Malware Analysis Report

2024-10-19 02:45

Sample ID 240826-enb39atfmf
Target c23f130feb3893b0e439b8ac780ce76c_JaffaCakes118
SHA256 bb3e8d0194d638399f8dded768ef93646b3bf18836e5d9e8a251d9b9c6464734
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bb3e8d0194d638399f8dded768ef93646b3bf18836e5d9e8a251d9b9c6464734

Threat Level: Known bad

The file c23f130feb3893b0e439b8ac780ce76c_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

Browser Information Discovery

System Location Discovery: System Language Discovery

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-26 04:04

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-26 04:04

Reported

2024-08-26 04:07

Platform

win7-20240704-en

Max time kernel

136s

Max time network

137s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c23f130feb3893b0e439b8ac780ce76c_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430806956" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55FF6591-6360-11EF-AD79-76B5B9884319} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000bc01526ce0cdc33a3e277fe1f8ef1a0bd1a15524ba238b70008eebbfd243c70d000000000e80000000020000200000004bda94389c9799fb6f4583c620688d21e43f745f25cdb4fd2a4ef7027761a3c89000000010dbdbd9bbe62e63ad74ed818dc7abff5d7bd9a8845cae24896097c6aa1f0111429220d0c54cf69616c803a7b1240587a0224da00d5683dbb11f024b460d39a012615fc2d7569346a331fe8651c256c5ef3d639bcf717e1d166a17643ab03173e35c5f3d1965cdce61c0ba32b2643e1914a6e452b51e99dc13143764e60fb82b35c0c4dd648763a2fa07f45a4937df8940000000f672a15c803e660929be6852c4b6f8cd179e4d3ce9cf4c10141e1509586d4d7be8900c9a64f9985d074f4b750b55738e4ef41127c942fca3a53db681457000fa C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000a377a7bf4bedd939a5cfeff7b0d753eeef21c08498f06707f285b524091662cc000000000e800000000200002000000048385cf7efa869d19e90b33115c1b00a2084deffd43c025c7482b4be310b4e9e20000000f7eee85992f3f453fb97761ab87daffbd9be4db8f24fbf4345bfe533821d0cbc400000005b3408c1cf6cd887dddc213f81817733b6f23d04e68de0de4ae3c81e0b8be3a7197a52abe4710f2f976c97ca41dcad17fbd28d2aa4f1fea1a302d19a9fb9ddb6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09929496df7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c23f130feb3893b0e439b8ac780ce76c_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 dl.dropbox.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 pazos-blogger.googlecode.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 games.mochiads.com udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 ads37459.hotwords.com udp
FR 142.250.178.138:80 ajax.googleapis.com tcp
FR 142.250.178.138:80 ajax.googleapis.com tcp
FR 142.250.178.138:443 ajax.googleapis.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.75.234:80 fonts.googleapis.com tcp
FR 142.250.75.234:80 fonts.googleapis.com tcp
FR 142.250.179.105:443 img2.blogblog.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
FR 142.250.179.105:443 img2.blogblog.com tcp
FR 142.250.179.105:443 img2.blogblog.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.105:443 img2.blogblog.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.105:443 img2.blogblog.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
IE 172.253.116.82:80 pazos-blogger.googlecode.com tcp
IE 172.253.116.82:80 pazos-blogger.googlecode.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
FR 142.250.179.97:80 1.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.179.105:80 img2.blogblog.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.179.105:80 img2.blogblog.com tcp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
FR 142.250.179.66:80 pagead2.googlesyndication.com tcp
FR 142.250.179.66:80 pagead2.googlesyndication.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
FR 216.58.214.163:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
FR 216.58.214.163:80 o.pki.goog tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.178.131:80 fonts.gstatic.com tcp
FR 142.250.178.131:80 fonts.gstatic.com tcp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 92.123.142.59:80 crl.microsoft.com tcp
US 8.8.8.8:53 dementor200.disqus.com udp
US 8.8.8.8:53 www.facebook.com udp
US 199.232.196.134:80 dementor200.disqus.com tcp
US 199.232.196.134:80 dementor200.disqus.com tcp
GB 157.240.221.35:80 www.facebook.com tcp
GB 157.240.221.35:80 www.facebook.com tcp
US 199.232.196.134:443 dementor200.disqus.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 a.disquscdn.com udp
US 199.232.194.49:443 a.disquscdn.com tcp
US 199.232.194.49:443 a.disquscdn.com tcp
US 199.232.194.49:443 a.disquscdn.com tcp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
FR 142.250.179.97:443 ep2.adtrafficquality.google tcp
FR 142.250.179.97:443 ep2.adtrafficquality.google tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
FR 142.250.178.129:443 tpc.googlesyndication.com tcp
FR 142.250.178.129:443 tpc.googlesyndication.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 578cc10ccde360a163af2bbffac8bc0b
SHA1 e520bf7b6b8e96866e827f70280fe596cee0768e
SHA256 26fe5f878a693c04c09e3c98bf580d1a7fd1c8e85ef5d007a39a7cedd39d4e94
SHA512 3caee63c9f647d595403b2087f39ed596e9846ac63ffe2f8827692f4f9700649b379df960428e8b78e315420942675251d72a9c45279b2d07c263bac66c0fee1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 36c28093e15de662f68d1625fa5b6d8e
SHA1 0f8ebfce30e800b697dd2f7f1fbfacb0c1569303
SHA256 0d0095b8f059db90c99cb23ab6dc6fe897ad7ed04f5e5cc8488971fe151fe89a
SHA512 cfa24a1f4b615cacf7d8782a51c4528967f5ec4c73f0d7a5d74620d5b42118e31321b862a178a090ef16a869a6b5c1dfbc3503cba8b16d1d0fcb4f4c1746c2c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 0184a0a7f06be34b0aac58e5e9c10d46
SHA1 cc62631072db617e3ffbdc1b244b3fc5821c765c
SHA256 2d40f3a19ae87d4a653884d4a4091615049c307a26b8d23beb2bcace0de92ca0
SHA512 f1acd147d5ee6fbfa78e40e0729e44b1656917187e03e0ef680191daf3f0b7329fe9ec74663026ce0ee9ab3c78b025f46db71c1731d657f5726ce08bf0f89ab5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 4a18a5db2d6d6be0a964ee87dcddf159
SHA1 ea8769c6dd8a7e0f2c5510661140f236f86893e3
SHA256 bcfccfaf557f7d208e371b037b6baeb04274a02f3faa5895717cd79cb082e471
SHA512 66b18715465092b968103445f601a4c9394e58791d7c93437490a314295de0e4548b5d50a5de6d5f8708beb5057d12650d33fda8f1708e267db8c2b648e7ec47

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_9CE832D646FBAFC5C4ACFC523FDD84AD

MD5 931a92603ffaae0a4a7759c17b295616
SHA1 74a00dac20018b5a64944c08fccb8d429c828b98
SHA256 89fa6b968b2fb048970226fa3b59fb103d5c30366e7c5594656447dba015c2e4
SHA512 dbeb7acac5de75f49a92caa5abb359c7b377a4c39654274d6762c898e163e2b410bdb0d86de9cf2a5674d3ce1bbdfc345dba9a858e7582ad622215135d85ffaf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_9CE832D646FBAFC5C4ACFC523FDD84AD

MD5 3565d3104fa920a897ae5ae49dfbc5bc
SHA1 4704720303efd716199f5a53390a13549fc054f8
SHA256 e59be9994e30908914b4579c7625d33ab7473e0625c7f1db2c31782cd65c2e09
SHA512 e37a07d3cc4f9f66973f3f0cd9c1e119cd7ca42746045b6a2f0cdde3615a711a47a2423378f1dcfa6d6f620037b86b56a07a73eddf5a6b4d2f064f24efeb52f8

C:\Users\Admin\AppData\Local\Temp\Cab87A9.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar8941.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 594f4e49428ca23af82e6663816e1685
SHA1 34508835e6b93e71d328d85c8c1756eaf0c9b150
SHA256 9e89e1c83a50a8ae44592f3bb2ae7b324da2ddc63a58b36265bf47551b410d5c
SHA512 6c7b12568f2a4cd2a1ebf34607ff0ea2457c8d2e7b52a63eea769c6182539ec8bb3e88a38aa9699ea58f5f1ce09fd87d530210196ee9c76d97adfb2750caa210

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 994c246dfec4cb29ca2473e4f26b800a
SHA1 6ca5365313b07f1d68915d6c6943adc144e4b972
SHA256 6b7a683c1dcf5a0f5007bacfc92ec3c05f3fae935b62f3b913675830afcefc1d
SHA512 098f94d3f3cd2de1ec676ef00e435800bab79a6c7317f601194bfc34ff051a5588cfe6219a498fa9be5b1856f62699a376f33cc5b48073e9169b4c6da507cb12

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 17f98ab1d28baa86134a79e1a3ba4be5
SHA1 9dfcd9ec065a9082ff4deb9c0b8979fdd64df6a5
SHA256 943ec2ede4f678c5c16b4175aa254ecc668cab3ae813a3787c2b7bd11b1941f8
SHA512 63cd74f24a5b9d03cc39a9e19b95cd6192670e16e88babe4458966fbaa6e13bc879f385e646d2bc744bc810bf1c89164a6a0778d0623efaba74ad7902aeb3210

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 166ed1b5c99a0964fe6f4ec938fdbd99
SHA1 b4602912c445b6bb3c2f65b779d8325e221756ed
SHA256 32535581174aaeb626b55538583327f0a667012a647132431ba715ae51cc47fa
SHA512 853406d79ed144d99177149e9928268323d9f661ad2501a29e84865130a7221fba081016b4ad4490953d0bb2e0ab69d1a18164fe7f4db82733bc4e4ff2d46d4a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

MD5 5897e4921cbe35c5f6dd5160ebaa3b29
SHA1 2227cf42a86dcf70834e0c41c3aba61ff01737c4
SHA256 c2d80b9f95a2d7d3940e73fa0bfd1344c8476e9500e84ea3044aac39d4f0ac24
SHA512 4ee68755b1d43f0aeb4675517f70b871544eb46485374d5ffd0ac11d262752c0d143cc05750068c98b14f331cd2fbed2d75740f7c4d83963269b1cf2779e06d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

MD5 c5dfb849ca051355ee2dba1ac33eb028
SHA1 d69b561148f01c77c54578c10926df5b856976ad
SHA256 cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA512 88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b5baa7c7c01b8f610d97b8ef92dc5ba7
SHA1 d72b8681cfc92cc78289c2a6e1de39e5d23c1ca3
SHA256 6250bed8adbc5d97ab97fa7ddef81e982860eccb494862900ef30fc6981b7b65
SHA512 b8cddba401e7b619408ec5fdcecdcd35de77f1d759aadd3eb7917a7cd7a5ecc9e41689921c60cd6b279371a9f23466b2c8a324ea026fc0dad592c23cdbc09eef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f2b0e5322752ea6896c738661e77453
SHA1 e14e4448cc9b23351fb9627196724c55b3709f6a
SHA256 32cdb77473d4add085a911196dfdc72db19910ca9bbc6eae6ac5b39b44f11a9e
SHA512 b22e31d5f32482c9c2ad14e800a3c2544ba596bdd375f94094104ccda93890abfaa210d10e94c76e80ab2b99233da4d70d6c698a948bf5e0505142778f5fc373

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 531ef39c8ad0d9ccbc43723dd59d33f3
SHA1 5d8e7df8d7b3368403d05f3c1e92ca2473ef4054
SHA256 4b20ca23bf39a6cedc1df4c02eac376f394259bf488a8235b67db44c4edeba49
SHA512 1bd6807c85829abc2952584daaab1c63eb8871c95760be49fcf87ca66a7702b5903f316fc239b90c5334ac2e47a9df4cbf152a2af7e2e5522e30899a85e6c23f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf4fb615192e5bc5898e895998c40d79
SHA1 e31db7b850da610e8fb2187f8810afd2e889d341
SHA256 e612ccb858f33a39a09237dde5cade847de323eca86cf09bc6aaf0af0a1a68b4
SHA512 f2c69f28c4bacd4f0ea06776e000ab493f68065b6e8536e0c5ff5995b9491f4e36770b080f6bce4675ac691ef072cbbb97fb9bf18e7aa7cb8b419684e70c474b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 878ffcfc7f908cd09e5e7f9322e503a4
SHA1 95a8c525b57133500761007a1b0a12de82afa858
SHA256 613eb64c2041084145752fa3344a8994ad98b007c4d833827c99ab1280e0cbd3
SHA512 44a67f07199439d5e3bcfd69d1d7b04acd43990269724c805627d566d87e2caa671532a406b2e3a9ccb72e67e60efee1a826e06f68a5b620dcad6e77b06deb89

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 95ddd36177ac0f1641e0b02b80488f02
SHA1 c2d15e63d069a574e1130f9a8d76180ef266cb6d
SHA256 61d8c1854fb871be21e5928bcc018c8a3516f3263236948e08158231cdbcc0dc
SHA512 e8e9acc811d98293779b5559de115e299ca42f250f5128fd688a3759e2b55f589f47282732e8432fabf8631c951242c99b4149b7eaf29f3c8b8a99d70e3ed911

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 928298a7008b5b1c8e72135314fc3d7d
SHA1 9b6fcb321763d2044cd1c896ae433561ca7d9b28
SHA256 2e7cfef24dde4a5c453805fe759bb556bac31340d00fae386f840e4dc5ba3faa
SHA512 cf66d72779fdb1754e9e4c347e1954cde803407ea07293fd71bd275efc920f13ff332a2778909c1cb28a1c27ea86b42eb0c2f7e303fb92f3c2cc8f6b70b59531

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8b7ed2fb6d2be5696dc70d9cd7630813
SHA1 8b5224f5420cc08aee8341bb7c2ed4a9cea67f29
SHA256 134992d107219cb206e11909c0834f055e4f3f150d7bfffbd82b8cc2a1eb9db0
SHA512 ce4f982f510e5f4bcb703d5a9629cd29bf05d7a176bdf1c8c7e737e41de8358985178ff4b16754459e1937a3436dffdc7cd6c2a17c41cc66f094028d05c450a4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c4ccaf09b2797efe8dc1fe4a95bbd00b
SHA1 85a88ca24f9c3a6d5a248c29ba0fe23cd65a418b
SHA256 d1df39931f9b2a874b98820336fdec5ec07702633050df4fbfe0f71d4d0f41e4
SHA512 27c929bec8f3d9faa9e8b6ced187ad4a076f99096eb3eaf179ff345801bceb983472ecf5c59828c8925808fecd07d39acb552bdac404d3a369345c8ce9381941

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c9f6b52c012472b5355ca5bac8b7f23c
SHA1 d2e3e0eaac98a14246d9adb0eeb3f0ff20af8fd5
SHA256 52000f3a8767be46d18dd856300054a525aa54b10e79cb00d5c5bcfa3856c7a0
SHA512 6f0583164c4c3f312692b0b20ce1895040ada82d80513f3077f0e8ab2eb82fada2564e54874da42ca32c795bf2fc1ff91bd5920e835d837d81673d4f6802d751

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3f1beb912d90868101ef5604c75d300
SHA1 40ebf92eeaa1bc0e406b859164273ba694f382ab
SHA256 8e4918e0f95a67474434372efd6d5f6062dcde133e0eba1a2e2e92535387935d
SHA512 a429dda03b40436295ce033b5c2fe68fb28c4cbc41842910db3df23c36fc8f3128623032546f1465607d23edc202e70afdebfa731fd028253022198fd7e3e8d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7cb36a658c19a04be3faa477e0ba77d9
SHA1 e57a6b629a1ad1edf2ae5e03398a915913ec66fd
SHA256 a27a3ee384d1a593527308b5dd52895fa98aebcff76de8054ab4904a24a28daf
SHA512 7f14eb66cdc771b6f62e92ffc0cd679e3c9ee862347962de5d2ea4cf80147694f4c984d41e964b8427728301cdfba4ebf5553476b3efeaa8750f91b5c2430581

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 aed6f37dc790eda9832298ee67dbb998
SHA1 7ecd765cd390583f7fe3412fe979aba7c214d2f7
SHA256 761457bc4e258556c9e65fa6c4fa0ed1e6873048482eed8dcde6e5cc20c41585
SHA512 66ced188217cf3c630e20e3cc474719b29c280cd0b72ec321258d0bc39be1ced9379923a8aeaec875c4501fa911c7a12f20d8da0f46642d7a56def6003a9cd33

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28c013f0350c38cb6934d6cc5fc7d1dd
SHA1 72291d453a1ba7acb73fc1ee75e9a0e2dc44295a
SHA256 1285c0a08efd610e32fa8216fb8c920bbbb9261141e60804e67c8d039cf41220
SHA512 bd2aca4f9a386bf6d92c5843ca082959503b06cc492eb5ef5055d2a5f028ed8343ce418eddaf3b6847752d7166cdeca9b964c15045d14f313e503e93202158a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0adf8990058c7f125874dd55b398dec7
SHA1 f8c1cde44a4fad48e63e7cc6c584f83051aba390
SHA256 27fdda1f4285ca8e23b5b544507fc668f789da08914797616c000923307ba4a9
SHA512 2f88ef9c7241b5ced033a675e5f95d9e1ffe1bb5f7ad52c18b79d5f4dde444a9461d4ea975df9163de6eda3158ad92fe490f7dccda4ddd66a5e943d15b084085

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7a33031b65e55ad925835b02cd59bb4c
SHA1 851958e5260835cff8b286b4ee452bc7dc6ab670
SHA256 7e0b65fd3d00df4b121c30b6ba78bd908e98e2afd2046d1b6e6e7f89e79a7e8d
SHA512 08d44312423d371698223a9166cc438d65ca3aa10ac21748731433bc4b7fd8bcfacbf1fc722b236c11c81fac84e43ed2eaaf42dbfa09f8a33f69f4beafeb8dba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 68c29225a38beb060ae88f62a339ac49
SHA1 8adc0779990a62d0abfe67241828139f5b15d74a
SHA256 cf430c31e00af8e1529cd87ab11cf3434b4b0eafeca56074ff4a8b6ca098ec1e
SHA512 0303af25acdeece16e0c81a53c823d1a37949c3a080c51b4dd3fc16fd6084fcaa7d9a64f0eeaed9dbb47d6ca2e28afe9fce1c01c372e892a14859a9bb8d3c05e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 174ad4368b0a2275923d0a64e669bf59
SHA1 a85a0982359a7eb1abeedd16c1f39893ec2f3b77
SHA256 c443e1c0a284e712c64f5c01b789d74663beb11dc50f2a99250044ab9271181e
SHA512 317dadb6b273923220d4fe5bb07f70d28eb836ec773b5ba5f74fd3da2b01c07d2a7451fc2e948cf7e0e83e961f361d3f930b6082b20c7560cd436a7eda073fd4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c106b263af2a5fd49cbc6bd3576fb436
SHA1 c735b76c91f0a98697a43af46683d32c735af626
SHA256 5479682c5beccfb8f4c53eb2160e817cc95393f8eaf86239d5c9aa93c8906f24
SHA512 f7bdb3cac6e31cf6cbdf2aef5e468805e9da7bb99f26a640973345a4f3871f7e06cf2f0506462950d00bfcc4f0682624f945d0ec9cac911f92f9caac7fa19b40

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 081a7ea393792d82ba986011a729e6fa
SHA1 6179767537e7d83a8ade950900441e95234d3771
SHA256 b78a3a059213783d74ca2babc59b8060b907fe8849452000a0665a970085d8c6
SHA512 cb8ae3803297b36e7d1520be12fe50488a897eef5384d5ea03ccf315c316b97d2e738799cb220b84c1eb93e29181beb6882f95d354d31d63513d996ea4dd7649

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c8d67af1fc07ff3951e469ce2c2fa62
SHA1 30de9a09ec05be94a3eec952027b0c8e97e07728
SHA256 2dd2147131d069b3da8d26846d827721430c698beb3dbf69fbef7028b98d368f
SHA512 c01770f2c9da8c442cdffb3a9e8cd700cbd05554a87f2e752cc7145b83360274f50d283c263c36e350139770f971f4bd629bb4da0daa732eee62f51c709bd514

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fa12c74866c8c8c8e18bc5ca9bcfab69
SHA1 5413b9ec287ff7e9d27f531e1e92cf65030b1274
SHA256 8a2c19eeab36aa8e22480ebf8240297d541f79a28032bcf00eff6e2ab48c7348
SHA512 33dc3b92aa4552cab49803c6b342a967b818f681e98e225a07246dc878f10ae08532c2122e95fa0889abf4807e8c5994847c1b59cb9984464680e49e106d3fa4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 26d2809b72b83378d8927bd81ce99d58
SHA1 8eba6fa6612f54ef17a3e423bcf4e5d6b4e76ad3
SHA256 423c4b869f682807c8a187849e973e2f74f324bb9d6bef3f6916b82f83bce68b
SHA512 3af09793a24c9fb68a696baddcb60503a6ac6cfd2ed331847d9de3b7b91b396c79bfe853dbb310c22ad0993684c25bc6c7a6c98b504c9c5449e2fd2a55841b0a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d79eb24acb3e5ef12b73fbc29a3daaa
SHA1 9f5153cf5482cc8103955ae8d712f2272a9dd80b
SHA256 09fb5255ac76983b98124f08b39a47870085b793bcfc328c0909f79556f6f380
SHA512 4956b51855208875a9d8ca28c85ab7c99869806f15669a8a66b3352e5e70cb0659072d75826afe6cbbe08047bba6e531c5080ff7bd52f3a3ab8da9d515608b7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c885e30888bc7600c59e4f90acdfff1
SHA1 b344ab4c9b4d6f7ea4cd97b6ab2e7f268f6a3632
SHA256 d104cd564cb903f5bd9619f0b7d7c9d37624646e8c5eefab78fe4b8cea4bec5a
SHA512 275319073979c415815d7765a91b38444df22c27463c9df25a11030194f965b771ed664b23ca4d073289c1be2af9cce68e4de6393ee0a59153ce810e2645af7e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3728b4934ad331cd0cda5685ccd09320
SHA1 8bf3b0cd9ed2ef9859ef51a5fd9a4e2f8eaea48f
SHA256 d04d63054b0e5d846f223a93f706418531152372436c08c07ae10ceccd25e29c
SHA512 090224f2835d16ac45a3b797fcb286e2d8a29f1e3b7e40e253300ecbd67716b9307a9ff40aa58e21774c5c873c595ae182d29b8448ae970f858d3238e1fddb5b

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-26 04:04

Reported

2024-08-26 04:07

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c23f130feb3893b0e439b8ac780ce76c_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2832 wrote to memory of 1704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 1704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 4372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 3084 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 3084 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2832 wrote to memory of 620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c23f130feb3893b0e439b8ac780ce76c_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafde346f8,0x7ffafde34708,0x7ffafde34718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13468505366676967216,9317751265573916917,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 pazos-blogger.googlecode.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 dl.dropbox.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 www.blogger.com udp
FR 142.250.179.105:443 www.blogger.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.178.138:80 ajax.googleapis.com tcp
IE 172.253.116.82:80 pazos-blogger.googlecode.com tcp
FR 142.250.75.234:80 fonts.googleapis.com tcp
GB 162.125.64.15:80 dl.dropbox.com tcp
GB 162.125.64.15:443 dl.dropbox.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
FR 142.250.178.131:80 fonts.gstatic.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
IE 172.253.116.82:80 pazos-blogger.googlecode.com tcp
FR 216.58.214.162:80 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 15.64.125.162.in-addr.arpa udp
US 8.8.8.8:53 105.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 138.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 234.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 82.116.253.172.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.178.138:443 ajax.googleapis.com tcp
FR 142.250.179.105:443 www.blogger.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.178.142:443 apis.google.com udp
US 8.8.8.8:53 ads37459.hotwords.com udp
FR 172.217.20.162:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
FR 142.250.179.105:443 resources.blogblog.com tcp
US 8.8.8.8:53 games.mochiads.com udp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 img2.blogblog.com udp
FR 142.250.179.105:80 img2.blogblog.com tcp
NL 85.17.54.13:80 ads37459.hotwords.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
FR 142.250.179.97:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
FR 142.250.178.129:443 lh6.googleusercontent.com tcp
FR 142.250.178.129:443 lh6.googleusercontent.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 103.224.182.246:80 games.mochiads.com tcp
US 103.224.182.246:80 games.mochiads.com tcp
US 8.8.8.8:53 131.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 162.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 97.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 129.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 246.182.224.103.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
FR 216.58.213.66:443 googleads.g.doubleclick.net tcp
FR 216.58.214.162:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 66.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 dementor200.disqus.com udp
US 8.8.8.8:53 www.facebook.com udp
US 199.232.192.134:80 dementor200.disqus.com tcp
GB 157.240.221.35:80 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 199.232.192.134:443 dementor200.disqus.com tcp
US 8.8.8.8:53 a.disquscdn.com udp
US 199.232.198.49:443 a.disquscdn.com tcp
US 8.8.8.8:53 134.192.232.199.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 49.198.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 dementor200.disqus.com udp
US 199.232.192.134:445 dementor200.disqus.com tcp
US 199.232.196.134:445 dementor200.disqus.com tcp
US 199.232.192.134:139 dementor200.disqus.com tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
US 8.8.8.8:53 cientosdejuegos.blogspot.com udp
FR 142.250.75.225:80 cientosdejuegos.blogspot.com tcp
FR 142.250.179.66:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 66.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
FR 142.250.179.97:443 ep2.adtrafficquality.google tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
FR 142.250.178.129:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

\??\pipe\LOCAL\crashpad_2832_SGNCOOURBQNOPKQD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b5eed4e5f8a2f3993cd402860247b72e
SHA1 276665b84ffc0ccf9099549e4cc2ef3f8690b2ee
SHA256 ef4ad2840eb4d95c7b713d2c096516f7e386728bd1b7c540cac419ddb0bfbf45
SHA512 8f4de454abda6cd820da067494c0bd4cb6736550d68d540399dbd9843e29ab482a112909f89a4e01d6f5fabd6072269b45f8521022a11bd0ac9717dad9aff7e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6e61ab9514061f2223532abf3dc1c006
SHA1 4d2710b4bf56353b305c7e0ce775d233c8f66aa6
SHA256 037ef5aea2bb5adb1d35035cdb4807b4721cbee97cd2d838609710e6e8c58edc
SHA512 22c0926fd6acdf0ce0e947d233781c23352cf34dcbeb8e8f8c9a789beabfaa975f47a6c975c4076366d08f72335dc0eebdaa51e52c8bfc878370b2b1d0588edb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ef295e3f9af64490e285f96a2c3d4467
SHA1 350b9d81a955e7902c88b43d056e6b5f357bf423
SHA256 5f7cf9ecdef6bab009a38c82258efc30b75f7a02d57f70e66ef3515b5d271725
SHA512 42bbcea91dc1adb1ca8dfa5101cbb72bc338396ada33d6d62da65b4df3d7a88ae4a059f8498e90b0ccccdc7507c3cd1e9cde906f1c0b14e7f87b01acef29bc37

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d8778124e406dea6da8f08a735ae09ca
SHA1 5ee63d76c434be62c9a4f33bf65dd9e275740677
SHA256 e5bfb323e30474cca32ffb1d333af670416ba866aecf124daac625cb179b93c1
SHA512 8257df0a7a4affa55c2ab09fc3ecca41aa8ed3caff2fb9d99ffe44e2e83dd074326ec0969d7a5363fbecb754336410eb66253faabe0c6c86dc160ab65c99211b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9d1daa5a62d50673701af02c1d6c4f08
SHA1 0d0abdf5aa9a2b3b1e030a377d75dd28087f66a7
SHA256 f3ffc6760bd4cfdc0fde2b4d7418133cf1eece3a3e76d77baab83ad16e7d8438
SHA512 e13f89842d7bade9bfc28673dfebad80b410295486bde52f9df1055d89ab744b214260f86666db318804386676b8a2af91a3d6b2bd53b7563f907e4acd0392b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b04d05be7cec05f2c5a5d0ece1008c79
SHA1 97343854b3cbb3382d197ec2b0bbd62fcc4f582c
SHA256 572b07a1941dff87a66224b3f281f3a08e7989f8337985ad80280bf3ee9e4d49
SHA512 5385998305de53fa9ebefae509b5b9417c6288db23117d7211092164f4703731cf0dd498317d2f2b30354b5bb8e9323a6759f10031ab28e0ae76f2ed2631d9ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ea02.TMP

MD5 c0d46de4cc9a965afa4b94a34a478916
SHA1 f146a8f97337156609af7222b862a6291d776188
SHA256 b34ac3f407d48f594b32548e354b1f498b4af96354eedd10867decb4ca1bb3c2
SHA512 076d23c9e585e97b28e7822eb76d2f4a2cd113e9e6211add9ff8cadbdaa015fe96df4c90c672e54bd8db638105271ca4149bbcc72bbe942929f40f52069ac5b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1ca07169ecf1bc3f44f03d5b10f3fce4
SHA1 86df6ec69fb15dec17b38b5325da19f7450180c9
SHA256 2df97a06f27f9dba77d095e66df896996432a10b3a0cd48ef0c0bed77be9e32b
SHA512 c3f28368eada2960ef97a8967b2821806e5f00dc66835dbf4aef9d11d77415cbdcc76d4b2917b94cb09c6ba20f65e78612ddf3c5a079b5a7669c15bd962ba5bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 554bc28dcea1b435b11ee6710c86dd40
SHA1 d4444293554a328dbf4c1ca64d224306ace7b383
SHA256 de62532e659ab364434e96c07ffe047e5cccfd36530784c7143783aa9f1f9a3f
SHA512 761a0a219752f049c91581eb239120f213793bcfdfe9499b742a0815d4dbb70a864f83bca61d4c93ad3c7c8b695ed98f6881877dc21293046329377d1c2f1949

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 83feee8b9e6792ff95342c5f005697dc
SHA1 4766e1e18b73e4cea93816ce80456a8cc9d839bd
SHA256 99b5230cfa1bd8bac203dc37b1bc01eca5fa993f14532bf1f45916f46149333c
SHA512 47bc982dbe206d585fcccb44593dd9cbe51cb43efaa3f57267caccfdb631fecef5affa72b2f40983232a0058ab6a944c4c19b3da14007f6cc5f3d2d00b8bcd2f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 958f0e5eaea67e0b3c9a898d365f5759
SHA1 4c2694b51adfabf9f124db8673a8f88727933848
SHA256 8e8c525b6723a4e37acdbcde689b72931249c61c5f37694dd177fa1d5f5a62da
SHA512 44e01a6505597dccbe9415dece07993b418d0f607e81fcfbd1c8f800b2df05012d2af8c7bb996bda9babbd4ab57a4f4d82f5a9b4bf6f1d7eb2f9cc412eb71918