

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28c1f7c81342a990e1329e786d7ab0eb
SHA1 b2527744d7ad30a37e60fe5c9a0bd08589dd6445
SHA256 9626f3c44f0689eeadb0e81e475017101a38161942ebbeb927cd68d9ccb53958
SHA512 dfa9ad798566a3b0a7c4df6b0a3141044f43ba4380ef46450badcdcd38a7af211df4b56e4835f4d058d7f9cca05a295d7f9b729fac54f593e3fccfe6147832d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e9a5acab49427384d31e0f405f099bf
SHA1 55491eac561bc96989c9291a60a2f61472d576b1
SHA256 c73fe1dfe52022932d6db245b879fcd50edaf2e9657014b1a809346b5dbd8326
SHA512 93715fbfbc72ac688d755fd5f2e3495f99a278ebd01ef5f6921bcfb50536455b4cbe7f32180bb5804a91cf153449a7f4e1f8e11df01ccea66c551369dc9b3788

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f32cbea82ee3806df853cee1500c565
SHA1 5bf2e5198035866155b2a1506a53f72afba5169e
SHA256 316c50fc1243e76019ddccb432fae0cbe9360683a5ba75512fcc73884158d3e6
SHA512 ff5001a89045e45bb4c291a876a104e4dd9b1b30194bea2a8192fa54c853d54c4aad6dd9587fcceb97674f6ccfba4e9cfd5d7db69472012b2efe45660e47de55

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ad24e789f77ac2606c1bad1d69aaab81
SHA1 b1543c37dcefe2e4a846764dc6c2878d3ae5b40c
SHA256 c1d6a59e015c2876d0766cd17ef2822d873aa43dc319b0564ccdf26c6d902da0
SHA512 7570d03cf2215fd0d0a947d2135344c15a99e3173bfa577dcf8933ff59ba0df240e73298e673925977f8c7045758391645f4a111e9ec18991f3548c1055ea3de

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\5d6c2c0[1].css

MD5 fc983cbe2ac80348e4abb4b239554b11
SHA1 c54e4a7ba77e7329ebba55cce83011fdc890c88a
SHA256 db8e06ac6db1edbc3c305aff5746346cfc98b40905dbb044439d5ff646873a8a
SHA512 de22e4fb82af4ce38b24ae8d5028ddb82de1f265c286b3c93253ec2ab8536ea88e939715b9628ea170c9aa2d2b9d61e70e378c5075b64d0a3df3a44cdde4d268

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\vcd15cbe7772f49c399c6a5babf22c1241717689176015[1].js

MD5 ec18af6d41f6f278b6aed3bdabffa7bc
SHA1 62c9e2cab76b888829f3c5335e91c320b22329ae
SHA256 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
SHA512 669b0e9a545057acbdd3b4c8d1d2811eaf4c776f679da1083e591ff38ae7684467abacef5af3d4aabd9fb7c335692dbca0def63ddac2cd28d8e14e95680c3511

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\4db5298[1].js

MD5 307a3d3a9194397f3647b0e42e36649a
SHA1 46a29108eb16239a82a3954fd3630eb6e5192156
SHA256 32d487d5c6bc6b15c0955465237187468ed4f1fa89501f8d231d82b7743b009c
SHA512 823a29fcefd08d201e67e6b9bcea5729fecfffd6045ec0d18da61e903b82a3c1007ae82c2b1c33638e4a969886a5354f52c818ddc1c922835cc66e1bff23c8b0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\67b3310[1].js

MD5 dbdc5ee9bacbb11e3ce477bd133e2ce2
SHA1 a1b66c38767413b24e0d0c3266884d9e4ab4c9ca
SHA256 6f90273ebf90e7f5517f52289b1fe2bd1890e0e74d8715b708d9fb37451c778f
SHA512 16ab4681682a0656aad2e5b4d959bc44b1fda7b37540f6f38fc32370804e2bb1fc927945cd52475ec1c4c538801acfc3842ee592fe663e9621caf85c75a9de85

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\18f918e[1].js

MD5 8da0c44e0710fe9645e5fa6589016a62
SHA1 3e004850e3760df294813a75b4ad91de4bf60c6c
SHA256 dc0e7d8dc230754b232e24232bdba968617811e9e0fbfdbaf166990d4b485232
SHA512 9281002a772a820e191870caf264185c09e3cc7f9ed4ee5633268dd20dc2c4ec1f535477fd234798290b07465ba45959f60e80da3d4a148f6f7700bda0f3cb8f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\16ad1ad[1].js

MD5 48c3322a65c0a64082d81ac8b95ab571
SHA1 11ba2c2cf78a81a6e874641e5b56690a041a36e1
SHA256 0582cb613a11a3c9a25778c8c32ea60fff75a1696f9b5b1b9d2b74494a69edb4
SHA512 d9362a48bd31d31264cb8822fa663f649c8fc9746e252f1488fdefba55606ff06c8a3021ce6ead31cb03d12f8ce3a8f324fa6bd21665bafabda35204b9e96619

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\5ece7eb[1].js

MD5 ef668e4054ae58fe4a964ae46ac3bd78
SHA1 30ecc5c42a7c527f0c517f0a0d3962e1cd7f778d
SHA256 4101c664267cf7c52c6a45f5fc14b5a7ab8019096252cd4b572da6a44db4bd17
SHA512 48caf3a1ba686e7023890fdba140fd5a79ce5e27057a076b8ba1e22f16d3625d8660f51ac39868e2f93738cb6d1927e9422051bc65a8b5740053a52441f46e01

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\fbevents[1].js

MD5 2c3e66cd55ea0171ae77702a6949a9a9
SHA1 69a1af382f821254dcce6a075f18e1d85c10fe76
SHA256 0313b0d078dfe6c7ab517c11404b0c01458469006fbf1a0d4d4c5e90517e54f8
SHA512 a5b7dd0d699fdc444f0322ad0a7f56e69eee980dbe95855d6742db3494583fa52698b6cf9ee0cf70038ff11ce0ef997035d9672eeccade22cbac4a35767e9ca1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\js[1].js

MD5 8c10d4e9539b44c31195bfc08caa86bb
SHA1 bf8b85958e60f854268826ef0a153bf06d503585
SHA256 e6b4a07cf7ccf9ce92b07fdd8e3a1d8fa4291b65d31783798218314937efd9ca
SHA512 76cfdb4adb62ac456369379377026b89b4766bbf037067cdd82c74cea9b544e9b24d559ed4f95b2a8558479941cf64220bdfbe60af25df13a371381b47b55ce7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\74f8479[1].js

MD5 1a6b0c54e62babfc506f6e5f9d221d6a
SHA1 dee8ab61b373f02c2c3739d3e2c5b54d4e8f501a
SHA256 6a160f83a713c970d25dce639d2c9f089e2460caba46dda62b59ff6174f9193d
SHA512 5001b6018785bd0eb24909af7b5c1a1fa00975c869bd090a461ea656e1ab813820d0e1fa2b74fee4be639330bb757d1eefdff0b51d9ed0991e2855bdb26b0e0b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\quant[1].js

MD5 6ef104090ab8672ea053d27faafd4ee9
SHA1 d7217a3c3a2f5d363396e28c8ae2b96df1c2d3f5
SHA256 45a4c240a17a4d5f925ef0e125b86d882c6ad7549028d9cbf6f4f06fd1dd897d
SHA512 92205501b1b01f4173a16a57aab0d847c9f574fc1a44a14d62e84aec7ebccaacc399eec6823adf082e7ebe766ebc8ba8c580e69c73cc7203d8c4c22b3660f6e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\40d4cb5[1].css

MD5 292fc0639600d7a97b0372f5c6418f29
SHA1 1279d399b6ea808543b259c8773f59f0e83c71f2
SHA256 5163578e205532ad6f34b2dbce5453110708e22b9a68d975f5e444e9ab204c3a
SHA512 8d96a621bbbc707b23ef84e0ce253658889bc4fad04aa0dfa0edcd45a69adba335db0a534fb31e13aafaf6567f6e7e922b9becb42bbf1c6e9d2455496f0ab938

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\rules-p-gsV-rbZdX5S-9[1].js

MD5 d2261deeba04bfff8efe6359cc1908a0
SHA1 bae1e6151816a5117f2d7611a53f1fe5130f999a
SHA256 e75b0a65d6f5d131b559e126e3cb5f1cc02f576196599e99da058d5171c2e825
SHA512 272dd1fff74e1c8a8ece5bbe5c9a7abbf293b7cc40eeb58a4f41cce70da2eec8dee50bf3d6be571869ce69a6ff579c0dfb73d308936ca53a3057bf449372cd8c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\ZKTJ8PHP.gif

MD5 55d25e9dc950d5db4d53a3b195c046c6
SHA1 75e91ae3e549dab12ed1c9787ade9131aef1c981
SHA256 a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
SHA512 e508d5d17e94d14b126164082342a9ca4774f404e87a3dd56c26812493ee18d9c3d6daacca979134a94a003066aca24116de874596d00d1e52130c1283d54209

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\RTD4906L\www.mangobaaz[1].xml

MD5 07aa89f4c8b2d3b29ab3a71cc05ea156
SHA1 aeea26f737fcc10717c5091a62258a0ead9bf74e
SHA256 bd898afccaf132e6075d318bde139b9773a1a97cf2cd82581f87ccc5946c6f8b
SHA512 723ff1e373f81c88f213b9c534587d478cb20f9c5b1ce14eb895c84055f438b339708dcdf4e415ae54ad33e12b10f2555859918e760ddd399c30fa64d2b6a99f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e93fa085b114ace169c398eb673f38f4
SHA1 fa906b050ce6e5efafb4cfef898102e11251be1d
SHA256 783ce1b541dcab1d106a419b0d8c6fab4f0434311e10f21add663b848e6b2550
SHA512 7943a22b1420d29223cafe02dfa883860f83239f226c672ba5de1fcd74280249583c826fdca13fc94229f1c68e15555520c67d5a32e6afcb8de50a1d75080533

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b0d2c379b51d5b8b70fabf86bb1e0469
SHA1 e3612922de307822ab86c2e36b63b6d66bff51bf
SHA256 fe5edd9594b88a3c85411792a04f47c772d29c73bb3d7a60061a12e6c6d372c6
SHA512 4c2dcf643177a16adabf315e698c9c4fd646444db8a53514917353ddec60f8f48e4bba88b2659832442a2516843e1c5d86debcef78f6a9b92e6e0032ae482971

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b9bfa6c67d1db66170a0f0b7773d1715
SHA1 067c90ad6e753b54d34ca6a902ba59c13916c99c
SHA256 98216b27008a72979fda4646792e9a2d5fffa7ab2bea5139b7530bdffbd79320
SHA512 e3c9121f1edfd39ee5297a9e5d7fcf32e467e3fbf0a7d731ce1538db0350fbc1855a1ca1ad5524629f005de30f0df2d691346803d5f9bc66bd2d353eeacc6877

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52ff6006d538f3b56eec906adcce8b50
SHA1 b590d326e6f5c0ae8454bddb662cecbea4baec56
SHA256 997fc0f76af7df14c9292ef00fc8edff45738d5449d1058a26770ed09ec73ffe
SHA512 97cfa74d716d6ba65ddd72c23401b8e9c98ba9161d507a8e07f9cc3e4c4b6933198ba43b3891563013c8435add17efcb940cb860dc0c378a392ecc56608289f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e1ebd1001dd4e0e01b3a1412179cb6b
SHA1 a2de4d133257e05cba732fec0b1ea4a9c23df767
SHA256 be4ebae97272295d2b3140c29fda186eadc621f202b7cf789b6ea8f8db37c3cf
SHA512 6f07a2c44ae9d6dccc3e5483bc803796e02c86dfed24b3167e96a9e2ae946006888c0697e02ab0512c9d7f8bf4fc9e509b48393eecc1fab19f060699ee385587

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f55a23b601915b4e9a7229608e1df2a
SHA1 9bd9e621c9e1e36164309633b9760b64230b188b
SHA256 db4a934dde317831d606921083d52c95d34311193d54ade4fe1509a127424a7a
SHA512 4aa83ef6e8068477b598ee490d1e227a22f7c6f68d82847489d06ace715a3ec6282d36faa48e5e8fba1329ef04c0fbb4aa35aa60bf21b2e159da40ee933338ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5acbbf0ab884ad471a77529eebf21ec5
SHA1 bd62c5eee319207249a81b1717bec12f46ce050f
SHA256 0342d2f314e4c1ee961d175ef2bb6051b3aa80fec504709660952151a1f9c96c
SHA512 9ed8e60cdb8e5c771c40b4a60676fbbd29224d7ce4c7293ffcdd08e763cedd69d3661aa78827098cadcda72b1e2aea97d910d116e5f3c10b7002346687135cda

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f2f5a482bc76eff21f3b725cbcf75bd7
SHA1 f9ec6cd1a8d449e8c130e694a4c456dbf7bb44e0
SHA256 7b3c13f14da5b857f9ceaf9d1e45ad5765d97dddd5ed8f730bdcb96d76edca04
SHA512 5823397f5ddb0f27e9c1cc79fe4bbc6cd1df986f006b0430eced03ecc96bdcc0952f569f033bd24f1d90eeaf44623c1e3c5af72172b4e98cf7288c1761e50b70

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a67359bdad63699169b627fd46899ebd
SHA1 838e9022d396e8b4ea40db62236f4600ffbeea78
SHA256 6cb74e6f3087ddc9503a13acee7b665259aa4a0da22c3a40035b1116ecff0f37
SHA512 92ff74aaa20f4769edbe6e942a0e2a70197aad877543f441a41a6973361b66722b45a428c6116a7a1e85027ddf11360fdaed0df8572b4bf11969af14915f0227

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71d87fc9b72e8de7706a8f58c3e7e48c
SHA1 637b41646be649727d29ae4675d10e6bfdd5257a
SHA256 5053bff756356635468efa538960ab06d0db1a1c7ea5b0c7b430e05878fb6f4c
SHA512 848b696062510b63edc9535e712d432e3e245a4c55bccacbaccbb2f74711ed5cb0af44d3479a405653165fefe14f779e180b5ab5b018bb02167ece564af08318

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46ab18ee7f404fd8dc6ddaf1d07da160
SHA1 477281ace2080407a3f84a4829af476c51db0c50
SHA256 549e8e39f1d700901420fca4b6a1d01f261f38501572a2032e3c2c72ae33d02b
SHA512 426447b53544ff3205b7ee1f8aff7a92bd1055b0d8324ca52b028a3f5ef8e3f64cbcb6a5af37db7bfccc5cdd39a42613db45ee446da084bc120944badce1863b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 1107b6efd1f3db7ce1bda63f9ec8dd8d
SHA1 ee2e79a8a2d044d6805841830507f3efe9f4f28f
SHA256 5b8d15ffdedb0030082a042befb46ef31e5e5ee1a543290cf63e08143b726e7c
SHA512 495236d8fbb1c1fb77fd40d1af6f779ee5c8e4aa9d8cffe66bc11e3d94e029f820214ea848d6cb8ae61f79b1a4c9ad13808b84cf955c87f0c6bd2b8139eef4cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b347cf67f2d9474c666922944f676c07
SHA1 014eca60cfb563f152b86cc8e4b9efaa46794593
SHA256 34ac8f5a9fa35dafd6ad5a9ef5fd85829c5912871363de96aae9f9d7888dc5c8
SHA512 780bb73d652358bee8497322d522fe3b4ef5c149359dca65d2292dee44180d9dcaddea2c04322819beabb74f314046a4335c26d993d4fbeb8bf6c4bbcac0db11

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2242ae1abc18b26dcb7b57d2589f7def
SHA1 8d928f0b8ca621a448f4ae0bc4252b0ef2af7ee0
SHA256 87423b5f75a9be3b352f8af9f9a06f030dc2980ebad51bf216d60217f0594463
SHA512 06de27951448c4bf4a5e0aebdbfd6179ae2a95ff1ea59297905e15e5828cbc690fe0a4356384750f35fba7d8294ad51e4b582cfaf716c7e52bf7fc73b449bf9d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c4025adc64c8c5f2de86bad2d00439ce
SHA1 ce402e7eac75de6fb86d1217de1e7dd217eef0ba
SHA256 c2f4df4cd25ca7af26f27ccb19cab2231b8e442421d5652980322f3db11705b5
SHA512 9405e1954bfab83a9e24e8b4ff3d8d077f9480d46962b721109bf39ff1e900c01d482f63a352fa3ba30edd8478e85a0c00ec0c40e8c068c866b396af4227bd69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f465305cd1a4e1049194b543f27af48
SHA1 ab397d1cb13e5d38dd5e165f5ee0bed3b4a7823c
SHA256 03d8004f245a2baabc2a8c5b679ddc0c5a501b320df417852b16f8af6ef94bfb
SHA512 0e64e9826cf5a7e6521b255ef56331f2c66a9a9e885ca7bdcf7017c7900f9eeebe748aeff4893866f5de6654119976d3aa0de318bd116de3134145c53f4c031f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bfbb17cc1e7f85c9c2f94a8cceb0e573
SHA1 dc46dee9141a21a954bdfa806558c9a5a7c09e63
SHA256 e1942b68f8054b0469908cf6cb873d97b29f2a514db61c4ad9d02e3ea89ccd5c
SHA512 8a55d43427bb8c72dfa0e047e663d601d1c4f47f00a28ca0ee3ed82f46c913de2fc33c7e3cf5ca33b956433b88ec60a52d725e8a4c3b39bdc9eb9e09b10f22bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca5acbbef22e0d69d7d2b0b062d7b32f
SHA1 c0704813b6243db145352f5a56b806cad9d43349
SHA256 59c1fa4e3982a02f5268c6ab095eca1073de5556e16c94e107c5e735bd45730e
SHA512 bb7fbc761895b92867bcf089bd9aa654ebf211733b59d5bab99c926613fe4367e21cf2f67a543a5eb7bd34814a0c27e6f139ec8baaee8b635fee4087e242eba8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4eb98efbdd44e9ef299c7212efa3d93
SHA1 1a6098ad70b0bb460e6db9fbb107b36e5e7cc4e4
SHA256 ccc955521fc7d38bba5c37adf44baf8513e6e808dd9e4f7eb06d49b0d235eb7c
SHA512 c0dc5110d182114b8470e17733c6513362ed6028e3545fd658cc6f1bc40ffebc35e74ad6ed1423e49bce286a4083e6b8d2e0dfc5f40c49c1fb4c76b5f95f32db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b140962cc3708a03bcc02380603a9583
SHA1 79eae5a26782919a83d052ae83a99973fdad27a7
SHA256 0449a66294cb1fca942b21138be8e049455d962ae41086755726f5a8b1a2be14
SHA512 7a2017595c131aff20ddd7c378c692b12ffeff286816460067b5425cbe3876fec2e30facd3354a7fffe31430577a167cf65354f286adb82b428b4987f3a186fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 45b26d7203a59a62377204771fe1ec64
SHA1 821c1ac8e0d718cbab8661d57f712e675ffee748
SHA256 69f01e5dd8a740fbff18d537c6b399425407eab8e6b7c50eb2509675a9630a72
SHA512 d638fe0c3d1de9b0d7aced31e36654f6b2cd74ef71b9528cb6924c4c26a2426ea582d17308a00178fbd0d4f18e00d0e5b57b5ae7016974aa7385f10c0403af79

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eee10656666be93b2127c0f150e6087f
SHA1 4586b77334fa430229e8ec39b10f279851567050
SHA256 c30e970ac965009b61b4537602faf840db5fdc610e2b9a100cf5b65f45f772e5
SHA512 5e23155209b51b0781a53b032606ea6167047f71a167632d4454f558241c67eddda39078069fc252aaaa99e5b49606c86a94befa44e65a3d9cc161a0efa8927a

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 09:23

Reported

2024-06-13 09:26

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4d5688232f2bfb397bd545e42935a7c_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3692 wrote to memory of 1104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 1104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4588 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 4348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4d5688232f2bfb397bd545e42935a7c_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3c9046f8,0x7fff3c904708,0x7fff3c904718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6780 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6780 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7960 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6385896128790228996,2540850168302662609,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7836 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 cdn.hungerist.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 www.blogger.com udp
GB 172.217.16.238:443 apis.google.com tcp
GB 142.250.179.226:445 pagead2.googlesyndication.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.180.1:443 1.bp.blogspot.com tcp
GB 172.217.16.238:443 apis.google.com udp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 145.160.16.104.in-addr.arpa udp
US 8.8.8.8:53 105.77.117.104.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
GB 216.58.204.66:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
NL 23.62.61.136:443 www.bing.com tcp
US 8.8.8.8:53 136.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 platform.twitter.com udp
US 151.101.188.157:445 platform.twitter.com tcp
US 8.8.8.8:53 platform.twitter.com udp
PL 93.184.220.66:139 platform.twitter.com tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 www.blogblog.com udp
GB 142.250.178.9:445 www.blogblog.com tcp
US 8.8.8.8:53 www.blogblog.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 www.mangobaaz.com udp
US 8.8.8.8:53 cdn.hungerist.com udp
US 104.21.42.156:443 www.mangobaaz.com tcp
US 8.8.8.8:53 cdn.mangobaaz.com udp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 104.21.42.156:443 cdn.mangobaaz.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.gmail.com udp
US 8.8.8.8:53 www.howtodoseo.win udp
GB 163.70.151.35:80 www.facebook.com tcp
GB 142.250.178.5:443 www.gmail.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 mail.google.com udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
GB 142.250.187.229:443 mail.google.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 asset.fwcdn2.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 34.160.100.207:443 asset.fwcdn2.com tcp
US 8.8.8.8:53 156.42.21.104.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 5.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 229.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 73.80.16.104.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 secure.quantserve.com udp
DE 91.228.74.200:443 secure.quantserve.com tcp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.151.21:443 connect.facebook.net tcp
US 34.160.100.207:443 asset.fwcdn2.com udp
US 8.8.8.8:53 rules.quantcount.com udp
US 8.8.8.8:53 syndication.twitter.com udp
FR 18.244.28.87:443 rules.quantcount.com tcp
US 8.8.8.8:53 p2.fwpixel.com udp
US 104.244.42.72:443 syndication.twitter.com tcp
US 104.244.42.72:443 syndication.twitter.com tcp
US 34.223.28.54:443 p2.fwpixel.com tcp
US 8.8.8.8:53 66.220.184.93.in-addr.arpa udp
US 8.8.8.8:53 207.100.160.34.in-addr.arpa udp
US 8.8.8.8:53 200.74.228.91.in-addr.arpa udp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 87.28.244.18.in-addr.arpa udp
US 8.8.8.8:53 72.42.244.104.in-addr.arpa udp
US 34.223.28.54:443 p2.fwpixel.com tcp
US 8.8.8.8:53 pixel.quantserve.com udp
US 8.8.8.8:53 54.28.223.34.in-addr.arpa udp
US 8.8.8.8:53 38.201.222.52.in-addr.arpa udp
US 8.8.8.8:53 mycoderx.blogspot.com udp
GB 142.250.200.1:443 mycoderx.blogspot.com tcp
US 8.8.8.8:53 1.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b4a74bc775caf3de7fc9cde3c30ce482
SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

\??\pipe\LOCAL\crashpad_3692_XMGREDBWQLCDECVL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c5abc082d9d9307e797b7e89a2f755f4
SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 30defac0a054058ef9682369524d5d3c
SHA1 04e6a9eb9448636ad00b358f3b9fbcdd5930ab2b
SHA256 6f9480870af0b568f9a365ec22c11a5bc2254c71cb7f7b64c4626743dbd0caeb
SHA512 53c11b6178efb28ecf010f1bc39d4bea6e664f0d1e87284411192194e723cbc10e7d527de9f8f42a3c027c6933f934a3e76eb9957c435cc1a948068dafd719c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6e9a51d9c3b8f72c00aa2ae44d1b92d0
SHA1 d10d2a2b20980407dc8e180d66993e01fbbd3679
SHA256 59e9abf849927c93728c65b9594e10115e19b8f49aef8bcb79fc95856d876f47
SHA512 4c9716b41f0d3301c5daee10bb1462d8422caa9862e9b3e2ee07b355d7160a1b81ade6d18ccc910647b454277b9b1aabf950bfface4e9274278e3825767928d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7bc3d05d15008a197aeb1038d4f4da53
SHA1 49817df0c231c7f3fa32a8ff71be0bca9f9b2b61
SHA256 483678a08246a7dbd940214f0f03fc4e1e7d77742a0f8756f27c9445f94ed5bd
SHA512 553d6adbf28e4a6c44592c4483614e7595e6cd176b362d0c7f4c16b9b7b26a58e1e6f25de55b1f0680dad09ee509914507b44f83b5e3eccb610c97a8ef541d21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 439098535e9951bd65cf16847dee731a
SHA1 4a0a55d4f60e1e5345a5e4849463e98e2e25da27
SHA256 8fda09d3d0cc337da7364bec5d97a6ff65bd491d18c3a29af865de43ee43eacf
SHA512 30705018e2f67939ec914be70d65ce94492042b596d77b7e05b81f1e3e6efd4f8f300dd6133a1c9563357ee6af1e54e18ef9799dab1c201c8b0fc4172adf2cd6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

MD5 40076dad99512484df7b2960d604c24c
SHA1 0f16aba934a7b6b5f9db9a573d13896afa6c6b99
SHA256 dc377fcc03f4512a8b407908e1709c0b6d75b546588842f98fdd24df57a17f66
SHA512 4b94a32bbaf3c6e548db68a9f2d526c7b9f1b00062b9dd4d42d2979c118a35b4fbcc05765269dbd01a0559d812b94177f13702f09108c826c3dae9f0b377a41d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

MD5 e1c894bf3fbd58b78d850ce33d6f3983
SHA1 08d182fede0e0f35c2d3937dad01b695f7f805d9
SHA256 4e3e0243085becdecfd2e3cbbaa3ac44c3f66b994315796dcf7a6b9e09d703ad
SHA512 177508aaf0b27631c3d038cd4652e93a879095f7e0bd6d295be33790dd16a91015eb0b84627a349c76c8b30029e03c4c41b199f5f680a39ca4439800db750792

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3c3eee4d3d871388045aa348f34a3074
SHA1 d751422d6a8f1dbd5295d38e63cc7244fd02d574
SHA256 1d8da9460eecdde6ec2b961e87b37e28461769d9c4dfbff990169792df5dd7cc
SHA512 30adff9afb03721fdb29f35c424b487a7a1cee374339822d2764b0bca005637e3a53483f59765ff2cea0bf18ef213b40d03f860a2f8a3ebbc1f525fb3f8c6746

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

MD5 ed76b3230fad7ddbc073911373d8b828
SHA1 e03350537c19495628ea3c3827254483b14bcf10
SHA256 c277c9967f04a3483e9142dfcdea2656d7300d00e66f116de284e894d262460b
SHA512 70867212462d893f9212317c551e5265760f5af5fa7f856b38b8d9fdc896fd3c8a89dcb3ce2119a762db0cc38fc2b0fe3d3c1e2ebdf087bf5e7c5833816bff08

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

MD5 8c018df541dff5ceb8c0259aeed75b10
SHA1 d177b23e47c6146b532bbcfc3bec0acf5edb2d4c
SHA256 8b25d97f90da34c0a5b19097556851bc87b35995f2a47e5ab5bf5bb794063e41
SHA512 325dc490b18ecf8f4043c7ffa0ee6a85f68f43d0b9ba31b0b68e8fc26cc392a5e6d6e4387ff7dd9b59e27de5140628d0bfa6256ad874da8575501d2cc2b302af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 81394d7c0c7a09879a510073691172cc
SHA1 23387a4aec8d60b3ffe49ef8931c5c3ad8d85ca0
SHA256 c75b3adc55e17951c00d75a1a0894de69cc0bc57d4959a2279483f891a20cfa1
SHA512 dece3df4b5568d52298afc1b3563a179c45d02831abb1b86ac7ac0e325312fb401d9da75cefffb062476c32a639cb7139f58f2f1556765081d04fce737d3eb5e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 07fb44fcb07fd690ebf3eb53d24a66b9
SHA1 1d7fa5e7264157fb466659965107d38cb7c1a0a3
SHA256 a0f9b824538a9e9c15e6e5da8c2853e33e1640e2db71cd2ae2d93eb4fed2cf12
SHA512 7afe783192489ede64fe38adc737d1ea97d9170eec13b1e6de7f736d384785109a40c559f79d5b0cb164823452b0369fd6b0211ee6b06bd62178f17704790a6d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589805.TMP

MD5 cf2f18d948f884512c3c95cbf3f5664d
SHA1 1540e5ec264691297aa348a25be80047ab48e0b1
SHA256 690feb25a8668d5150a960e99d83aa30c1d4e9c81c927ac723d9a228c6c7fe5f
SHA512 eb4df20fa113e81c08e8477ee7cc933c42a662eb57f5b31635613527a02761ab944de33bb2276287dd1174301e3a69de206adf3376b2793097336307a39c4341

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

MD5 342e152ce9d9ef895fce298a61a52570
SHA1 c2cadef1ca66600d5c2c6dcbee3355bbf901a591
SHA256 baa20b7c5a3388f6da66e839b2b187662d3ffc570704a0b9382cfd0874922394
SHA512 10196f93f2d8fcf8e7a7ff6e9706e42be64c075833331cb48d938fd1be321e8c4f926a9c888add217540380773ca2c4b269230227af8fe945344ceb6b26e40f0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 dfbda586aa730cdd5a806ba934240001
SHA1 ecbac5bb9d8f08435276ce85b432ca2ebb33951b
SHA256 8869fd1ee086c85f7605a930aa876b5e5127de9a847153c4a90ac188e185c911
SHA512 03645aae529ae3661f45e996231643957ab85400fd76ce0c89dc641aa5b44ca9c1471356bdac795e0c44a764924602947280fc3c4a6355fec4ad6c5a0780de82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7ee7ab215d66d22625cc817f6502545d
SHA1 af386dbfc644b275c094beb9a70d5f14f3c1d062
SHA256 71a33e88257ce85628f86df49604212d9ca7f17ef060bb84ce07fec135bf3a89
SHA512 272b7cd57ee64b2c9d217575355c4288854c2141b92c0109acad4f5fb86071b663ddb65f2e28781e1a7689a1f1ea3a18b6da36b1df5c6306e47e003e2e215086

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a3855d1c16a756231aee76ba4bba3ab9
SHA1 9250dc38306928b51760df8693e3ee65231d61a4
SHA256 7692423af51526fd4b0aab1fb8e53e2df48f1b00cab8ff45a1c973a0e3ff8f4c
SHA512 b84a94d5efe1d91cb2fd1ed3bb84423bfff916fe985ef71d6440456386d8d198649624b7bbd73b55674e1866157dd3e4964d7c8eb7686cbb7ff819f6e139bb08

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 262e185ffc792724c4eb2c3122c2e00e
SHA1 d7eeb8fdd3230625362c62d8d742789250ab222d
SHA256 9f926955a4cef92e865b41de1e6abf07832a78dbb20ad99a970f5f9b5792c28f
SHA512 7159a82c16d5bd00d5add618b50129da3b9636495a98a802e02a0e0e71cebf3d9296de2a2e39704c71446753411b7dae87a1590ba163601b94b993f055bd2609