Malware Analysis Report

2025-01-18 01:02

Sample ID 240613-ld1r7asfra
Target a4d6feebe7ec73b0643a3a6680e81268_JaffaCakes118
SHA256 37eb0a63acf114fe3877df7c5d290486d0f286efb0a369cd5939b383be322374
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

37eb0a63acf114fe3877df7c5d290486d0f286efb0a369cd5939b383be322374

Threat Level: No (potentially) malicious behavior was detected

The file a4d6feebe7ec73b0643a3a6680e81268_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 09:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 09:25

Reported

2024-06-13 09:28

Platform

win7-20240221-en

Max time kernel

149s

Max time network

142s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4d6feebe7ec73b0643a3a6680e81268_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424432617" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ca9b854cb7d9e46a122e74a497e0475000000000200000000001066000000010000200000008a7d49a881a663a3fe992897dd175dd795a000a972c26a6adcb166417682096d000000000e8000000002000020000000f7417feee21c37b8e8ea1b94d796861c066de0e19af0c95f92e27a0b3fee03db9000000046ad98f2a1f851faa6a201faeec11dea99ca37d6338dd6811bf3a733b4b6dd9d33fcfc69ce3c4387fb0cf55515531551e614d832130dbb1faeccac350282d6c87ba9f8c32118f288a3ab004653ed90a34388eadd1e1a77fa03d5c00c037889ea87b614bc8ea040c349d48315694095655be8fa682f6d8610afb3c90a0c90f968c1d0df98c1ae660b2c10935f91a1eb40400000008c0318d69bc2a863b95e30ecbcfa8b2974d271e151898c48dd12c24f223e6411840f253f79f866f42516f58a2ecde35b3420f5a7d6b2399f3c3f92a2ed38f892 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ca9b854cb7d9e46a122e74a497e047500000000020000000000106600000001000020000000aaefbdc8ab1690b0c251c39defbbd7643b21d7237989d64a73cff48544ca35c5000000000e800000000200002000000098cb2296584bc2c5a9bbcc710b28ee00433aec4ffe0c065ab435dcd11b92b4b520000000d341d61b679b00ec9f9a05b9f5897689b775a581b0d2adfc7ee2a58df9224c9240000000983b6543fde7afdfe86dc01a104cbcf2b14ac561ea7eb5184a73c1f5789d6444edf0578b6ef4cd251e67d42a175adfe8d01187a4ba68e8d290c97a0cff6ae860 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB68DDC1-2966-11EF-B1CF-5A791E92BC44} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04a0ad973bdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4d6feebe7ec73b0643a3a6680e81268_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 helplogger.googlecode.com udp
US 8.8.8.8:53 w.sharethis.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 network.clickbanner.gr udp
US 8.8.8.8:53 www.zougla.gr udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 fvcreatives.s3.amazonaws.com udp
US 8.8.8.8:53 forestvieweu.go2cloud.org udp
US 8.8.8.8:53 feeds.feedburner.com udp
US 8.8.8.8:53 s08.flagcounter.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 www.alexa.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 static.networkedblogs.com udp
US 8.8.8.8:53 ad24.gr udp
US 8.8.8.8:53 www.vrisko.gr udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.widgeo.net udp
US 8.8.8.8:53 i.creativecommons.org udp
US 8.8.8.8:53 jf.revolvermaps.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 www.greek-sites.gr udp
US 8.8.8.8:53 s7.addthis.com udp
US 8.8.8.8:53 nwidget.networkedblogs.com udp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
IE 52.218.121.217:80 fvcreatives.s3.amazonaws.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
IE 52.218.121.217:80 fvcreatives.s3.amazonaws.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
NL 142.250.102.82:80 helplogger.googlecode.com tcp
US 45.58.124.226:80 s08.flagcounter.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
NL 142.250.102.82:80 helplogger.googlecode.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
FR 18.164.52.84:80 w.sharethis.com tcp
IE 52.218.121.217:80 fvcreatives.s3.amazonaws.com tcp
FR 18.164.52.84:80 w.sharethis.com tcp
US 45.58.124.226:80 s08.flagcounter.com tcp
BE 23.14.90.82:80 www.zougla.gr tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
IE 52.218.121.217:80 fvcreatives.s3.amazonaws.com tcp
GB 163.70.151.21:80 connect.facebook.net tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
IE 52.218.121.217:80 fvcreatives.s3.amazonaws.com tcp
GB 163.70.151.21:80 connect.facebook.net tcp
IE 52.218.121.217:80 fvcreatives.s3.amazonaws.com tcp
BE 23.14.90.82:80 www.zougla.gr tcp
GB 142.250.187.238:80 feeds.feedburner.com tcp
GB 142.250.187.238:80 feeds.feedburner.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
US 54.236.142.192:80 www.alexa.com tcp
US 54.236.142.192:80 www.alexa.com tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
IE 18.202.12.61:80 forestvieweu.go2cloud.org tcp
IE 18.202.12.61:80 forestvieweu.go2cloud.org tcp
IE 18.202.12.61:80 forestvieweu.go2cloud.org tcp
IE 18.202.12.61:80 forestvieweu.go2cloud.org tcp
IE 18.202.12.61:80 forestvieweu.go2cloud.org tcp
IE 18.202.12.61:80 forestvieweu.go2cloud.org tcp
DE 185.44.104.99:80 jf.revolvermaps.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
DE 185.44.104.99:80 jf.revolvermaps.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
US 172.67.69.193:80 www.widgeo.net tcp
US 172.67.69.193:80 www.widgeo.net tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
US 172.67.1.191:80 i.creativecommons.org tcp
US 172.67.1.191:80 i.creativecommons.org tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.234:80 ajax.googleapis.com tcp
GB 172.217.16.234:80 ajax.googleapis.com tcp
GB 172.217.16.234:443 ajax.googleapis.com tcp
GB 172.217.16.234:443 ajax.googleapis.com tcp
BE 104.68.81.91:80 s7.addthis.com tcp
BE 104.68.81.91:80 s7.addthis.com tcp
NL 23.62.61.75:80 www.vrisko.gr tcp
NL 23.62.61.75:80 www.vrisko.gr tcp
GR 5.172.193.139:80 www.greek-sites.gr tcp
GR 5.172.193.139:80 www.greek-sites.gr tcp
GB 163.70.151.21:443 connect.facebook.net tcp
FR 18.164.52.84:443 w.sharethis.com tcp
BE 23.14.90.82:443 www.zougla.gr tcp
NL 23.62.61.75:443 www.vrisko.gr tcp
US 8.8.8.8:53 licensebuttons.net udp
US 54.236.142.192:443 www.alexa.com tcp
FR 18.164.52.84:443 w.sharethis.com tcp
US 172.67.7.63:443 licensebuttons.net tcp
US 172.67.7.63:443 licensebuttons.net tcp
FR 18.164.52.84:443 w.sharethis.com tcp
FR 18.164.52.84:443 w.sharethis.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.151.35:80 www.facebook.com tcp
GB 163.70.151.35:80 www.facebook.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 172.217.16.238:443 apis.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 developers.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 network.clickbanner.gr udp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ocsp.r2m03.amazontrust.com udp
FR 13.249.8.192:80 ocsp.r2m03.amazontrust.com tcp
US 8.8.8.8:53 www.microsofttranslator.com udp
US 20.119.175.244:80 www.microsofttranslator.com tcp
US 20.119.175.244:80 www.microsofttranslator.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
US 172.67.69.193:443 www.widgeo.net tcp
US 172.67.69.193:443 www.widgeo.net tcp
US 8.8.8.8:53 mc.yandex.ru udp
US 172.67.69.193:443 www.widgeo.net tcp
DE 185.44.104.99:80 jf.revolvermaps.com tcp
RU 87.250.251.119:443 mc.yandex.ru tcp
RU 87.250.251.119:443 mc.yandex.ru tcp
US 8.8.8.8:53 rf.revolvermaps.com udp
DE 185.44.104.99:80 rf.revolvermaps.com tcp
DE 185.44.104.99:80 rf.revolvermaps.com tcp
US 8.8.8.8:53 arvigorothan.com udp
US 172.67.150.119:443 arvigorothan.com tcp
US 172.67.150.119:443 arvigorothan.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
GB 172.217.169.67:80 c.pki.goog tcp
US 8.8.8.8:53 widgets.amung.us udp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 142.250.180.1:443 2.bp.blogspot.com tcp
US 172.67.8.141:80 widgets.amung.us tcp
US 172.67.8.141:80 widgets.amung.us tcp
US 8.8.8.8:53 static.punchtab.com udp
GR 5.172.193.139:80 www.greek-sites.gr tcp
GR 5.172.193.139:80 www.greek-sites.gr tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7242019229a5165e0ec732487b2b4e8b
SHA1 072f9736fa8dc77965581567bd70a7d4685085fb
SHA256 73c706ab4a8f03c51f918ff947bccae736d69d51453bf541273f14e1f1be987d
SHA512 c8700c9a3830ea6e5c8d25387d12babfcd68c509c9ad908062e5a9fc4712279b42a666419dd009f55dc13a6cfdbd2197a5c2fcd7352d4d0fa466afc4bd741564

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 cb85f3fcf86ef0de7ef258539cae87de
SHA1 c73288fff07885a62f8c7033b348863ed3b8cad1
SHA256 7430a96d94b1faa5363b7656b323ffa416fd262e0405e498bb143dc93443963f
SHA512 dc152f2e8c8f7e316e84f7a1f3996e02c08d582d6d0e40b8bf7171e359ea952a80b7452e56690b30fe98b4655d4744e8529a930449ef1cd853e377f86294b2d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a39395c8847ab3bf73e97d495e37dba5
SHA1 c07090bd28a6da6ffff1eba90ad85e9c6f485acb
SHA256 f230c6dd38a137641e8387ab44f4798f71945713a83b597c0827108696e10a57
SHA512 21cd6b4b04648486cac85962d3b8d5e566a7f6119b8824ecd10bece5b24ab9f8cce4a7eb83b3da3677072467b5b30daefd61a8f8bb4ca8bc58cb93ad8a7174e1

C:\Users\Admin\AppData\Local\Temp\Cab2271.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Cab2292.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 9ab69958add55ac2c43c7e24e368dfd7
SHA1 672181b654f2b5c4282dd4f9e2d1b67abef9dc4a
SHA256 7cedacd6138328fdd5a5e3eee88a3fd2d3911191d054ded65b66c7661d176510
SHA512 e330588e343a16c32385b70314c67aa994c2b27133f3024028011b2729145112696daa634f9cf9d8c1095b68b98bbfd1d7cf64502e69a1946cd456e3fa04d77b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 6392c897c9f2365edca44b66367fb5f0
SHA1 b0bc239f3ea4c325e07655c67ae18e2fd2bc288a
SHA256 b2c2855b33df587b9307877a3b318950f235d7312314dcfc4f693b70fb1257f0
SHA512 76551e02665676a0192a83fa8e3ead4e8ba12569f9c8514ae7e8c660914a8b0ea29b754cf68e160e2aeff880a6ff00165f70b7e49db355569d8d1fccc18039b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47

MD5 51e422c91e7e6fe36e866b4b60e43652
SHA1 e9e371dab021766c30aca13fe58dd305f7713b33
SHA256 e43d752219339ee8d534c58c304e185f041eecc908435c3bf5b42bca932941e5
SHA512 7180408a161486872ca9906cdbf5ea57795c2b1544b68fefa1dc35adc3170df675ffd55194881e65f57c9b185215ee1d43b6cc58d4706d0532fd2cca8cad373b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47

MD5 31c72108356bcbb5569409aa463923e3
SHA1 647712555d187d6763bdafc3e9c2ee9645bae56a
SHA256 16c8fd04d2e7f175e0092f4e468aaa9b762e79720e99683c787e4ed130404cdb
SHA512 4768ecbf85c6c15bad385b1c5b6937e4243aa4bdd0163ef49bf219047b6d9920a535a860cb29cc02dd5a427f170ff43d4e6e7fb5b3505233d24d671e84205e60

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47

MD5 4ff73aa489e352c6c35d61b1e09df593
SHA1 8f5bb27548d063a219a709abd00cbc094a12d0d7
SHA256 54cbf5de8965198bd4e2dae3a4140f143ff0bc05fed8452a27e9b26cf666be9d
SHA512 1aeef3d681c024b392d1054055b7160eb228f9ab0603939fa0e9917e6a1e7af9ff112b129c5d5be24194fd9f4598ef9e163167a1568219102a08e07f154182d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28276a88c60b32d0ede2ff8be2e90530
SHA1 08c7a72b8082faf3bc78205b64e32dd051471273
SHA256 bcd4650080855016b588567bebfc955472dac0c832dedd1b0e51a6e432891f6b
SHA512 a8e132f016c6934e09dd4b1aba6f38a61fc295cb4e81a2161ba01c68247f1c7cdef004d1a61d3550ad51465f920305331d1ec6f85f781cccbcc8e3c107156441

C:\Users\Admin\AppData\Local\Temp\Tar2362.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c6cae50ef09932e297eff9d3916f4288
SHA1 21545497321360cbd3419097b41bc065905016a1
SHA256 105ee7a0507c2b0d1277951d1945f85b605dc0af3dd36a272bf2b6c494a5e062
SHA512 74827a0e8459ec6781d43b3d50fd7c85e09819cf600ed8ad71fc3b1af7b124e238a5dc367a1b35354c94aee1ed0dce4b53d5fb32c51c8f9d956a0a719d1fdece

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 1da54785e14364548553c0fc0f30e94d
SHA1 8139091f51feeda55f114b78bf04cae830219232
SHA256 c00030b3091562fdcb6b45a9559832476d133beb8f31a5e9b234f721b4a863e4
SHA512 9e1bc7dfcbb6c47630377507d818145417d424745f458b3c51b1300a08e60ddc839eb1b31f3078a777395ced29cf608de656d2ce19b69e22a0db14c3edddca98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6cc0fd6771c4608e0c775fe42b4e007c
SHA1 a4ec536b0de30b6edd21684271157a1e7a493a69
SHA256 c79a6992dcdbe5e85b169c3608173ff7aa94797464ab23de30ec463635e33f6a
SHA512 8dd4fb7126762a3641b1455d644b9811932eb3693971f21c913f9c8d9467fd7eb6f0b2a8ae676fec0c6e8f4fc476f88ea766842face5e77284e79433605dbb6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_5E390E1CA50E646B1021D6CAA485D322

MD5 93b11faffe710c6a02b6598f14ba00f4
SHA1 c2aef6bd038611532cbfa296152eef3c1ba89014
SHA256 869c43bf2e1e71e7893b715c0ab8c2024d15dbdf400b1d0da166be41a893aeaa
SHA512 0cc8f23a825185634f14a220ecf1c0ca0d54aec46ba7ddddcf1ff6b49288efe544155d54a0642958485709f7e90336892985c22c36bc8c91a822d00ad8fb316b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_5E390E1CA50E646B1021D6CAA485D322

MD5 825b0a890b909d6f905afbd40748a3e9
SHA1 72fa58e62196b76c4a79663805516b1869e5cd56
SHA256 9a8a5301ab6052977a54946fd30513488a139099b14d80ed9cfe5e65996c3853
SHA512 a95d3813c1756042da1bd292711c587508029ee172ffe75d5f8e2d50928018249d888ee4cfa5204c831c3cdfba6b19322f23d5c47f1b2855b5ba585847b04ee2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\errorPageStrings[1]

MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\httpErrorPagesScripts[1]

MD5 3f57b781cb3ef114dd0b665151571b7b
SHA1 ce6a63f996df3a1cccb81720e21204b825e0238c
SHA256 46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA512 8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\cb=gapi[1].js

MD5 0fe383a7ddb9bbaefc3105b3297f5583
SHA1 f80c9d789f251909c7560bd91a9e1b9a10c26362
SHA256 d7ad4aad4e48174c30ef21fc32c9380659d2c99a5c39680e10ed9752139d8683
SHA512 31de1f59377bc76e5d602d02273867ce750bbbccb7edc8f2803c0188002ecae6752ac3ec31c2108e64b0d871b01e6a8a06711969dc68bd9823303def0e7c1ee4

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\dnserrordiagoff[1]

MD5 47f581b112d58eda23ea8b2e08cf0ff0
SHA1 6ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256 b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512 187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\platform[1].js

MD5 ca058c47f91fde91fe2689ab8e0b8a5c
SHA1 f49a88830ab0aedec26386d901232aba544e57d5
SHA256 376d19623973dd693148671943ac4e30194fc816761688e08ddfe9dc8553719a
SHA512 8bc32d1ea3217b651c9842f222612361c129ec5397f176d9724ea154012ffe774818d58292e6eea22deea5b466ae9667a878b5c1bbbf386070d74ed9764f2ab8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\jquery.min[2].js

MD5 e85aed5c30d734f1e30646e030d7a817
SHA1 b8dcaa1c866905c0bdb0b70c8e564ff1c3fe27ad
SHA256 8f0a19ee8c606b35a10904951e0a27da1896eafe33c6e88cb7bcbe455f05a24a
SHA512 a5b7c4911b530b4b550838f50ceda9d9382d86aad7cb4ff13c897c269bc7ff350ccf01487534882f294749bc19f3398f0b338e1d8b03af3dba1ef382168ecc9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20b948c2dc225657696faad93f588139
SHA1 4b0cc76ee13889f923a0cd46878b5bbc46777229
SHA256 9efc53b493bed2fb991e9831b9d2bc40ce9225ce4f14b46f966c21438281202f
SHA512 94f41cbb89bad84601d1df9d11effeebf2c9a239f417d2924e4c53d22d68685cb516e733e416b801b98a871c4d1497bafaabaefac955697714cb3da78622dc1e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 3dd062d11a638889a0528b631bd68077
SHA1 c3a1a9a58b952bf822a1d0b7c6d1e849da6f786a
SHA256 af3765cf294ab046d2f233f44192f85dd4ef39ecf4a4a0eb80b038fd16a15a51
SHA512 6f1e999e79e10e0a72d739ee527a5428aed7c0d60d010bd061f72af36484076634e28c7c3358105eaa6fb0619d274cc1331a8b49384e150e9487e9f3eecca317

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 304e089b1eeef74496220145828f0071
SHA1 90be3b2f46d255fcfbab4ff973b5c55bf51fa9d5
SHA256 45151b3dc6dba2fc8132dc50df9b73cfe3415e97f0ab4f0262d8aa9ee8baa22d
SHA512 f01a9c969931a4661230c1642910af0aba0dced464c7964d7812c1349597fa8660f25f0bcd766f19b569f51ffaeb6963b9e6bd8fb74281891f1967dbac9b25ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9879d2377815ad78a736e2c80445fec2
SHA1 4cf0557d806f4bbef6e19be95b48f67f0aefcd45
SHA256 b6013bcba5411d2b1f396ee7cb621e6b06cc65e3d9809ad0610d47fd31f9c12b
SHA512 87a2fd6b57900924c10ba9788d91c2e478344958c22d373e582d9ee5cb98f4d363ed18cfd947d1e50a1ca2ec23cc0613338f1ec1112a57b385a9a30bc3cdd9e1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2c522b79fef3ef1ddc979d1899c3ec3f
SHA1 1253089a2b091e55c3db04af688c2bd7e4626933
SHA256 2b0424c1cbb8fbf01f0e67e3fd892c6e230c86dac2273a854bcd22bdd0430c1c
SHA512 cfb8bb17551e31d8975fce0a734b10a99c91de002f46e0b3e0081babbce804991d51a1d773ebf4bb8497ea68d86144ffc56333959ee728df117d6abf33d6d96e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7ce6d18bf27732dc65a5514ab3e40e6f
SHA1 89ef5fad398b0d6cb78edb291057eeedc009ccfe
SHA256 d4e70b74d218e280fdd33714dfed8d98b8b572bd2df81be863c8fa193013b04b
SHA512 2bf55123095127d4ea476e73ab40d221a2201b752b16943cd6d61aca3d0a3f21d4db138d97e26a36f07c408a86da55492bcdfa707d70322e1f1eecc95451c68d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7ba2513774a705805c6e9efaa68b1d1e
SHA1 bfaf5e0926367221b34fbbaa734e0084ea3db2ab
SHA256 fdea2ba348d8bb104fd8cd4da1f1ae76ebb8e4d078d876f20fbc2619cfee6a3b
SHA512 e50290aa6b7683e1f245de0e1d7172b542e0845d0d018efbbc7b74b333d2a805df6755cecadfe3d013f94ed4bee3d49e6bf2fd1cfc6fad366fd23add3d484740

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b3e5f1d1e5483aaa7a036b5b0de2f708
SHA1 4d7fbe8b21c68fb0f33cb88229ccc19dae0ee155
SHA256 33feef0491c90fa83551f3d1093c9b054e6186e8da481dd803ddc219d96e41aa
SHA512 60c926f7244cce372f51e077cad832610e16fd0df274f85246c418460e29cfbf5b769dccdf26a5b2b6b315d6d97e46e3c636049758f1861e83ac312a00e2b873

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 d653464c9ea47a11669e3dcb51875eb3
SHA1 01450f250354881a11e8339dd1da5bb277b8f7e4
SHA256 1f6e4fe5df4977438845bfead4eaaae32f761d26a62242e90c6b6851a1dfbda3
SHA512 9875e7f1041c21f163279da606281b97aaa0146603edd89c0610440260e53f38cfb45ec8344299f1a20b5ec36daf7a1a06a88fb7fa26c67e4fe9f9344afeeafd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eac68a2cdee2cb5df9e3648bdd5a1c2a
SHA1 37d05b3b550b038c5afd75dce4c9f394a00b98d5
SHA256 a39a0150d4b62a62b2a3fc1cdece47747062cc496e41c301ed532a058f680b43
SHA512 5923f4789698ee5575720778948c120890df06047a39dce6be18d201e47d19720b78e2ff984595cac494a9087ca85ba3103b791d61ae09f330b2792b21a500e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8d2f8eba75eaf70ca5c522ed4b7c650d
SHA1 2119730f4849e2d03618027e58b90d5fa7782a3b
SHA256 4b91b5fd4469266cd5b7e67cf9c6e770f17cf76f909a4d8dc6c04cbee82aabf4
SHA512 33c1ce648720a36317599e7b068bc33bf721048f8e0ca2949b991ee96f6f4e862494728b1cdf09105706a9aedbf84872605be084e0ffa88d989ecea03d71586d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f20036c969003cbc70abbe47322f1b1
SHA1 9456938f825a4ee6b8d76c86d38c77975c5affd0
SHA256 a246c8f1791815dbdc9b6da762360920465bce569cbfbf8950fd86cf35f7602b
SHA512 5aebcdcc01a30956252406fe577dc1ce7930f22c7627b49ff484c0bd840645292658b27f6fb240b4d5ffdd48026baac529c555976e91ba5198199a15157118c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3c3df65ab3e87e6bedce4749aea020c
SHA1 dd7a2cea464ac9462c15ad022edfd7ba55aa84be
SHA256 fe05fcfc05210791fcd75c9af82136cd7c2e5e0fc5e3f8a5ce021890769ae384
SHA512 7ea78d012b9d32d75f39c65dc47aa17b63a1cecd1c3c90448d3a085ec253fe3d8211019e692753491f288800caf141660fbf56872be06d1efbab38c362a26d69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f6fcb943eec34aac2cb0f293a707d4f1
SHA1 7f0bd0645202e2f1ddd858f14bc7e461a4284c58
SHA256 5fe765d71b4d4afa46c13f733ecb320a6d7685acb2c6fba28514505d566750ef
SHA512 8c4ed7d160070be15cb371a59bac4ecac851b18c209eb06e430be5b8d985cc9ce6c86feccd6b5448f8800fdb7fdcaf4a9dd23f58872b177df25c18c98d094c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 678ee479ec3cc69e4109e24adff2e0b2
SHA1 4abf65279dee4f9d67fc9cd51b1204b5494afb56
SHA256 58a7e82c37b479009575d213adf99e28605e6cd467046c1240ae0fd1096d71eb
SHA512 fa0fb4ec206fbbc6629ac2d5c5fc53c1d155715488301dd43874db99e59c47fd5b8220ea4caef79f7dc3b6360f51b1e789f1565049110caa444bc535da0c8e5c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9745ee0dc3e1de1b448ecd30928e094
SHA1 40aa5dbb3bd7992ea0e86e97746d1de6633fcbfb
SHA256 d5efda51d53e7ee90131c4e80ab2443892931ecf0feaa05aaabd214a60c5d3a6
SHA512 8de1750c9ac92884199bc5425af1a7695a1a3627de07c66af3226285333ccddd8e2f53934dcc32bc2d078441f3bc4a1245ac71baa0cba45860b5673ccdc2461c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 937f2a00bee8472671e72db4902de083
SHA1 e9f0333855010f5c2dd18fe971001f4b50baa5b9
SHA256 6f20d608b868a4a6a6f5af0d5fb5795eb31bcd0335532f672e3da29546d0ce53
SHA512 554b4df124cd6e8c3a4db55cebf43b0efb5f347318efa488e9a670f9f4b036160c7918c0652dff762a0db4629892a3261663d59e42cc50c072e277390c7da089

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 70191fc445d8eb6c2ffd94fe90a257ca
SHA1 a50c05eab88b5e2c3094a7854f5cf34ea03d4357
SHA256 74802a2373af62012c6dc5e299c4dd796c35d85f851f0d11f13084b80a783300
SHA512 3f9ba0a3424258cb9859e04555af5d28425f60b9a9746e0fbc8263846c90e3cd96cd30be696820d09304c2841ef376e90854394051b34aa917bf42abca4246cf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9064426ba7a27d2d75335d75afa67a93
SHA1 532cbd5cc84a33c1545a2ec818660838e3f9ab9a
SHA256 0f47e36afb00baf444b1c6a5b7590b31a017020a76c54ebdbb5b8e135478caab
SHA512 ffc509f2ef1fdfc92abb4d9173862a4366a5820cae99b994daeb9a15a452e8b8b3ef7a5991927294f441174040cc97affb52deaeac6839320e53b11c3b0087dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ebe6270e216e9958251c43d4bdd50164
SHA1 878caa7f9da0aad216c23646bab14e089f791d71
SHA256 14bda509f8b1e26ea9d5e8c77e1a5b33429d092ece151afef17a2b0eeb288cc0
SHA512 5d6fe2179fa76d8eec3ed1de373cc9a697189c4d60df86b07c0c9b65ab61cdf5b795aa47a60064411a9c123b00422b8517041d35f6ee4a4342e60300dd979ff9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3fe1dfa094091c1bc3c583d098870267
SHA1 b8d372f100dedbce8a45875437546060a15c35d9
SHA256 1c1b840cf198f4774b0f9da1fd91e0e6d17afbead4e2c25a13369cbf00e65a3f
SHA512 c2a564077b216cc6ea3c1964a605155a87ec617e6721975a1ce6e1d86efd1820abb463060d5198292f1bd6857c9a2ab3e169e3b9a18771d6ea3565a14039e523

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\rpc_shindig_random[1].js

MD5 6a90a8e611705b6e5953757cc549ce8c
SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ADCJI8Z\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 825bb8b87f70194b786775cdce0561f2
SHA1 f67bd54eba06dcfd5a8832ca0352d2adaed0a3f0
SHA256 f56d699bed07dce1b100ec52cbe774fefcb99b74eb4a236a623847b981cdb0f9
SHA512 13fb5c6941ae50846518d1430c569b7a4e8891b10f4b128b33c12102c7b1804f241a156c603d768113cc31e1bc521d286ad457d49c208a4d5a2390da38dca3a5

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 09:25

Reported

2024-06-13 09:28

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4d6feebe7ec73b0643a3a6680e81268_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4860 wrote to memory of 4192 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 4192 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2656 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 4576 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 4576 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 3056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4d6feebe7ec73b0643a3a6680e81268_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7e3f46f8,0x7ffa7e3f4708,0x7ffa7e3f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2806841464794120699,12198263048902318307,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5728 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 w.sharethis.com udp
US 8.8.8.8:53 s7.addthis.com udp
US 8.8.8.8:53 helplogger.googlecode.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 www.blogger.com udp
FR 18.164.52.36:80 w.sharethis.com tcp
GB 163.70.151.21:80 connect.facebook.net tcp
GB 142.250.178.9:443 www.blogger.com tcp
NL 142.250.102.82:80 helplogger.googlecode.com tcp
BE 104.68.81.91:445 s7.addthis.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
FR 18.164.52.36:443 w.sharethis.com tcp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 feeds.feedburner.com udp
GB 142.250.187.238:80 feeds.feedburner.com tcp
NL 142.250.102.82:80 helplogger.googlecode.com tcp
US 8.8.8.8:53 ad24.gr udp
US 8.8.8.8:53 l.sharethis.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 36.52.164.18.in-addr.arpa udp
US 8.8.8.8:53 82.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 50.201.222.52.in-addr.arpa udp
IE 54.74.6.207:443 l.sharethis.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:80 www.facebook.com tcp
US 8.8.8.8:53 nwidget.networkedblogs.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.widgeo.net udp
US 8.8.8.8:53 jf.revolvermaps.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 157.240.221.35:443 www.facebook.com tcp
US 8.8.8.8:53 s7.addthis.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 www.zougla.gr udp
GB 172.217.16.238:443 apis.google.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 172.217.169.42:80 ajax.googleapis.com tcp
GB 172.217.169.42:443 ajax.googleapis.com tcp
GB 172.217.169.42:443 ajax.googleapis.com tcp
GB 172.217.169.42:80 ajax.googleapis.com tcp
US 104.26.10.22:80 www.widgeo.net tcp
DE 185.44.104.99:80 jf.revolvermaps.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
BE 23.14.90.83:80 www.zougla.gr tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
BE 104.68.81.91:80 s7.addthis.com tcp
US 8.8.8.8:53 network.clickbanner.gr udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 fvcreatives.s3.amazonaws.com udp
BE 104.68.81.91:443 s7.addthis.com tcp
BE 23.14.90.83:443 www.zougla.gr tcp
US 8.8.8.8:53 forestvieweu.go2cloud.org udp
GB 142.250.178.9:80 img2.blogblog.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
IE 52.218.62.58:80 fvcreatives.s3.amazonaws.com tcp
IE 52.218.62.58:80 fvcreatives.s3.amazonaws.com tcp
IE 52.210.2.133:80 forestvieweu.go2cloud.org tcp
IE 52.210.2.133:80 forestvieweu.go2cloud.org tcp
US 8.8.8.8:53 s08.flagcounter.com udp
IE 52.218.62.58:80 fvcreatives.s3.amazonaws.com tcp
IE 52.210.2.133:80 forestvieweu.go2cloud.org tcp
IE 52.218.62.58:80 fvcreatives.s3.amazonaws.com tcp
IE 52.218.62.58:80 fvcreatives.s3.amazonaws.com tcp
US 45.58.124.226:80 s08.flagcounter.com tcp
IE 52.218.62.58:80 fvcreatives.s3.amazonaws.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 www.alexa.com udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 107.20.94.77:80 www.alexa.com tcp
US 8.8.8.8:53 207.6.74.54.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 22.10.26.104.in-addr.arpa udp
US 8.8.8.8:53 42.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 99.104.44.185.in-addr.arpa udp
US 8.8.8.8:53 83.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 91.81.68.104.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 58.62.218.52.in-addr.arpa udp
US 8.8.8.8:53 133.2.210.52.in-addr.arpa udp
US 8.8.8.8:53 226.124.58.45.in-addr.arpa udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 lh6.googleusercontent.com udp
GB 172.217.16.225:443 lh6.googleusercontent.com tcp
GB 172.217.16.225:443 lh6.googleusercontent.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
US 8.8.8.8:53 static.networkedblogs.com udp
US 107.20.94.77:443 www.alexa.com tcp
US 8.8.8.8:53 www.vrisko.gr udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 i.creativecommons.org udp
US 8.8.8.8:53 www.greek-sites.gr udp
US 204.79.197.237:443 g.bing.com tcp
GR 5.172.193.139:80 www.greek-sites.gr tcp
US 104.20.6.134:80 i.creativecommons.org tcp
US 8.8.8.8:53 ws.sharethis.com udp
NL 23.62.61.75:80 www.vrisko.gr tcp
US 8.8.8.8:53 licensebuttons.net udp
NL 23.62.61.75:443 www.vrisko.gr tcp
US 104.22.11.121:443 licensebuttons.net tcp
GR 5.172.193.139:80 www.greek-sites.gr tcp
NL 23.62.61.144:443 www.bing.com tcp
US 8.8.8.8:53 77.94.20.107.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 134.6.20.104.in-addr.arpa udp
US 8.8.8.8:53 121.11.22.104.in-addr.arpa udp
US 8.8.8.8:53 144.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.socializeyourcause.org udp
US 45.79.19.196:445 www.socializeyourcause.org tcp
US 45.33.2.79:445 www.socializeyourcause.org tcp
US 198.58.118.167:445 www.socializeyourcause.org tcp
US 45.33.18.44:445 www.socializeyourcause.org tcp
US 173.255.194.134:445 www.socializeyourcause.org tcp
US 96.126.123.244:445 www.socializeyourcause.org tcp
US 72.14.185.43:445 www.socializeyourcause.org tcp
US 45.33.23.183:445 www.socializeyourcause.org tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 45.33.30.197:445 www.socializeyourcause.org tcp
US 72.14.178.174:445 www.socializeyourcause.org tcp
US 45.56.79.23:445 www.socializeyourcause.org tcp
US 45.33.20.235:445 www.socializeyourcause.org tcp
US 8.8.8.8:53 www.socializeyourcause.org udp
US 45.79.19.196:139 www.socializeyourcause.org tcp
US 8.8.8.8:53 s7.addthis.com udp
BE 104.68.81.91:445 s7.addthis.com tcp
US 8.8.8.8:53 s7.addthis.com udp
GB 142.250.178.9:443 img2.blogblog.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 forestvieweu.go2cloud.org udp
GB 163.70.151.35:445 www.facebook.com tcp
IE 18.202.12.61:80 forestvieweu.go2cloud.org tcp
IE 18.202.12.61:80 forestvieweu.go2cloud.org tcp
GB 172.217.16.238:443 apis.google.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 www.microsofttranslator.com udp
US 8.8.8.8:53 accounts.google.com udp
US 20.119.175.244:80 www.microsofttranslator.com tcp
US 8.8.8.8:53 rf.revolvermaps.com udp
US 8.8.8.8:53 count-server.sharethis.com udp
US 104.26.10.22:443 www.widgeo.net tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 104.26.10.22:443 www.widgeo.net tcp
US 8.8.8.8:53 www.widgeo.net udp
NL 192.229.233.25:445 platform.twitter.com tcp
GB 163.70.151.21:445 connect.facebook.net tcp
US 172.67.69.193:445 www.widgeo.net tcp
FR 13.249.9.70:443 count-server.sharethis.com tcp
DE 185.44.104.99:80 rf.revolvermaps.com tcp
US 104.26.10.22:443 www.widgeo.net tcp
US 8.8.8.8:53 mc.yandex.ru udp
US 8.8.8.8:53 widgets.amung.us udp
DE 185.44.104.99:80 rf.revolvermaps.com tcp
DE 185.44.104.99:80 rf.revolvermaps.com tcp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 www.facebook.com udp
RU 87.250.250.119:443 mc.yandex.ru tcp
US 104.22.74.171:80 widgets.amung.us tcp
GB 216.58.201.110:80 developers.google.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 www.revolvermaps.com udp
US 8.8.8.8:53 static.punchtab.com udp
US 8.8.8.8:53 arvigorothan.com udp
GB 216.58.201.110:443 developers.google.com tcp
US 172.67.150.119:443 arvigorothan.com tcp
US 8.8.8.8:53 www.google.com udp
NL 142.250.27.84:443 accounts.google.com udp
GB 142.250.178.9:443 img2.blogblog.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 t.dtscout.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
DE 141.101.120.11:443 t.dtscout.com tcp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 61.12.202.18.in-addr.arpa udp
US 8.8.8.8:53 244.175.119.20.in-addr.arpa udp
US 8.8.8.8:53 70.9.249.13.in-addr.arpa udp
US 8.8.8.8:53 171.74.22.104.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 119.250.250.87.in-addr.arpa udp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 119.150.67.172.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 steejiwoowu.net udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
NL 139.45.197.244:443 steejiwoowu.net tcp
GB 216.58.201.110:443 developers.google.com udp
US 8.8.8.8:53 sr7pv7n5x.com udp
US 8.8.8.8:53 yonmewon.com udp
US 8.8.8.8:53 my.rtmark.net udp
NL 139.45.195.8:443 my.rtmark.net tcp
NL 139.45.197.236:443 yonmewon.com tcp
NL 212.117.190.201:443 sr7pv7n5x.com tcp
US 8.8.8.8:53 connect.facebook.net udp
US 104.26.11.22:445 www.widgeo.net tcp
US 104.26.10.22:445 www.widgeo.net tcp
GB 163.70.151.21:139 connect.facebook.net tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 ws.sharethis.com udp
NL 192.229.233.25:139 platform.twitter.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com udp
GB 142.250.180.1:443 3.bp.blogspot.com tcp
US 8.8.8.8:53 11.120.101.141.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 8.195.45.139.in-addr.arpa udp
US 8.8.8.8:53 244.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 236.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 201.190.117.212.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
GB 172.217.169.34:445 pagead2.googlesyndication.com tcp
GB 216.58.204.66:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 whos.amung.us udp
US 104.22.74.171:445 whos.amung.us tcp
US 8.8.8.8:53 whos.amung.us udp
US 172.67.8.141:445 whos.amung.us tcp
US 104.22.75.171:445 whos.amung.us tcp
DE 185.44.104.99:80 rf.revolvermaps.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

\??\pipe\LOCAL\crashpad_4860_HZZTUGNAUGYESMOA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 55b575812609eef25a9163420d989747
SHA1 186bf81fca467be12f817f6b4337069351389f3b
SHA256 ac00559e9812eae97af4b2786d32cf07ab8b132440c3876177aac2a0848e1893
SHA512 dedf89d39f1697a86bb6716630ac394dc03dc214bef938376d7d7d83986e74f21ca0dcd09361a8fd4cf612adb13c60da184ba0695375a5bafed18851d31c35fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c245a28dca2c6f795461f2226085a9bf
SHA1 7403f2bb0457de4c72a92e2f065eeca2509e3943
SHA256 02c7109071b9a0976cf1de110ce3ad6d8720689391c7b1a319901c49b48b4b15
SHA512 2db416907b124ac06877197274f953fa4d921481a2135ec86b5144adc7b2ad3f726fa5c4e2a79f55ee9dd52ef84ac60b55c3ef9a8c4825cec61ad88e63f1f590

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 83ece3bf4dec7a40e99fbcd26fe11d89
SHA1 bc54614c30e28911d7cb1483d18f33e2587ec46d
SHA256 64f674052b72dc036c2e0b7d6e2006103ec2a15a833bad4413bd1c6e07ba2608
SHA512 613144dfca40c17735b5956a54fcbf6890fc55c0d8f9f86f39cdf92ee765d69614e11dfa53dd6f95b023abae12415792c37e0dec6f1cd571a7d5d8cd3e58ecd5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 424dfe4ba2965e72aa34c3e41e3d416b
SHA1 f70b7e8c72f3f80bc3865e9ba0f1b569a0b89304
SHA256 e98b3f85a3eeec3059f8aebd01baca9df5ef7020c68405b919b1df7ed8505e2b
SHA512 1c703ff5e2a7d4edb5e9a5e0671c468e49390b906f733b6ac284f936d3b6136c6be545e855f2bc45d3e053d78b348a9a7bf6301e867377af605e84bddb634276

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bc7c13557addf413bfe2f606bc9b628d
SHA1 3037777852ee268b6e0c218d7aea019516caf153
SHA256 0a7fe83ea62cbdc5a584d4e79ada00a99eb7fc94ee28aff8c853e70f7d548fb2
SHA512 5cace0482974af5c526e389e147fab28065dff0ed7502d7cf93981f17596bdcdf853bf430b21831f1181585ed748167656cd7c4aca1bb212fca8fa74ebc694bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b9cc8c2c9e017d9c61715cd7ca45b035
SHA1 62bc5afdb7a34d345f9f898992c294f9b54bb23b
SHA256 fabf0dba29a23126b85cd887ba93468a1c3b7068fccfdd83bafbc0e98e3d89f4
SHA512 92a39d1de357ee13559d0b8278cd667fa2367d247840f87a00389e11ca58df3bc4eff536bc6be68e2e5fad211eedd70a99dd297d92dd2b0db267369e8b4423ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58aee8.TMP

MD5 2ac32bb47f139530c889c1cd19657f94
SHA1 a93e2ac253c4299cb624038b563030d76f41f891
SHA256 89174fe9d472f864626316f46778083163e9f31d3f516a8e4d92b87b732f06b3
SHA512 6b11f5e930da3abe25594b2b753fc5d5cdab18fb7fa5367c70517f3a6362c47053c90e3bff601bdcbda8ffc4c114e78161be1a7e4e4e845673f9fdb371d72347

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 679c3fc3948381464a8259ce54bd28bc
SHA1 add668cefd9b1a0591b80ded13cab73e2dcb2b7f
SHA256 1fef14657e01fc3d02ee11178124a4215f62e07e074bb6e3f33c251de8baaf54
SHA512 9fdff36268f0f843d372b2e641fd83e63601cc8ab1643008186bfd3b6bc7ac15b9a3b5fdc6763357f88b0f5449a5db26d5a1437d91543c300e3e39858127f3dc