Malware Analysis Report

2024-12-06 03:21

Sample ID 241027-3a6byavdpe
Target 76772736fdeb61e1bf90ef1751d11bc1_JaffaCakes118
SHA256 a38c590c1196a919c30c91fe47283391f96ce94bf39d8e12357850cc23d57bdf
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a38c590c1196a919c30c91fe47283391f96ce94bf39d8e12357850cc23d57bdf

Threat Level: Known bad

The file 76772736fdeb61e1bf90ef1751d11bc1_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

Socgholish family

SocGholish

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 23:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 23:19

Reported

2024-10-27 23:22

Platform

win7-20240903-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76772736fdeb61e1bf90ef1751d11bc1_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0E47F71-94B9-11EF-9C44-E61828AB23DD} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000f7cb683c43141a08ada832caeaf3a7ef291063eed744e354bb3e4b08b8d8baaf000000000e80000000020000200000006e1684970cde3c6f99890d6757bc2e19df51f3b34d4e6acac13bcc2162f8672b200000000d8d0496c99adda950157405ebc380586e56a44e1dda9e45a985ce89beb648b440000000a4a9b0d1644cac47717eb85d18ee30ce6c9a859fdfcef894ec774eff85b41eef56c228a81c2fbe274ef2302c4cdf095e56b72acee63c57ac7a256a1c9cdee566 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000482c766b0780a94d394ac5c98f7a664d125667428aa29589b235b706be5b8a3a000000000e8000000002000020000000819c38dc9c2c0177a58551057fec714524124e58f3e909fa3c67d57024ed6b6d900000007593ecaeceea02bd37081a1f96ec43125e17f42a31ad6c42e49fa19dcf3fb9d3330fcc3136be61e26788058b0a68a79a743bdcd0ba5e7d62e20f2cffc9bbeb3ca95a8dfd27a27de2b047f68918d5dda8a2481f96d801551462dc0a81a5eb2f6f8dcbab8cbea4786543082aba1291f3edb92bce89e3b80bd9a58c4037af6ca0f494bd76990dcfbabb07beb339545e33f1400000006b0ebfe03015978cf8eac3380bfb7017243d96f908cd1023d16165714a76fba672b9de4f03b8e73832a1dd83fbeefd3795b3b8a78d229199cdc2013cdea74315 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cc18cac628db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436233048" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76772736fdeb61e1bf90ef1751d11bc1_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 farm5.static.flickr.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 i844.photobucket.com udp
US 8.8.8.8:53 pr.prchecker.info udp
US 8.8.8.8:53 synad2.nuffnang.com.my udp
US 8.8.8.8:53 referer.org udp
US 8.8.8.8:53 s10.histats.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 kunoichi.info udp
US 8.8.8.8:53 pipes.yahoo.com udp
US 8.8.8.8:53 www.kuizikel.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 www.google.com udp
US 104.244.42.129:80 twitter.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 67.227.215.171:80 pr.prchecker.info tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 172.217.169.36:80 www.google.com tcp
US 104.244.42.129:80 twitter.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
US 67.227.215.171:80 pr.prchecker.info tcp
GB 172.217.169.36:80 www.google.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
US 172.66.132.114:80 s10.histats.com tcp
US 172.66.132.114:80 s10.histats.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
BE 18.239.208.4:80 i844.photobucket.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
BE 18.239.208.4:80 i844.photobucket.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
GB 142.250.187.194:80 pagead2.googlesyndication.com tcp
GB 142.250.187.194:80 pagead2.googlesyndication.com tcp
NL 190.2.139.23:80 kunoichi.info tcp
NL 190.2.139.23:80 kunoichi.info tcp
DE 64.190.63.222:80 referer.org tcp
DE 64.190.63.222:80 referer.org tcp
BE 18.239.208.4:443 i844.photobucket.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
US 104.244.42.129:443 twitter.com tcp
US 104.244.42.129:443 twitter.com tcp
US 67.227.215.171:443 pr.prchecker.info tcp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
NL 18.239.36.28:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.29:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.29:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.123:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.29:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.123:80 crt.rootg2.amazontrust.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.18.190.73:80 r11.o.lencr.org tcp
US 8.8.8.8:53 blog.kuizikel.com udp
GB 172.217.169.36:443 www.google.com tcp
GB 172.217.169.36:443 www.google.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 172.217.16.234:443 ogads-pa.googleapis.com tcp
GB 142.250.200.46:443 apis.google.com tcp
GB 142.250.200.46:443 apis.google.com tcp
US 104.244.42.129:443 twitter.com tcp
US 104.244.42.129:443 twitter.com tcp
US 8.8.8.8:53 www4.shoutmix.com udp
US 8.8.8.8:53 s4.histats.com udp
US 8.8.8.8:53 statinside.com udp
CA 149.56.240.131:443 s4.histats.com tcp
CA 149.56.240.131:443 s4.histats.com tcp
US 104.21.57.149:443 statinside.com tcp
US 104.21.57.149:443 statinside.com tcp
GB 2.18.190.73:80 r11.o.lencr.org tcp
US 172.66.132.114:443 s10.histats.com tcp
US 8.8.8.8:53 openofficeorg.kuizikel.com udp
US 8.8.8.8:53 belajarpicasa.blogspot.com udp
US 8.8.8.8:53 shop4blog.blogspot.com udp
US 8.8.8.8:53 sh0p4book.blogspot.com udp
US 8.8.8.8:53 shop4quran.blogspot.com udp
GB 172.217.16.225:80 shop4quran.blogspot.com tcp
GB 172.217.16.225:80 shop4quran.blogspot.com tcp
GB 172.217.16.225:80 shop4quran.blogspot.com tcp
GB 172.217.16.225:80 shop4quran.blogspot.com tcp
GB 172.217.16.225:80 shop4quran.blogspot.com tcp
GB 172.217.16.225:80 shop4quran.blogspot.com tcp
GB 172.217.16.225:80 shop4quran.blogspot.com tcp
GB 172.217.16.225:80 shop4quran.blogspot.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.73:80 crl.microsoft.com tcp
CA 149.56.240.131:443 s4.histats.com tcp
CA 149.56.240.131:443 s4.histats.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\5085871345_0f1b431565_b[1].htm

MD5 f5d40b7259645010f9a248858ad14178
SHA1 b3051d17a6ec8c9e166bf09a62b48261ab86957b
SHA256 7f5007068d2b56ea9735e2490d60cff2e72cae312024ac1f6c91158eba47d05d
SHA512 1e82bc2d067f726670b3e6054d73e57868f6e7c50eb979696bf927daeef699f2d8f8de201e8252b86b0e9f86dc69e5037fc9fa08ef6c271b033f29d4f0f4c1aa

C:\Users\Admin\AppData\Local\Temp\CabABDB.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarAC7A.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 60c31f59f98e10f09c0e2faed9d3349d
SHA1 1209d21a4cb113ed946f3b8caafb2f3fa01202cd
SHA256 937b321cdac6b3f69700bc05872f9e965adb29a939bc75041dc2d4261bd9de5d
SHA512 99b849f61f278f659a81f5b97a7b6afadf7fd9988c7bd632df015bd5b8b62c8735b74227a736f655856e86585896ad0b27b768365eab78dfe7287c6669c052ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

MD5 c6150925cfea5941ddc7ff2a0a506692
SHA1 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
SHA256 28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996
SHA512 b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7a548f0ff598af7143a354a5fb36e286
SHA1 036106afecdfe3b96d582e2faa5648d7099b8dd7
SHA256 11eee54fc0cc9ec3a9232f48b9f5bcfc98fbbab2d7907d08ca2e44c72062819b
SHA512 83d7c43e73d8ce367644f5fae5248ebbc2cb6d445cc9dd0063d5c722462b17e8eb73ca88cd4f6ea681ea7da37b3e5cd2feb265be800c4938e1c4f584c5e60601

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ffceba052fb5d0a99052ba99b29977aa
SHA1 a4e026581f47dd57aa43c727359adbf44b8972f2
SHA256 f50a9ad9d87f099a5c8c50037a4a42dd0610bd2d292061022cfff96c52218fc9
SHA512 bb20d445abb52dd97794844cf074ca9b2bdb71ec153869fe08eada2f89edda63daa77d56b7ffb5067cfb635d727c9e5ce967399d39bfe39c02ad223ac6d14c22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7

MD5 88bd666753fdc4d873c46567bf88e60b
SHA1 4a0de1613bfaace7a595d9dbe55e23f7a24cd42d
SHA256 7c6e4abf537830c97f930edc02d2cde8ccc6f9ef12011374c23a7fd42a5e9898
SHA512 5437a1d3feae01031e7bf4ba689e43bdcb199301a7947504b458b21e07ae33796f98c6e8239f67ca78c302a273f78cb2784994c34b38654ec96f9e17051414df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 064a0c3e4fe9da222ad53cff10926405
SHA1 8366d0ab93aab3c5c1204cd3ece9ef7dc08aea1c
SHA256 68362fd1b491291243de66405daee5b6a82b332211695c528d838f7fa84b43b3
SHA512 e3125de5da17cd35ae5b9d401735d90bc46d9304e860aa1c63003766792f19763eaf7345e46b5058e76834014c5de074be6a77acfb1ac7790cbcf959bf2a2861

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4720b346ac079741ef73690d941ee854
SHA1 7b6af78e185f76b622f9751e51bd95ee9425ae22
SHA256 966e0631857cf295a52c63e1965fbcc5d674ca1c946d100ae79226dac4d187bb
SHA512 f95db0884126070112b768bf38feb6ab7bf64fd058319856fa7dafcc7e7eacf62b4af37d0b29d5db2af881a43a0df5e0a5ec83b6110378551d00f08cde187ae9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 950c2f7d0e85b9a4e0fc57f9922ba843
SHA1 3533987d9fb64a6930ff8a39284445640e04cb06
SHA256 4023b30154025c63662fbd8826259af8970134f0ba425e055ffb0a5f692150ba
SHA512 5602a08d4bcc148c95bdcc415cad1f946599a54b5dd9054fabb6386f171c0897fe84e7d2181353ee7e72fb3c1b51e79e2bea4d5a9b46a0d4320a38c799dd7aba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 02be37e9e8213c709e89c8c846aa9b18
SHA1 f1ba4d681fb0b2843983997ee6d04ae2d8140d96
SHA256 5711bb1dfe5a7ccf71c5c164091666aba15a26491eb4c4709346b3221d0c4076
SHA512 44361d340c663aee33460bac7253581a3171858af042a117e683357d4fd5e43c5d406f9ebfb0b630f6f67d332a27d6e9ea008adbd0d6a1a72ae9fd56d788a279

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2a0f6a7aacc44ccbbf8a74f528e355b
SHA1 8b27aeead8edf0722e801830dd199e144321879b
SHA256 7b30bdf58298813211d6236c921ee99c1d53c968bd0fb0229e0aa50104353438
SHA512 9354e5833e80a3e84a17133f9927c2bea597d9ac0babfad518f2c12f65806769fcc76df6a8fe6bf70d303edac95398f7b5e16bd0473ad3e40b4749aff1b0da94

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8d7548f054f72f211c28f4f76d224fb3
SHA1 f6d938cff43a9a6fef8bd9f3eb22677fbde11fa4
SHA256 81b0cc349baafb03a38d48c73b723e90bbe5113d9b7fb1b19693d86a587eaaaf
SHA512 d2c97b95ee8187e261fd03d458e43b414c25e04ec803b157eab4feb4339babffc4ae812448674df56aad7776b17bc9397b03629e6b313c3be6e8294dddb20c6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8b21db95b9a2c26addc14f53174d862e
SHA1 38774ad3f9da804c5ba60ebd6f59f853343a550a
SHA256 6796e783522e6cd4415593dc85ece747237b4a964ab2a870b2ec71f736e62187
SHA512 585232aa9f4db7d8e19224dc9fa7f62eff4464b4df6d8f8e72c866e12e3ecc639338e217483d34a09e8bb9238d11bcfbf777e39f116aab79272c10eb698767dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 247fc1e4f1349e5862d43a9454ee32e8
SHA1 19a2af6a5d4331af9bcc53f2014b649ccaadc65f
SHA256 3e13f5c47ed6dc5ba33ac5960e44e86d5607a7bd1b1ff0c0859c683ece70a91b
SHA512 424953dc1d94542143cc67d9e7484a29c85e9c57ba103e5c74fb4aec97bdd16e7483eec92925a1a598716f05dcc7514e7c6fd494a552bd23ff211098de5021e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 38b9e7c205379534269a286c28342c44
SHA1 3544734dfdd84075e7801f43d196bbdcbf5398ef
SHA256 b8ce070a2eaaa17a7399ec22b02e11dae79fe65d37be77f18ed62a83a3abff8e
SHA512 53fdc43744c7bd0599b32d8e72ed4e784a125781fe14a896c1d04ad4b7753ecb30a525a337d4717db1ca097aa85b41de9e4f35010750229b89a0ccd0e891e534

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1da860744789f6830f89490da8c2f90d
SHA1 0e90388dfc02423bf6c45f9c5eca67861ac820ef
SHA256 b3c181caf68f6db35b80f82d853bd349ebac364cdf28c6389349b0552502eaf0
SHA512 476e47f00224eac2fc699e765804a0b3c796a68ff0f51991981265a308eba45dd5eed8ff8504cf2f285af793cde8c3c236ff1c4a8a57ec7122c85d2e8ead7e85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aae3b6d50d5d9e59be7c3a061d104ac6
SHA1 b43d0c1a6c6ab6b9395812ee38e8531390894e88
SHA256 7dbe7297b59f8a9d68b5a8ceb455d318c417e323689ea09c0eb9e0a45c23831f
SHA512 e3e05dbf6464fe3569c145de5e800c58288a8164f7aa9946a02e674bda2fb5e816bd81ec41efd8887a3aea8dc4e5eadbbcd6bc95acc4a5b830fe88f343888f66

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 66b1f931f2bca8b717118f646c80a76c
SHA1 ecda3928136c80b7fd43d6a3d3702839ac757171
SHA256 4c9144bc3bd99fd08f7197dbe547d4a226518cb1fb7ba92141e7f9760f183329
SHA512 11faf0c26dba6643075d0bde121389cc887298a784b59f2811661d93441b198792072803bb306e48a10542c546281a5c19b948133c8f6a1396e95fdd516dcd8e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eacb7e42b34e1bd9b3f9c05095d167b5
SHA1 23e167a936edb8931a0fff7808b227b383d35c5f
SHA256 2543d444e8def13f0e6a9cb19ef93319ba51f63dd12961448c4b88d2e5725997
SHA512 1c39ad49954b0b5e8adc2cc9913a99861476005d5bd8565cda9dbf6306216b780457e9e185e852df609b4d04edd2a7adca08ae63a1a908f79b64c1a0497dadbb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

MD5 47bce8c3cdd17394fefaaaec2c4006bb
SHA1 f0b7c8e054e253565e253336504f4986d03281a2
SHA256 26384f308f91787b07ca8c547335bb4c2546be883c02c391b1433f07616601cd
SHA512 f69cf63c6801547a35e0ba3bd4d0ab02a636f11d56c185a303a50b51a65b93caa5946059b710d6a17bd82d0e1bc65b3db84fd8299e66c1d2b48024fc682c45d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

MD5 1733b08a3185b93beb3391c7a0795f95
SHA1 b5a124dc3a058e306a9f927b616ccee88d9891d2
SHA256 059e8de326ede2d31842bb10141f29bf6e2bd000c5c5ec1ce322d7fa990bf1da
SHA512 cde949637e01501c2d7d9f78c5fdc3edfa8318808858378aa437f087ebaa8049da120f627e5e39ffee6d9db224943d230b4fd69705c223bac09978cf168777c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4b43d9a85bb7b778f2f196024411b62f
SHA1 ea3b2e02b96e87ecdb06bbeb9d1fa90e592ef981
SHA256 c1224ad18e19b18b32414e0cc56f0ecf815bbb2c3d9b57d7464831f14cba928f
SHA512 3141f9053f48a0fc87c1cdf2f4490522ed3853562808c1f718c2296a3f903ff8a14a51d9772f9c7afbcdf126cf88a48f527165a06272c1fb7f3df99d06e461db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

MD5 3f5093e7f8beb087abe24f9986e6fe25
SHA1 65b519ce12537ab5ba3e1ef7d626012ed78c352d
SHA256 06d0073aed0aa8813d1a1a752dfc7e0eb54d264b26f9a7b71a5c1be513d11bf7
SHA512 83c99e8700a2a6f9546c7079ca9bc8f08febe4f1b0a11ff18eff7fc2997a8b406cbdf115a9ac8cbb5a6d5050d879b4a05b359b7f4d74df15724d0596ee6e495c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

MD5 78d8b2409073bcd418fb34693c089292
SHA1 32e18360a2360d52dd6ddf1a6e94552c6cda4e9d
SHA256 fa9bcd784c874c66375a336b330d89ccf2231efa7b325f6eefc27f82817ca89f
SHA512 d211537f8ac9b124b24c4df3bae50fe840948e5f18268d641f38ae1f39cca2bb4b9369c12ef3fa5522b0e6908e8634326de2eb7b3b0ea51ace1063c0aac33fed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67d673c1906012550236f744646eaca3
SHA1 1d438b754d4dbcaa73a3bbe71d362946bf50c1f9
SHA256 86d4c8f2d04464ad3cc940eb15f7faff36b4b41e478300a43edbb8385a375f45
SHA512 6cb6c7e3c2363770fd9b1b2a194456bcc2765df4dad577aeb1764bc9ec500421a0372df405a92f90847adbce2c9dd07541420116959e49521ded8c7f428b6854

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f59e956ac45096a7b22910f856c46d8d
SHA1 2215675165566f2cdb048b38e92b1225b6686fa5
SHA256 33a966bb506a574419d55bdcd366455c383827522755660c1e3875c83e7ac006
SHA512 8ca5f45696d1c8d6de1ebb5c68959384ef78e24488541c15df713b79e910b0700493d7f05e62cb45bc6ae8aebbfdcc0b671c5dc74fadf308991b03e9abca9c23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

MD5 d71272ca07f18aba2b63661787a0ef7a
SHA1 bae0e3fd9ee47aae84633c9135c99059cbc92d01
SHA256 1cd1e0566ac284aa5860629cea03cc72693383980b13d5a3c0e183744510a154
SHA512 52e572e83255b718526824c6ecb32c2e9fac0b9263c999f6e4a256f7c35fc23bf6d93e6b77f2a780fdebec94086bb7c81b3ddc214c7531ace8bfbbe825fb742d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

MD5 31234c6836afd54779cded53e359ded1
SHA1 346f44dfffcc37ed51ce55a21618ae3db47dbebd
SHA256 3bbf2e5f5be53fdd8c2fcf49ccc258082a618589b80cd4802f172fa920d5bed1
SHA512 7f816fa5f35ed2bef21fc76cab3761ed55e289d0cfae099b0b753c0b711e0d62d58daf39a8bc8844cfcf64f3c1da79472494a8e02cd66d6fceb3f802ceec79bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e4fc96c5a21be44e86006bac90016fde
SHA1 829d44e9b4f54d34a79d08dbcda3117f30c83271
SHA256 357dba18c16769ba7bd4f859c6fd3d75eebc1f98bf94a4687358cd50e1129688
SHA512 edf83910da2227faaa2255cddeab67f4d87610619dacd19a931592ef531e027d1dda7971a1004cd79db63524fe9830a6b17c92e63b760361f1c4c56b2a28ca6d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

MD5 87a415106a6d606d12ff6c709f56c985
SHA1 94454799081084f4354405c6bc2b709abeeb2028
SHA256 4d0b015dbd6d872b4d567775361ec9e9077899e09281072984b2a6ea7054e2fb
SHA512 53df0be71f8f816caad8955875cb559f8397ea80becfb0ae0aa94e2d5be666fe43099b76942096d8436142e6106344aefe35c96c6f556558fc4fba5c95d39bc4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e3066c06c5f364d6f612cb1a472d97d
SHA1 21fbe2aca9e2629b94cb3aeb3ee4e65e32e452a9
SHA256 2f6484909def0baf5bb18d26430babca37d5667b0a2976d701bf8d155764d521
SHA512 b10c3deaaeefa40608ade41cbc7890a14031d96523bbd23f5c8f1edc03e4922d1b83e2aa25ce0cb194af629ecc9e4dece4580f2b9022dc7772a4f0cca56a416c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c08943ff47829dce2391f7ec85ac946c
SHA1 b0574d32eac60684f0e2776c2b8d8ea64fd8eba3
SHA256 f2de157cc3024a75531b2272a513a93d81cd73082a03be6aa82519ff87ecb15f
SHA512 aa5c88cd99208c435e74d77d009131176187d54c4f10bdfb76897c268f699502b00177385e723b7b597e2395985c8595fa653a0835954da2b082ef0f96e8a0b1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7e9956a0340f116cac0beee336ffe799
SHA1 f534a9101fa5990add9ebe8434ee192c497ec967
SHA256 d39fa73e2dafde9f2c5d3b30dc50029c80bd5560f0d560e6022373101c71a4e6
SHA512 b1216a39d39ab931995f2df29210bb82c5ac3cc535008730d35fc919d20b127fb887c57ac43dd22ea396afb091c5ca553e0515a6d5fe3c2a5ac1f62e78c86e82

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3044aeffe9ae39d9f47252df439bfd36
SHA1 e5e8b31f4e4b7f388944452f55911d61ce226cd6
SHA256 84b4773198861b2b1c4c55dbca55b3fd0ef5ea43370870f27167dc7ec9b08bce
SHA512 5631bb47f84ba9446c434f2393c851fd83d531b21dcac776bc33f91ae4680ee22c8deb27a6900e8e0411081cbc4ac60a45f0da2644274e52a8551e928e8b99f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b7ef4942e57fc5ea1f8113c7311cf5a2
SHA1 ed1804f2b15f8a0381f281afc944dc63c22b8c48
SHA256 aeafbbb1be569e28d4841b1f1867bb1e89262189239d5620a680026b6e5a713c
SHA512 6de35b20bd5a55a3ff908cdf7dc5ff3cc72dd602f05e3233773e46a212efd0e5b579909e7a69015820518a05f742e7f6590446ee5f0688f8d1926b809157eeea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bdc3145303b19416b1c25517d94f63b2
SHA1 6cb25daeb03b7970c39084e407930651494c1a26
SHA256 3245dba488ec86e8936206a5c77ccb537256ebc95a7fc53f4eb67647c0d53934
SHA512 17923b69899eab330b393197515b4f25f27381c3003f59ae4f52f306f2c943ff99dd2db7042a3eecfad5d9fb15a4d002703a1917e1a7ae15bc75b1db286b5e71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e97abf34d0b11df96344d540ecf1c8b1
SHA1 983034d75b2372b98ceb94b51987474bb83968ca
SHA256 82472602f83f4e9a22e9ae0400ae05fda158ab6b90e51d47acbcac831f5caedb
SHA512 b23b5d94b50ef6685f2c5d87f3f80a7a88ec2e5820ecb6dc4c6d7ea328885377153ff8ef66275c9222815a2e73c9f9edc4419ef6aa8bb457bec115c8b74b7b3c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d48a33aae236d7934404f7031e6f9389
SHA1 c10fed976819d6edaf7f1f24f668615b83ec8cb1
SHA256 a045403a995ccb00f9dbf2837ddd367d30d9d23ea82f909402353f3903010c6c
SHA512 29e1ed4c08f032630c06cffa8e2f13b8dab6f4a7565f2579987421510624d57971c20f90ef64557fadf230dd4713a300c0e13e55f7330a60163cd07e6e28afca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c9342246b2f88bf96033aa8bcc3c9657
SHA1 cb746afb3a7c3dbd7a20ffdb1fa28a5a16f05695
SHA256 3aa0e848a8e87fc83d1918547f7410f096a8af0e49e6ec5e3ec672315b8d9146
SHA512 ce77761bdaf7aef11d33eb750642a4198c079f9797143f9d356c62d2b3a8c15d36deb4e4c1fa03d9c9ef154c4139bbaba480e1fb50e7efa1afb9c2a5818dcc2f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 411c18f3d8913bcb1bbcc3d4c8b7520a
SHA1 6000232c9871f146641b6d75c8dbf266ed138310
SHA256 35d6262164935fde8f0b9397e6ba9a14b3e5a1dd10c1b6fec84acac472869fdc
SHA512 bac9b1974b06025967bf9119b1ee4cb432309b1e993c356115a1f63a5731ccd6eadc21cd228fb807670044ec6f0b90825f7b4796ad63bc677f3fcf73840170e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2aeb5f9caaaf2b406c05a5435bf34f59
SHA1 cb690c5a82e728342700361a32fdeeefed733552
SHA256 c5b212a11b4f63cb8b0eb5d6d6b7b9c4b6f0654e995406d353f9b43bd7be2a45
SHA512 1b9ea7f68a307b310d6b58565da20cb99424c0159f4f91e93bde564cefdff4c592d8c2c8679edebe87c6a73cdacf2163cf1eef9544cb053e78f1602d9a2cef6a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5071a6f880cdab37fc3942ae9d0a0d43
SHA1 000da118b10c940909741c3a621c4716a0cb4e94
SHA256 cf8e1aa75a45dce184691da51621a3362b8cd66bfeee4347f583e99b89ca3c9f
SHA512 21792fe0cf35d8d709f8610f4be46b17b39b6b299044a2f46c6ef73712849f6db7f39d0f897895f34447044a1c21d9b22bac76f9f11bcdae694698493411f028

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 01b0f0874645ebe8331eb0729cead527
SHA1 37a30373a7f6cd60591922c1207a54298d74b58c
SHA256 87606a52c0ed67b4dce9fa73f29a0c4b8da967e23bf719f6532bac0791832fbd
SHA512 b486ddbed5be5a7dad409f2f5f83f54c7dfaf2f0b664329ecb4e3ff64bfd4bf013491f4ad16a76b342734fed3883f5921162440e968531df49470b7ae0e44160

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b462c2fca25aafb4d8b5efbe06b41005
SHA1 5fa0f780a5bb282782a1369d134324fef0b9d9ab
SHA256 264794e2ebbddd9e3ab6ed823893e96a87ea54b3fcc44727f253400a605f7520
SHA512 df620bfbd8e04e7cdee761d10deaa4f8c646fd26586bbc45c20f864d78c6769aeee40abeffb37b904c3d50f9d9e60800eb7719a31aec18b7ea4273933186437c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77757b33838d5c20d97731834101a6bc
SHA1 edab394a44025be3addfac9d123ca1040e7cdacf
SHA256 08139c279f16d46399d0d2b96cb4dd2eae385e8a55827478cbf4bc99f57c5402
SHA512 b0298f98a5dc2a010489603800de7ff931b977a9e82bb7cb44c4e1065952e4931d40acca9df839f2d7b96a9f0aca8d8bae0f211b10b2aa0a9f3ecd8b99e1ae17

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e4480333b5156eb867c77a484d5bdd45
SHA1 bdc40521cd12ed58a492652817b87558bd489c78
SHA256 a080668bba525f50210fa4af87f5bded4eb2462b701fb75f873dfdc522106e52
SHA512 d78b7f1d3fa559abe689940a94f31639bc9f3943c65f3b129cf0ef416c6bd8329bbaaf3e5bf2dd971c169dfbaf20318e54a0899cd62e2e181e7c9e9184ceee53

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f794eaab9ee8ac3680962562562bf2b
SHA1 0bd83f504bd7b64592de379a29bb3164d0467d4a
SHA256 586e503cea0e8662e7f5f6484defb5394b58be2b9256e009bfe5551c490a360f
SHA512 bb962c2ab6c47d1e6b91a018b406dfa53d471ae72285d33838d5f9b76bb92935e7bd3a04a3190683914c98753189c2459987f6fc78bfb0a242f173571e981843

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cc6862d462c4a01c9fefb1abdb49e8e4
SHA1 ea6402fab1280c1d2153e593249f921f9d1489d1
SHA256 ebe9fdcd3654ce885bfe079fa023944a5e93c5f85126822c7edbea09bc1c1aa8
SHA512 8a82d8e8e658551b50dd0468a7d734730ae88daa0d5af4b7e185a7dc5573c4443acc7f4965d266a7216dacaeb73a89df5ddb7086c7d782aa93c8342c970e718f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eeac7690e7680c0c56002dda3e1aa555
SHA1 40d7dec42e7bac3a0faefad5323cb34fcb77ac43
SHA256 fdcc5b68446899bbbd9161d2dac4ebdbc492cbcc3c0378db02151f59e857633e
SHA512 dc152116860009ea81c71b4030f4ef43175c28d766549c23831fdb0c7b81b739c9f4b23a0d7801334b504416b42f869e2d811d01a85b04a11574d1d4277a4a35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 601c03e064a9cd18805a46fb5f004bf5
SHA1 68f8950df43a870ba73d6b3bf12127e92f1c6cd2
SHA256 45bc82aaa689844371189d9dbe5673b542beb4eb53c002a92e129a6b7309bb93
SHA512 d62bc51b3c0897866731b44e920dd84ebc1f424eb6da37550fb2b371f92425bd7c133c3f422d387eb7c14c4293c6e03101d1bcc93f070a2b23e5c2dec9a46a47

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 465fc8ec524cf3857060960da14130c8
SHA1 77b9febf1ea59ea4c70f58dc02de07b1b6c0e7da
SHA256 1bf989530960e13a031a1154d9275d265c3e9039154828fa333eee77a30849c1
SHA512 0ff4037ecf898200d67b688932e8281269405f74279e8f9fb95acbd906ffba39d346c3f3be4c648a0d2392f901adda5927ff20bf9e990931fabd5b3867180de5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d0c4e9835cfea819753380e08d750f00
SHA1 ef05626d03748e56c943e9aafbffc61230b428f4
SHA256 4ea1a06b8a03f4d31c6882a95d709d76729ac2d527eabd979a87c7fb2ec6f173
SHA512 a371de83b4fb9759a11677ca1bbab5057b9bfb249e968f3459dcbcddcd42c11d616a0f7b543cfc60c1361b13ad882cf10df316da55cef2dcc9e70480c2c73dd0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 c8f18bfaa6a09bbeb032c42b6ce43dad
SHA1 d3e53ea39b679a21ebd961e148e8d566fc72a709
SHA256 2db4caadcd19b3a21006bc6b381627e170f27571db1345b276579763ff78b218
SHA512 dc3e26d02d155228409fcbf8962f09acef2afc9a92926dbb2e6d98213bbbc1b39b4743189c402f5e1788b33c6eb808f6b86afd3c5be66bd36c55de91744ce462

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d8c4c37eae4483a3233ac70f6cb3a0e7
SHA1 b3083d145160bd570cf176902e0ec0a4dff87c37
SHA256 c336f8c36a1ab03b599d6180e513334fe5ddaee59555b23cfc846f0e7da7cd4d
SHA512 338cc8f1757de20062d534c8afea8f1812ac3aa56c7080066cab3a2f4d07030f0f3bf54236d67a413d1f62f427447cdee2302a7be63f88a46b081be0acac6c2c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2adaba43a055ca15cc64270c2421602
SHA1 4da399b308a9c65e0134fa5d9fd3474103f91907
SHA256 623241e15bd67f519db5e3de8742e7854814f2b180765faae16eb8f10e72397a
SHA512 fca97f4d018035791d54c36c3eb7158bc0f194e5ea0716150ebd1ef3b2e0c9d619ab563711cca9f34e02cccf6adc11fd89cb232976c21cf2f23507a41e352e60

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 26757a3c69d5ad175901e08855ee5ab0
SHA1 6547f9cd6b89f952525724108637e3f89256292f
SHA256 c695bebed24199271b30116b09caebd75507a3664b672cd04c2c9f228dd2f4b1
SHA512 40fb227214e43d128a08e76261d53ae556c13f546330da1edaf69e1700507a6eb369a31234a06276b291cc91dcbe1ac51373f04e273d3e4177358add08e8324d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d9dd452260610c1b3eb34223ca0a0ea
SHA1 e79226a6e6b45c05b91c9d047fd0f8f8fffa1c41
SHA256 eb4f5fd1ed54882767b689d866141102146b3f7f186ad018bd986ede2efa4fd8
SHA512 59d07a37df1798b9c4af73e4b1c87e67a068375776dc72c9c5d3656c1100e3bc2eb6a6899b754446e8182f100d079708e4325add8e48577f0f31b024eab3c2e6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 488240c92682d34833ba3aed01ecf3c9
SHA1 b72973ea592dacbb206739768db02f628a824106
SHA256 b2ea18818e840e07e5b995f1d1969666b48b03ea0d2f41888fa3d8b63cc2f2b8
SHA512 731f574fedf8dc9c2270e538e11410330e3f6d1201b20942af9863bc110d5f8f897a7e2683f4e68844f26ad6687a535391a2d50ffb52b29970969d59e7fa9556

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 f7d232666597212ba19908f0ed37916e
SHA1 b1b4bf75a73146d4c8a1fa7c7c017c59588063d6
SHA256 7879e28035616ef86bc1e4fefd627519d8af9789df2ad86b3f703acebecc5d5b
SHA512 fc76e67fd78d4c08bee7292f674d3f11bc34b442240145e7c75c9708fe13f45ca9a7a70e00ff385d00498693391fcd392e6d1fe313bd075d277171a31c4c0b98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bcdfe32d224ac451adacf5d124bed59d
SHA1 9c0e95e0e959f3801a2cde895c3be30eb9df19da
SHA256 5897887ac0e2342bfeb5c83aa8a7849201daadf1ef9d1140c3e47bdcb260fd6c
SHA512 b0613a37a15cb54a09497b40cba4809aa38b14ab9c2afb7cf748381254568bfacc3f7d1d314cee5f9090447ed4b277e3ef2ccaf9679be7a67403aa6631c15780

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 72780844642c6c0d10d955cc5ab4abc5
SHA1 4d6090a8a3d78f797ce3cb93087da1de070cf441
SHA256 d31a1b11241efec231724dd529d91f4a19e6e7cd153b8fab13b895a5ec4c369b
SHA512 074932473f2f582e13cc0930d0cc90bc939caa0943a935a5fa90f95a651229d828f0a455160d99e2b4538caf0c18b84177622c5b99c5f10b4abcdef3c41a9222

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 773cac45a5a6d0aa2e2bd1dfdab8b115
SHA1 d4cbfc04ec77f94a317b75b191d1766ca9eaf16f
SHA256 470212650a11918caab67c800add1877881fcaa245d9538189b8694945a6ffa4
SHA512 3f65e969df5e27de23689c2c20bb92024acca664a548aefbe76fc8ec2fd58b8a60577522a3a321e93f6dbc3d55b85bb9e28d22bb9a10b0a2b73041a408ede874

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-27 23:19

Reported

2024-10-27 23:22

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\76772736fdeb61e1bf90ef1751d11bc1_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4284 wrote to memory of 3840 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 3840 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 1180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 1180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4284 wrote to memory of 4808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\76772736fdeb61e1bf90ef1751d11bc1_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94ef946f8,0x7ff94ef94708,0x7ff94ef94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,11002678163249050828,16863527878415981764,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=904 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.178.9:80 www.blogger.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 synad2.nuffnang.com.my udp
US 8.8.8.8:53 referer.org udp
GB 142.250.178.9:443 www.blogger.com tcp
DE 64.190.63.222:80 referer.org tcp
US 8.8.8.8:53 twitter.com udp
US 104.244.42.129:80 twitter.com tcp
US 104.244.42.129:443 twitter.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
DE 64.190.63.222:80 referer.org tcp
GB 142.250.178.9:80 www.blogger.com tcp
US 8.8.8.8:53 pipes.yahoo.com udp
US 8.8.8.8:53 blog.kuizikel.com udp
US 8.8.8.8:53 www.kuizikel.com udp
US 8.8.8.8:53 kunoichi.info udp
US 8.8.8.8:53 s10.histats.com udp
GB 142.250.187.194:80 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 farm5.static.flickr.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 i844.photobucket.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.google.com udp
US 172.66.132.118:80 s10.histats.com tcp
US 8.8.8.8:53 img1.blogblog.com udp
GB 172.217.169.4:80 www.google.com tcp
GB 172.217.169.4:80 www.google.com tcp
GB 172.217.169.4:80 www.google.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
BE 18.239.208.4:80 i844.photobucket.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
US 8.8.8.8:53 x.com udp
NL 190.2.139.23:80 kunoichi.info tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
US 104.244.42.193:443 x.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
GB 142.250.178.9:80 img1.blogblog.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 222.63.190.64.in-addr.arpa udp
US 8.8.8.8:53 129.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 194.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 118.132.66.172.in-addr.arpa udp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
BE 18.239.208.4:443 i844.photobucket.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 pr.prchecker.info udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 67.227.215.171:80 pr.prchecker.info tcp
NL 18.239.36.123:80 crt.rootg2.amazontrust.com tcp
US 8.8.8.8:53 www4.shoutmix.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 s4.histats.com udp
GB 142.250.178.9:443 img1.blogblog.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
CA 149.56.240.127:443 s4.histats.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 67.227.215.171:443 pr.prchecker.info tcp
GB 142.250.179.226:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 statinside.com udp
US 172.67.146.166:443 statinside.com tcp
US 172.67.146.166:443 statinside.com tcp
GB 172.217.169.4:443 www.google.com tcp
US 172.66.132.118:443 s10.histats.com tcp
US 8.8.8.8:53 4.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 73.247.238.18.in-addr.arpa udp
US 8.8.8.8:53 4.208.239.18.in-addr.arpa udp
US 8.8.8.8:53 23.139.2.190.in-addr.arpa udp
US 8.8.8.8:53 193.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 113.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 123.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 171.215.227.67.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 127.240.56.149.in-addr.arpa udp
US 8.8.8.8:53 226.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 166.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 42.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.178.10:443 ogads-pa.googleapis.com tcp
GB 142.250.200.46:443 apis.google.com tcp
GB 142.250.178.10:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 shop4quran.blogspot.com udp
US 8.8.8.8:53 belajarpicasa.blogspot.com udp
US 8.8.8.8:53 openofficeorg.kuizikel.com udp
US 8.8.8.8:53 sh0p4book.blogspot.com udp
US 8.8.8.8:53 kawandiet.dietmate5.my udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
US 8.8.8.8:53 shop4blog.blogspot.com udp
GB 142.250.180.2:443 ep1.adtrafficquality.google tcp
GB 172.217.16.225:80 shop4blog.blogspot.com tcp
GB 172.217.16.225:80 shop4blog.blogspot.com tcp
GB 172.217.16.225:80 shop4blog.blogspot.com tcp
GB 172.217.16.225:80 shop4blog.blogspot.com tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
GB 172.217.169.1:443 ep2.adtrafficquality.google tcp
GB 172.217.169.1:443 ep2.adtrafficquality.google udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.187.206:443 play.google.com tcp
US 8.8.8.8:53 2.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 1.169.217.172.in-addr.arpa udp
GB 142.250.180.2:443 ep1.adtrafficquality.google udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 66.229.138.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

\??\pipe\LOCAL\crashpad_4284_GGSVPGDEKEPUTKTL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fb13002a1ca90b5800c995661f3b23ec
SHA1 718dcab1ac7be3c50c52e49573771ae5bb9542ea
SHA256 afaddd149f9f8889f483319640d2cc171b111adeb2073b6402d7e8321a47e843
SHA512 a826c1fc39ef5f6ab5137e7626394f9e0a3d52f2c2cb4c9a2169cc717a0e842b2e892ea79b8da05dfaedd57a891b7d887748f8187ea573feb126ae52ca4ea1a1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 98a75a81b8728bd6460e0ed68f30d49e
SHA1 fec8e31970fcbbb9179b4a53ff4f83f977087dbc
SHA256 4896df07a6a4721252b0bfc76a15ba7e5aedfee2108c471aa4ff7351ab008986
SHA512 4cbd797dfb1992f1efe58dd7959a42a6e6d2facf86cfc3e739c22472185e9a1bf12eff0b0074c09f3060f39228f1cfb231f86a7f13a2e8b418cf2cf55708cab2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b6b56d20140813f66284730d3c75f585
SHA1 31b16ea88302f4ae0c9e667905dddabfa3fe2d74
SHA256 81282c09bf86934cb80158effa5c78279750bec0e9f80931e62904f6671d67cf
SHA512 75dcdc378049c95d393b19736eb7a0ee20c6d50bc0c4e5d2904ef6d67ec5fe174567e96275321219772f5f58723d5f046f1fcc00d7e12e878c024ff15162e3ab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 113c2ff7564d92f663f600beb81f9bb9
SHA1 6cf33f4d027ca4702d6dc7603f34ac2c5ad0b3e3
SHA256 ef63837573c0014aae284de9659ca9379fabcc3a1b6888e4f90495f9c1b62765
SHA512 87e139a8fd495474b5ba2a5360e6b688b2745b6e5581aadbdeb5885151669284af6c43f7c5d9e9c41722bd2d45cfa1e2a804495250a456da5a5ce06896e7bc00

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 91be833c518df1958fa5c2ee5fea6708
SHA1 1f2052675604704fecbc4c39f2c9881c66c724ff
SHA256 20cf1ecaece442d82eaed0e216980f3497b18d0458323d92c29249313ab2a913
SHA512 f592c5fc4b779b2cb9267ce321d14e4fa9dc5001e2dda224be66f12c8258de5887c0d790a78bc1e36c59f0c514d51d0bae575c87ca57043011df23271b12af28