Malware Analysis Report

2024-12-06 03:26

Sample ID 241023-kc94sszena
Target 6debabe7f1e858940daf04883a56a150_JaffaCakes118
SHA256 d24c1e550291dcb5f6b510d161eb7bfabfbf1bfbc12fb6a736ee8ef69cd1758c
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d24c1e550291dcb5f6b510d161eb7bfabfbf1bfbc12fb6a736ee8ef69cd1758c

Threat Level: Known bad

The file 6debabe7f1e858940daf04883a56a150_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

System Location Discovery: System Language Discovery

Browser Information Discovery

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-23 08:28

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-23 08:28

Reported

2024-10-23 08:31

Platform

win7-20240903-en

Max time kernel

144s

Max time network

145s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6debabe7f1e858940daf04883a56a150_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000003b2df46ed5504e8703cfcd4926de61d2e3809d40d1ed04eac4424e34e3cad477000000000e8000000002000020000000da431eb7a469aea362142953562c8a43e44f24c5a8d4a75f7c4df91e08eec147900000009d8c736e96884347619f0dfb38dbea8866e17e4eb9b9e59d79ccc6c97363cce09be81d7acd8bd020dceb61a651d73a6ec3bfa29eeac2cb4f7fbaa148821ace2c761e96cdfafd9316937cb4afd06a6c05d1df3c7a34511bb81219f515bc7ccdd48ae075ed1f03fbdc10be491323c2bd7709c80670bbe50f21c94160f5d93ab008e069cedce5f10549fba7583a4293a44b400000006aed31aee9b3c74e7f59728fdd889502c3bce62a572a3930dea450cd3ef79a105a36ae9c4d7ffb1440558e34af2ace0b937fb14447997f03252b68bbc787dd40 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\Total = "18" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\Total = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\Total = "43" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "24" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\ = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "43" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "66" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\ = "18" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\ = "24" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\ = "16" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\ = "43" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d097baba2525db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\Total = "16" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\Total = "66" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB970F21-9118-11EF-8B05-6E295C7D81A3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\Total = "24" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\disqus.com\ = "66" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435833983" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000029ad5450ff44a068baa4f348be9120c6a2aa75e757ad86cdf02a4a300c2f6615000000000e80000000020000200000005556d736aaf18135fbdeb12b6050dfdab30dd4019e71e1a560e511acb09ecb0320000000ad0fedcd5e9d87fdd726f99c34743cc924e3bd640d28faedfcea5aad82028ea540000000b6402c1c8fb1038ff46c509ed7d1bbecb609e5c98c93a99f886fdf0f2f84def7eee46238f97151035c2461646231a3600b931897318a4f5daf2f317a7d6dfb81 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6debabe7f1e858940daf04883a56a150_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 disqus.com udp
US 8.8.8.8:53 www.google.com.pk udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 twitterbuttons.sociableblog.com udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 i402.photobucket.com udp
US 8.8.8.8:53 blogergadgets.googlecode.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 resources.infolinks.com udp
US 8.8.8.8:53 static.ak.connect.facebook.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ws.amazon.com udp
US 8.8.8.8:53 www.assoc-amazon.com udp
GB 142.250.178.14:80 www.google-analytics.com tcp
US 151.101.192.134:80 disqus.com tcp
GB 142.250.187.195:80 www.google.com.pk tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 216.58.204.74:80 ajax.googleapis.com tcp
GB 142.250.187.195:80 www.google.com.pk tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 151.101.192.134:80 disqus.com tcp
US 172.66.42.247:80 resources.infolinks.com tcp
US 172.66.42.247:80 resources.infolinks.com tcp
GB 172.217.169.73:80 www.blogger.com tcp
GB 142.250.179.238:443 apis.google.com tcp
GB 142.250.179.238:443 apis.google.com tcp
GB 216.58.204.74:80 ajax.googleapis.com tcp
GB 142.250.178.14:80 www.google-analytics.com tcp
US 151.101.66.137:80 code.jquery.com tcp
US 151.101.66.137:80 code.jquery.com tcp
GB 172.217.169.73:80 www.blogger.com tcp
BE 108.177.15.82:80 blogergadgets.googlecode.com tcp
BE 108.177.15.82:80 blogergadgets.googlecode.com tcp
GB 13.224.81.9:80 i402.photobucket.com tcp
GB 13.224.81.9:80 i402.photobucket.com tcp
GB 172.217.169.73:80 www.blogger.com tcp
GB 172.217.169.73:80 www.blogger.com tcp
US 52.94.229.212:80 www.assoc-amazon.com tcp
US 52.94.229.212:80 www.assoc-amazon.com tcp
US 8.8.8.8:53 mrcracker.disqus.com udp
US 108.179.243.36:80 twitterbuttons.sociableblog.com tcp
US 108.179.243.36:80 twitterbuttons.sociableblog.com tcp
US 199.232.192.134:443 mrcracker.disqus.com tcp
US 199.232.192.134:443 mrcracker.disqus.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.179.238:443 apis.google.com tcp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:80 www.facebook.com tcp
NL 157.240.247.35:80 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 ws.amazon.com udp
GB 142.250.178.3:80 o.pki.goog tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.36:443 www.google.com tcp
GB 142.250.200.36:443 www.google.com tcp
US 151.101.192.134:443 disqus.com tcp
US 151.101.192.134:443 disqus.com tcp
US 8.8.8.8:53 c.disquscdn.com udp
US 3.165.148.60:443 c.disquscdn.com tcp
US 3.165.148.60:443 c.disquscdn.com tcp
US 3.165.148.60:443 c.disquscdn.com tcp
US 3.165.148.60:443 c.disquscdn.com tcp
US 3.165.148.60:443 c.disquscdn.com tcp
US 3.165.148.60:443 c.disquscdn.com tcp
US 8.8.8.8:53 referrer.disqus.com udp
US 199.232.192.134:443 referrer.disqus.com tcp
US 199.232.192.134:443 referrer.disqus.com tcp
US 52.94.229.212:80 www.assoc-amazon.com tcp
US 52.94.229.212:80 www.assoc-amazon.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\ga[1].js

MD5 e9372f0ebbcf71f851e3d321ef2a8e5a
SHA1 2c7d19d1af7d97085c977d1b69dcb8b84483d87c
SHA256 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
SHA512 c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

C:\Users\Admin\AppData\Local\Temp\Cab958D.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar963C.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 755b4eb5f997a4f417b8f4e2eaf4f37c
SHA1 c13e8a7060fe4d2879b5995bb69346ac9227d405
SHA256 1e88e83014e937a5c00300f76bde6ad0910b1a05a9ffe4f6e0a7d36c769bd0b4
SHA512 9976f9550dffa6371b0f49657a81a881db05b551c2de30a8b36acdf53b577dadb2f37f5e2356b297afd57b9d8e87f465c7d2795e39dd05032b45668c7e3a09c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ef297475eecea43196fb129037c6c0d7
SHA1 fa2baee1c36050f9b0636d7943b53542b2a2333f
SHA256 7bad7a5fb8da7d83ba94ce735430e68806b1c08e9fae4f18fbf88b496ba87d6a
SHA512 717f036e0a05fa0be99502ee85f683aae528f5a6a186a06885ef6118c2cb7aa57bee7a2bb73107c1391bd08f6b1825c823a99b46e5678a5bd5563641a7215c75

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4354ec9460688b59ad6c65ed3b243c84
SHA1 5f614c7412f44f71a1e4f1bae8cd33fab2b014ca
SHA256 25c8973c9f1333d79f9de37cb7fd7992ed53b64873630c58062fd090995a89aa
SHA512 5fd64a25a4b926f5c4dff859863fc8faf6c46b82837a71f6650735f663dbe8628fdd0b6ee160651be548cdeb6914896872e711d2fe4792efb1c77a5eaf522c16

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fba10ce39a9ae76680b43273e218876a
SHA1 588d9bd26a2c3534052633b05c9ca6013e90060b
SHA256 476ca0a9a9a21f90ed93adf9406f9256afeaf86e25868503d5febc36c6f827ef
SHA512 da933f8b19b5ff858b792f94e28af689687afd33a41a44705157ba1db8bb2624db04eff6072cb6b0549728c3f7080645cc2d06278404ae1a96b7f982cb40b8c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cc3b0d13931bbc7c4b1acc5a776ce7d
SHA1 f373de4ed1bfc26bbd63faf675eb64d2ee8454ce
SHA256 66585ff1534da8d85940b161cef04ffcf6e91b27701ae46dd10240f55d07029c
SHA512 d120da9ec34fe0f145fc25bd3f8b5f425a245e89dfb49633c9f4958db6cf4c75144befce070fdce80bbe90786d8c2f52aa16b7db2a403880993c65af7c4191f0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 928e58a2b199d1872a49530bcb197c39
SHA1 3ef0e337b16e4a0a64c025d0ef8bf693e98d8735
SHA256 db746b5483f8a0ff7ef542dd3c15ff214a95a0d75e430319c5586f1c6f2976fd
SHA512 85b4b249589a0907e7d92f07c7a033e92ad0b526e3de316b26e3fe0befe442251cbbc2df62c9e4fa6073161bc9ebc18a1d67cf835c7ac8d974b07412b64e5d7e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2326bbab2037d77801f5c0895e8a5775
SHA1 49ac9dd2b8f6d443fe1f1db9763cdf25424fab3b
SHA256 495b4dfeb2d5a3f10db099c646438e3671f1dd42a765ee5c1a226166beeb23ca
SHA512 945b9ea2c017da64bbbeb94244eb8f1c01b20c08215ab6e0b6469c3a0f6de9c1cf5c81c759a324c4d88db5034ca1d1114c2915ee1cd9381854027341e91c8e75

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c016839363d17a488ac0c7a6c1f848e
SHA1 677c7c20ad8a76498c9301a1d4dd3ea27e447294
SHA256 6878382d997bd6134cff81dbe5a44998f935b437bc9732a2df9a23729fc1d495
SHA512 fe859a0e93cf9aed0f04f37aa8677c8deece0be7f9718a0681af7823256835ee45dbe9b65951baf571a6b4c466cbe5f6b30eb4ec078ca0556102de5fac4c0176

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9517dec3067775750a1bc98a2b59ae7a
SHA1 f440a1a0a38208430240a17e1bc40800205f5bc5
SHA256 1e9392cf8faee06e4fa537f24d4396e1e6e017d74bf3e418395af54ed28bbd0c
SHA512 c4fef8932bfa3433ab058a1e561f0b117b7279e8159859363e362b8d722df1792dff396d81b1de9fdaba861338e13b7c593c28cf860834c3963855d907dda9bd

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\KMLP0SBK\disqus[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\common.bundle.14814e267412506a81edfbae9e14cec1[1].js

MD5 acfaeca06300e9f41a1e2192b834e996
SHA1 3f185e058526a20de98cb110d6b11f4231d21931
SHA256 37acc7203131d31316e86eaa7b061c3cbc4378b78b9b755bc94a5d7fcc2f2f72
SHA512 9d82a14c3bec3c376f456fc5170b54ded23a0c2d85545fd87d73e46f573da6213b7587fa0250f02e0dbaef3f7e004f4e3a7fdff04e6cf3e0e8b5e51ee4604a81

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\config[1].js

MD5 d1368c3fd1cff077a9596e7b3a091ba5
SHA1 cc8117382dbd1476eae6c9887b50a373770d06f4
SHA256 f638cb91c4496edd772935841ff424c363624396cc8e006a21a26eab4e2d4463
SHA512 65dbbbd2dedf5f6bc4b7a3889677913ab718f70517873fd7aab8a72dbb25f11ee3b4dc9b5b3f79e512b3ed74b5e4563acadbda38b551a6fe2567f1d79e688ff5

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\KMLP0SBK\disqus[1].xml

MD5 2dc1311a921c7114d0aa0dbcfb85afc7
SHA1 6a662206fea7694b8d7ba89eab5b5fe0c5c42d22
SHA256 abf63b07b253b13de2a69346550fe21ae4f33d637f59a70ea294956d557d98f4
SHA512 c48e6b6130af324c976adb322c8fe777f6604f982f39ff4cd2cb40fde25560aefe2aba5ef14924ef86ede8ff0087a740dd46f3a64bbd575c5f8cf991857bd452

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\KMLP0SBK\disqus[1].xml

MD5 f01fa8f27dba6539601eb39d13ca5710
SHA1 1d000b4067cac2350f951880254678cae6c69e7f
SHA256 436a6bee409ba3d3994e2c7dfb022e0fea68bdc13af323157e2d3a74b20aaa32
SHA512 852c4d3290ebad2c21bd109a193727d4fbad703b432b1ac2270407667d8b844fdb653f3e6bbeabe571530616e49e63634e619f530a1ff95be2337ae26746a8d4

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\KMLP0SBK\disqus[1].xml

MD5 a83cb5c9fb90a678e5aa79b6da421f06
SHA1 7100a69ef7cce5cea2f56c839455b0e816b41757
SHA256 25a85e28317b1152b02fd5044644991911cb04d5d8619ef1d34e00ab34857b90
SHA512 eccc6d963d88b5d57964f1199074838d95f354608cd1337d799c8f65fab5b4eedb7ef9a35b6c5e0ab1298060a6b31e32266dbe93cefacc0597c9e2179a68fd26

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 fbef3ada18f68abcde5f1cf5b5d960e1
SHA1 5199a88cf29efc492eefe7218c381faf68de76d7
SHA256 65d47ddbc732ec4f66e6066c92f4de2fc47e1458e1ca6dad3690c647929ad845
SHA512 edf5f3f8b6e22cff499dc62a2afefd54588597e0442da3912c2fe5968ae2d9919ee2566669cf9beb6aebfc36fd6c71ddcdeaf5315b8dda980240ee35b41e3696

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b9dcb675130d8c7502806e053a517c84
SHA1 fee33ee67408109f8bfabed2a8b3b167248c228e
SHA256 7bdaf1a893d418cf891b470ba339b0379673ce665f3ec5f33fc9f556dc9e90d7
SHA512 03d5a523bfb3fa2c735f2821c672c6160732c8f9b148581c15cbb2c43b1f39b4df8b0dd363ecb41058bd2e0b55d290820cea830b4e5a272478a8fd522d265055

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aa0894081a41eacd2a22386ab1bfd356
SHA1 30f811bb002b1da194f0fb912958c980f5543eac
SHA256 bb902842c61671d7225303369919a5cbfefb8746e85b7b46b44ef0877c43e9c2
SHA512 8a32c1d65fd0801f02aa1aef0b9e0085f4b874cb5b61b08b14800c07a9617960310d3eafb8bf8ae3ae2dfdc3881d34b51b3686cbdf944289a57ea73b7e1d5d3d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 924cdf3f301616708417409854650a1f
SHA1 839eb1476208312a325a8d3286a1f1a5a359d50d
SHA256 a9473d25ab118e8f08e77cc3990cfe006f3e092e59a3ca548b7d0a712485f26a
SHA512 fe674dba35a6c30eac465d90814c1ed7bb9c4b025abf1f688725f2a12c09b3cf6fd34105c660f818d18c79348fedfd95bcfd5368b0ac054fa2054e0ac89e034c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec617ea3f0bb4f60df44e9b1693f4f56
SHA1 f954c551056c483099c3a2ebf31643946bc869ad
SHA256 0f0b01283227589613dead0f48c894c63a78bc19592fa98552d7e8dea8cda759
SHA512 860c86499ab08f89e0076e97a73b97d9db91c0b4b489325b7016b8ab59bc7cf057acc7666252a6cce512e578f303b4ddcf6a26fa21ca3a6c651ff84b72efec1e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2be8b848b086e1b516eb3afbdf83b2fb
SHA1 3d65f010ba154d4ebe473ea7a32cf29dac09b585
SHA256 45b55734814b4fd1672269ca24ae4c5b74b850d59373b2ce32dff233007c9b81
SHA512 3e89525ec49a256870dd6959c3dbf9bc824cd3ceda3c20423b95f1f2ff78965ba65abaddbc9cafb51f83179ef2a4a5c0e2fc105087f9d9dfde2b51a70034271e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 f04d75b942b9de8be8c5738969743191
SHA1 e2d15b3000e95d027c66dc56835ea26b5b8560e2
SHA256 746b268c04a9be6df5d587ef5781df3997400027da0753a611e6e14224e5d013
SHA512 4b13f6c90e70560db3f8612df54969213a55707f75467744f49110663e1618f433e587b566588b82400bb45e9796309dc0c9dfa42505c62ee22a2ac576a16d1f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b1443149858a0960d4a04494588bb011
SHA1 14bd54d6f229555ba506918c68160f754a0836b2
SHA256 e6675ae02f4c17033225184405e9a876fc02e6a560fd54fe4032880662e290f8
SHA512 69a69d8e78e44402a9a460157d92c9431b0de953f7e1fd32ead0a06e1f5191002619739bffc72e38aab0c8cf349ced19501ee001934d26992299ac7a96c4d9fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 48b4be10df359ce386d45b845fe2b24c
SHA1 97817244112a3636502a930e0d49d4a5416955cd
SHA256 19be174d924027e66312380ba6ca1af525515d91f7f77ef4d72fbdd654079199
SHA512 9d255e5050fff727b2e8e7e37d38ef16f3449d5d8d7ff3c2a4cb3141f29a87730340f8a313e608cbbecc2900982a190ecfb55e37f6e92f041df0cafa412283e7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 af29f59a394fdabd86c66798d861edd5
SHA1 b12f7c73dd889aae45b58716a09a024dda4404e1
SHA256 c1f14d381e8ad501c98ec67dff50cee6c461a77d83807225bee326b423f887fb
SHA512 eff82dfe88a8c7d28ff91d052bcc268bd202e23bce1ad60988b6d16fdb6c56765934650761cfb1725967ff90c3b45da5844b800a02ab5a211160ff587e114064

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 93710e24c22290fa809277edaf818b9e
SHA1 1acf4d9e9bae4ad30d147e276b5c927a4b95e641
SHA256 773a8933052e136e2dfdbda62d9c2709bc3d55c12f2514d5b4701ba4ca51f968
SHA512 69499ce834831bd98ed146737cc4fcf899126042af2d0009dfb19819fe7fcafff3d9bc220865e06d4f03f22b8218e3fdfb746fbbf3e2e89093a36db919b265ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2bc65a6b34fc5a1a67b46e7bd6f559cc
SHA1 bc0fd98c4b53076c3548e84ec59090401ffbc858
SHA256 ce5ff1aa43f4dbf17ae8e1f9e3500fcf4b37ffaa60bb6a888f2bc3b6c67e06a6
SHA512 4643f14c5d138047fbc1fceef25874cfa0ba18cc38ae1d9551febd07942b44d06b7297bb56f0ab2aeb03409a5997eef0dfb35cf4eb56b564c2be38a9544b3ff9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ddfa688ba197b020a2377f1d8659995d
SHA1 ad6f8989bed81472c41ef7d79c826c209e27b32c
SHA256 361340df89a838713ac5c05125c9eeb7e05364778d980182c125400db44f9b71
SHA512 75cd843ea928d4e6191998afd427cac404f61b2a1d9088aa6e533d0244ea047771e8ced9817b499fb641a0d82160ab999b7834d17bb1183af40867174fa93a0b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75c91e6722137a93eb3d5f085796788c
SHA1 8e4cebd88c44ec145d10a6feb354eedd7bd4e83f
SHA256 11f5b0bfb9c868dad02542c640672c4e7eb8b64c3a932948304ca8597bf102f4
SHA512 a634035d05555a4a5719147dbcbf20f0986d5872b6b6fde67f6b8e8e9fda84c8be3721ce9193826188b990653d25de341e22bcfaedf9eccf74bc7b94d2023e07

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6c0332e7b48f288a03cc99b42e68ef90
SHA1 ddc7a39a31400b8f9ea3a4db676dd5331f9528a8
SHA256 3187c688ff94f67a103a88f089bda60deb71c122bac03d584192b847140e98e2
SHA512 ab87a031919f2de67351544af4f1b2c971cb0b92f7a39c92ad161e542c8146bca7eac0ab96e6ebecfd846d377e328443e4c560d1e67ffa8d64115e904248068a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 90a94ed01fde621d805a81d98f25e8ac
SHA1 bcb8cdeb6f3d82159564911a15d316804304f7e6
SHA256 366a17924b862c89e7cd64f0b0ba90e4dc4f07823f1cb77857a035593ed84d6b
SHA512 3087320eb53f324d9a27d369211991c867498494443712af2224f9e3781065d29ae217782d691f9933f3c5235bbd37c6026be6e3669698e1730810ac27a331c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59b4fd86db56d39db6affb5f26c841d7
SHA1 cda73bc52a24de7d0a3c60fd90db9e5c54885c9a
SHA256 176b97426e97a3a7708fe44c9363114a42c4720162b67a11270f7663e0c2d46d
SHA512 8477dec9da1f63cbe423bb4715764c0825392af0b93282118663fde89cec08950f8dcdef9572b16936cca986b6abf2081a73239d1acc22c4352a1439e5192547

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 02e7681e90f7da1238778b0cdfa42dd3
SHA1 b667a67a1dc5f5b5d440f231cbf3627837071ba8
SHA256 acdd97fc5337041d19b476dea2430041a7e5c95c26476895cc87126e18aa3465
SHA512 a02ad8db1c652a74dede1206b2cdbdeef76f31baee3a825c4afc8a423f416f0165733ff18562c3bac1ce0f792c0678d6d6169cfe0270fdf7e0562d86c767df6b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9fc04d8bff951149b0a35c45d86326bd
SHA1 9424cec612287762fd2da3aae183577e7216058b
SHA256 ddeacf5918bb42b516c95ee7e5089e4c1ccf3663e4c2b2938aa80412a0d63d3e
SHA512 6d5cdab8aa59a9c0f249c0d3d0b4f798e529ad6e1398ec22af47809545f876561251446e678abd444f11244dc60eb984b06eacb02cd5e167d997be7338dfd1ff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e3ef65c1021fc67be509994191adbd0f
SHA1 217b1317b5238c812e5fd169bc403cb8c49d9eac
SHA256 b783127e189e8836dbd1073aa293b41b69755e5468b248b261e0f49986f7909f
SHA512 b915558241541f4bd09e67aeb0a9bb8e9c0ad77f055075950d90cdb09f79ce1db1efb73e834074da03030aef8e5e4e3ebc21cf72fd6e1096f7494842641644ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15a4a4e6e15e8f09c2174b36bec5d5da
SHA1 73d54d3ee3066d00ea89f268d762fcee6fc2b38a
SHA256 533e56b3fc93992714445517eebf6782f5d44420d0b443769a5bc7bad2647400
SHA512 89ac8b0065be62767bfb00f95af981899838d15212e7da0409336cd0451c3505d030bb73f58ba21b10bda776e2ee021d677d30c1245f54c8bbb9a8e2845681ec

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-23 08:28

Reported

2024-10-23 08:31

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

139s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6debabe7f1e858940daf04883a56a150_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1048 wrote to memory of 4640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 5032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 2264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 2264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1048 wrote to memory of 4048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6debabe7f1e858940daf04883a56a150_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc02b446f8,0x7ffc02b44708,0x7ffc02b44718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,12483938193802401493,17102554687594327082,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4612 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 172.217.169.73:445 www.blogger.com tcp
GB 172.217.16.234:80 ajax.googleapis.com tcp
GB 142.250.179.238:443 apis.google.com tcp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 static.ak.connect.facebook.com udp
US 151.101.130.137:80 code.jquery.com tcp
US 8.8.8.8:53 ws.amazon.com udp
US 8.8.8.8:53 blogergadgets.googlecode.com udp
US 8.8.8.8:53 disqus.com udp
US 151.101.128.134:80 disqus.com tcp
BE 108.177.15.82:80 blogergadgets.googlecode.com tcp
US 8.8.8.8:53 mrcracker.disqus.com udp
US 199.232.196.134:443 mrcracker.disqus.com tcp
US 8.8.8.8:53 16.43.107.13.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 137.130.101.151.in-addr.arpa udp
US 8.8.8.8:53 134.128.101.151.in-addr.arpa udp
US 8.8.8.8:53 82.15.177.108.in-addr.arpa udp
US 8.8.8.8:53 www.linkwithin.com udp
US 151.101.128.134:443 disqus.com tcp
US 8.8.8.8:53 c.disquscdn.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 3.165.148.60:443 c.disquscdn.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 www.google.com.pk udp
GB 142.250.187.195:80 www.google.com.pk tcp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 resources.infolinks.com udp
US 8.8.8.8:53 134.196.232.199.in-addr.arpa udp
US 8.8.8.8:53 60.148.165.3.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 113.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 172.66.41.9:80 resources.infolinks.com tcp
US 8.8.8.8:53 www.assoc-amazon.com udp
US 8.8.8.8:53 img1.blogblog.com udp
US 52.46.128.194:80 www.assoc-amazon.com tcp
GB 172.217.169.73:80 img1.blogblog.com tcp
US 8.8.8.8:53 i402.photobucket.com udp
US 8.8.8.8:53 g.bing.com udp
GB 13.224.81.9:80 i402.photobucket.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 52.46.128.194:80 www.assoc-amazon.com tcp
US 8.8.8.8:53 www.blogger.com udp
GB 172.217.169.73:80 www.blogger.com tcp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 9.41.66.172.in-addr.arpa udp
US 8.8.8.8:53 73.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 9.81.224.13.in-addr.arpa udp
US 8.8.8.8:53 twitterbuttons.sociableblog.com udp
US 108.179.243.36:80 twitterbuttons.sociableblog.com tcp
US 108.179.243.36:80 twitterbuttons.sociableblog.com tcp
US 8.8.8.8:53 36.243.179.108.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 translate.google.com udp
GB 142.250.179.238:443 apis.google.com udp
GB 172.217.169.78:445 translate.google.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 142.250.178.14:80 www.google-analytics.com tcp
BE 108.177.15.82:80 blogergadgets.googlecode.com tcp
GB 157.240.214.35:80 www.facebook.com tcp
GB 157.240.214.35:443 www.facebook.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 151.101.128.134:443 disqus.com tcp
US 3.165.148.60:443 c.disquscdn.com tcp
US 8.8.8.8:53 35.214.240.157.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 translate.google.com udp
GB 172.217.169.78:139 translate.google.com tcp
US 8.8.8.8:53 referrer.disqus.com udp
US 199.232.196.134:443 referrer.disqus.com tcp
US 199.232.196.134:443 referrer.disqus.com tcp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 static.ak.connect.facebook.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.2:445 pagead2.googlesyndication.com tcp
GB 142.250.200.36:443 www.google.com tcp
US 8.8.8.8:53 router.infolinks.com udp
US 172.66.42.247:443 router.infolinks.com tcp
US 8.8.8.8:53 36.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 247.42.66.172.in-addr.arpa udp
GB 142.250.180.2:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 d8rk54i4mohrb.cloudfront.net udp
US 8.8.8.8:53 wellcometoshareknowledge.blogspot.it udp
GB 216.58.212.193:80 wellcometoshareknowledge.blogspot.it tcp
US 8.8.8.8:53 wellcometoshareknowledge.blogspot.com udp
GB 216.58.212.193:80 wellcometoshareknowledge.blogspot.com tcp
US 8.8.8.8:53 193.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

\??\pipe\LOCAL\crashpad_1048_OIRBICXDNMJXCMGS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ca3cc24cb28cd295f0da0e2534a1d355
SHA1 9716be7251c5b4aed4cc010a55964bfd4451bc9a
SHA256 113d47e66c32a4ab039b1db197e447a67bd58a26cb523f9566fefc5861b253a7
SHA512 2da5d09b8e7a2fd5f357362b3ff0ae8ed842acd7ea2cd51b439a2c920138530083d03d7b05cfd8fb73dd52395bfd165356c8fb9004ecc316185184904f74bf71

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 dd47515dd0916f76c46e1b5dc4201579
SHA1 1e7f30a28a98fdca6243a9d0c281fe1d9c44b930
SHA256 99a7009dd29c2845929ea6e1cdc8230d5c9437cda140d9361af5c9e5fcf9c549
SHA512 4653334e81dae5505d7965ca8bd040bbcbb36a7a0696d867a301ef9ac2b683ed5c8d229c3fd53969c9c180f7952ada04f62bded887f02be032b8e2615b8ac650

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6e395a4ab0a067d116c36df67353e823
SHA1 46f8c16c5a1e9844a72d7339d6b8fe8ce466112a
SHA256 93ff13b86d31503d9c2f3950a32a7b8cc512c86e5af678e7bd9b9eb1bc677d3f
SHA512 1ffc04876cd07342605b24ed53b7c8baf26e84d67645864ac431a73b03e4d6279d4fa1672612f145ed7e54ebbda3f0a339f84f5421d9c047439d4c89cc5f6a5c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5809af.TMP

MD5 f71e399985151ddd2af9ddea85cd9102
SHA1 97270cb6e257409e1de56d015b64b085613774c9
SHA256 4db3280ba88f2b7bda1d8bb901fbfca3e94395d8fe925920876a6ea3478281b2
SHA512 c406ce1af00d1654f21338b3bea127f413771ef5a6a6071923e50a50316794058224a4cdfff8e88ff13e68f2b074e4a9228cd405cd9aceaabefb6aee66f2093a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 952ab252e839cc22a79e79987e510e4a
SHA1 719ce44f47c42bc78ed96ab6be99f4e0cb03853a
SHA256 fe540bc6df44dfd07ebb2107d1bccc2f4ae6651a1ef5ac23262a272333c891ce
SHA512 617a931e0612243533e8753ad042a3d49667b6c00da50683f2aab31c6850795d136ceed94840078d38103c043e70111fd72b41957e19e136650c90929d1318ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 979f949e3d8d41d715552412df716627
SHA1 30562aacc0ef2f790b764e18dd7f47b16d24a3a7
SHA256 246c9d1c896f1400581f6d5ed871e2b941fb0c07edb93342bf2347c6d63057a8
SHA512 383a6d1a474a4ddaf7e959e75847a1e66fecf629653066fbde29dc31c28baf62e6543cac6074f81815652b349d16302fb11dc4432e5f0548c3435777d5547a0e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e3c976a1f1054b07c0cff4db978c6e2e
SHA1 7f214100095e04f4a5009b650ea6073c1545ac65
SHA256 c153694b905f2b75305eec60928ed58c8d2f62b6e6f4267d95fdc3e574815b97
SHA512 96483d1e964470022ae22984391e7e4bc352b0a89ab35f14ad33d323aacf6f150a0d39394c2a60dd5eb51faff0d5d97338b6d1bc000bca42db2e5b26bbda33f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 744a9652925071ebe2d007ac18ad1dbd
SHA1 ec2688164a1d9af0685be1309583b1ce30c1bca3
SHA256 b501b2e1ee45b66b3c0af42faa7d63477f3253aed2fd505321031dfce073971f
SHA512 d187da4401b759245ff0ff3aa78ca8c39d474d5e987a32fd05b17b3c7b6a03df45a123bc12d09ef62cdb7240d42e8236ac877385c09a03e881a100d715b887eb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 dcd424cf8be5c48c35d2a7ab9c99853f
SHA1 88181fdb592830e23f5f83e4dbaefdff1aeafb5c
SHA256 ac328c657c02f1b97a8775269dd2dc25a70c1ff0eee422dae61f0588e62cceb5
SHA512 c3eae9f5051ed497745823c10054dcdac67b5d6d2a1e7aa615ed68b88569f2574b883c04655a8e0cf9a9a513494644cdbe28b606b40767b1ac40cba8b3d87270