Malware Analysis Report

2025-04-03 14:26

Sample ID 241218-ca7lwsxmez
Target f9a3d2bbbb7a682ec3477db1dedfc1b8_JaffaCakes118
SHA256 a2835ac039c3c94270ebd95f8f228658c2618f5361eb93010d798acd5022fbf2
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a2835ac039c3c94270ebd95f8f228658c2618f5361eb93010d798acd5022fbf2

Threat Level: Known bad

The file f9a3d2bbbb7a682ec3477db1dedfc1b8_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

Socgholish family

SocGholish

System Location Discovery: System Language Discovery

Browser Information Discovery

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-18 01:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-18 01:53

Reported

2024-12-18 01:56

Platform

win7-20241010-en

Max time kernel

126s

Max time network

135s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9a3d2bbbb7a682ec3477db1dedfc1b8_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "10490" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3896" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "200" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\damncok.blogspot.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\Total = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "14697" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "10469" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3717" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3785" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2224" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2136" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3873" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "14697" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "3752" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "200" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "2103" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "10469" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\damncok.blogspot.com\ = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2218" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "2103" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "200" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatroll.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3867" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "10469" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\damncok.blogspot.com\ = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3752" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatroll.com\ = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "2224" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b96000000000200000000001066000000010000200000005c61f4d720821db2fc84a7f4343d9be70fa19c41e3469d4af486acdf6d2479db000000000e80000000020000200000005965f61efdd46c3a1b41f10ace8b9b3759fa22bbb3ed29bf76c92c9e239fe94f90000000f857413f660581e765b17683d952ce8af722bbb683d522bf11a0f64347d4fee9db16f7d6550cd62cd8f82f3d2dc33df772ea1f7d17fe16b6e8114880a7344aa9b66ff2a2c6e05ad022e87361495e22cbc4bb3fac7e6bf5f6a5a566a0a40007ffa452daa8cd35596c7999cf4bef2d5febe53a0d92cef243a9357bca7ba56edd5220a8c77edff9dc623b00d94e5011a05e400000007a58dcf8d19b4d0db78a16998e4b2d55cdf2017f08ed7fba2434ca7b5380817b5f7695255faf5ce7ae8a74066aeaa97e6f801c24cc325d7a9590812938b117cb C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "3785" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440648677" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9a3d2bbbb7a682ec3477db1dedfc1b8_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 layanan.oposisi.net udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 dinhquanghuy.110mb.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 adsensecamp.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 feeds.feedburner.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 c.gigcount.com udp
US 8.8.8.8:53 www.reverbnation.com udp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 icons.iconarchive.com udp
US 8.8.8.8:53 imemovaz.googlecode.com udp
US 8.8.8.8:53 banner.adsensecamp.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 andreykusanagi.googlecode.com udp
US 8.8.8.8:53 www.alertpay.com udp
US 8.8.8.8:53 mybloggertricks.googlecode.com udp
US 8.8.8.8:53 www.lintas.me udp
US 8.8.8.8:53 s2.sigmirror.com udp
US 8.8.8.8:53 vicahya.googlecode.com udp
US 8.8.8.8:53 js-kit.com udp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
NL 185.89.211.116:80 ib.adnxs.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
NL 185.89.211.116:80 ib.adnxs.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 172.217.20.164:80 www.google.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 172.217.20.164:80 www.google.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 76.223.54.146:80 yourjavascript.com tcp
US 76.223.54.146:80 yourjavascript.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 142.250.179.74:443 ajax.googleapis.com tcp
US 76.223.54.146:80 yourjavascript.com tcp
FR 142.250.179.74:443 ajax.googleapis.com tcp
FR 142.250.179.78:443 apis.google.com tcp
FR 142.250.179.78:443 apis.google.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
US 52.223.39.56:443 www.alertpay.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
US 52.223.39.56:443 www.alertpay.com tcp
FR 142.250.179.97:443 lh4.googleusercontent.com tcp
FR 142.250.179.97:443 lh4.googleusercontent.com tcp
US 104.21.235.214:80 icons.iconarchive.com tcp
US 104.21.235.214:80 icons.iconarchive.com tcp
US 34.226.101.193:80 www.reverbnation.com tcp
US 34.226.101.193:80 www.reverbnation.com tcp
FR 142.250.179.97:443 lh4.googleusercontent.com tcp
FR 142.250.179.97:443 lh4.googleusercontent.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 142.250.179.97:443 lh4.googleusercontent.com tcp
FR 142.250.179.97:443 lh4.googleusercontent.com tcp
US 172.67.215.31:80 www.lintas.me tcp
US 172.67.215.31:80 www.lintas.me tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
FR 52.222.169.66:80 js-kit.com tcp
FR 52.222.169.66:80 js-kit.com tcp
US 8.8.8.8:53 t.ly udp
NL 185.89.211.116:443 ib.adnxs.com tcp
US 104.20.6.133:443 t.ly tcp
US 104.20.6.133:443 t.ly tcp
FR 52.222.169.66:443 js-kit.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
US 34.226.101.193:443 www.reverbnation.com tcp
FR 52.222.169.66:443 js-kit.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 52.222.169.66:443 js-kit.com tcp
FR 3.164.163.90:80 crt.rootg2.amazontrust.com tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 3.164.163.59:80 crt.rootg2.amazontrust.com tcp
FR 52.222.169.66:443 js-kit.com tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 r10.o.lencr.org udp
US 8.8.8.8:53 r10.o.lencr.org udp
US 8.8.8.8:53 r10.o.lencr.org udp
US 8.8.8.8:53 r10.o.lencr.org udp
US 8.8.8.8:53 r10.o.lencr.org udp
GB 88.221.134.137:80 r10.o.lencr.org tcp
GB 88.221.135.105:80 r10.o.lencr.org tcp
GB 88.221.135.105:80 r10.o.lencr.org tcp
GB 88.221.135.105:80 r10.o.lencr.org tcp
GB 88.221.135.115:80 r10.o.lencr.org tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m03.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m03.amazontrust.com udp
FR 13.249.8.192:80 ocsp.r2m03.amazontrust.com tcp
FR 13.249.8.192:80 ocsp.r2m03.amazontrust.com tcp
FR 13.249.8.192:80 ocsp.r2m03.amazontrust.com tcp
FR 142.250.179.78:443 apis.google.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 chatroll.com udp
US 8.8.8.8:53 s10.histats.com udp
FR 142.250.201.174:80 www.youtube.com tcp
FR 142.250.201.174:80 www.youtube.com tcp
US 104.20.3.69:80 s10.histats.com tcp
US 104.20.3.69:80 s10.histats.com tcp
US 8.8.8.8:53 s4.histats.com udp
CA 54.39.156.32:443 s4.histats.com tcp
CA 54.39.156.32:443 s4.histats.com tcp
US 8.8.8.8:53 www.scri8e.com udp
US 8.8.8.8:53 lh3.ggpht.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
FR 142.250.201.174:443 www.youtube.com tcp
US 208.87.227.250:80 www.scri8e.com tcp
US 208.87.227.250:80 www.scri8e.com tcp
FR 142.250.179.110:80 www.youtube.com tcp
FR 142.250.179.110:80 www.youtube.com tcp
US 169.47.242.252:80 chatroll.com tcp
US 169.47.242.252:80 chatroll.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
US 169.47.242.252:443 chatroll.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
GB 88.221.135.105:80 r11.o.lencr.org tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
GB 88.221.135.115:80 r11.o.lencr.org tcp
US 8.8.8.8:53 dw3mgzt87vzb4.cloudfront.net udp
FR 142.250.201.174:443 www.youtube.com tcp
FR 3.165.112.6:443 dw3mgzt87vzb4.cloudfront.net tcp
FR 3.165.112.6:443 dw3mgzt87vzb4.cloudfront.net tcp
FR 3.165.112.6:443 dw3mgzt87vzb4.cloudfront.net tcp
FR 142.250.201.174:443 www.youtube.com tcp
FR 142.250.201.174:443 www.youtube.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
FR 142.250.75.226:443 googleads.g.doubleclick.net tcp
FR 142.250.75.226:443 googleads.g.doubleclick.net tcp
FR 3.165.112.6:443 dw3mgzt87vzb4.cloudfront.net tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
FR 216.58.213.74:443 jnn-pa.googleapis.com tcp
FR 172.217.20.198:443 static.doubleclick.net tcp
FR 172.217.20.198:443 static.doubleclick.net tcp
US 8.8.8.8:53 connect.facebook.net udp
IE 31.13.73.22:443 connect.facebook.net tcp
IE 31.13.73.22:443 connect.facebook.net tcp
US 8.8.8.8:53 d167qii8h0pw75.cloudfront.net udp
FR 52.222.196.155:443 d167qii8h0pw75.cloudfront.net tcp
FR 52.222.196.155:443 d167qii8h0pw75.cloudfront.net tcp
US 8.8.8.8:53 d33tru5sm6wy0x.cloudfront.net udp
FR 18.155.128.189:443 d33tru5sm6wy0x.cloudfront.net tcp
FR 18.155.128.189:443 d33tru5sm6wy0x.cloudfront.net tcp
FR 142.250.179.97:443 lh4.googleusercontent.com tcp
FR 142.250.179.97:443 lh4.googleusercontent.com tcp
US 8.8.8.8:53 lh6.googleusercontent.com udp
FR 142.250.179.97:443 lh6.googleusercontent.com tcp
FR 142.250.179.97:443 lh6.googleusercontent.com tcp
FR 142.250.201.174:443 www.youtube.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 169.47.242.252:443 chatroll.com tcp
US 8.8.8.8:53 damncok.blogspot.com udp
FR 216.58.213.65:80 damncok.blogspot.com tcp
FR 216.58.213.65:80 damncok.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
US 76.223.54.146:443 yourjavascript.com tcp
US 76.223.54.146:443 yourjavascript.com tcp
FR 216.58.215.33:443 3.bp.blogspot.com tcp
FR 216.58.215.33:443 3.bp.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
FR 142.250.179.97:443 lh6.googleusercontent.com tcp
FR 142.250.179.97:443 lh6.googleusercontent.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
US 8.8.8.8:53 fbcdn-sphotos-d-a.akamaihd.net udp
US 8.8.8.8:53 blogger.googleusercontent.com udp
US 8.8.8.8:53 s7.addthis.com udp
US 8.8.8.8:53 nwidget.networkedblogs.com udp
US 8.8.8.8:53 coepoe.googlecode.com udp
NL 142.250.102.82:443 coepoe.googlecode.com tcp
NL 142.250.102.82:443 coepoe.googlecode.com tcp
FR 142.250.179.97:443 blogger.googleusercontent.com tcp
FR 142.250.179.97:443 blogger.googleusercontent.com tcp
FR 142.250.179.97:443 blogger.googleusercontent.com tcp
FR 142.250.179.97:443 blogger.googleusercontent.com tcp
FR 142.250.179.97:443 blogger.googleusercontent.com tcp
FR 142.250.179.97:443 blogger.googleusercontent.com tcp
FR 142.250.179.97:443 blogger.googleusercontent.com tcp
US 76.223.54.146:443 yourjavascript.com tcp
US 8.8.8.8:53 platform.twitter.com udp
FR 142.250.201.174:443 www.youtube.com tcp
GB 146.75.72.157:443 platform.twitter.com tcp
GB 146.75.72.157:443 platform.twitter.com tcp
FR 142.250.201.174:443 www.youtube.com tcp
FR 142.250.201.174:443 www.youtube.com tcp
FR 142.250.201.174:443 www.youtube.com tcp
GB 146.75.72.157:443 platform.twitter.com tcp
US 8.8.8.8:53 img.youtube.com udp
FR 142.250.75.238:443 img.youtube.com tcp
FR 142.250.75.238:443 img.youtube.com tcp
FR 142.250.75.238:443 img.youtube.com tcp
FR 142.250.75.238:443 img.youtube.com tcp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
FR 216.58.214.66:443 ep1.adtrafficquality.google tcp
FR 216.58.214.66:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
FR 142.250.178.129:443 ep2.adtrafficquality.google tcp
FR 142.250.178.129:443 ep2.adtrafficquality.google tcp
US 8.8.8.8:53 fe0.google.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 8f75bccb9f90b405c5b13c4731e0bbcb
SHA1 ef87653e805350f58a9b1627f732ef537d4b35ec
SHA256 631199d5e68c1ee542c0bb76facd0bc1d2818c03cec5ede0d861e7a2531baefd
SHA512 705be773396efc82ada12d587941604f60750d569d85474a8f767248bfe6c228cf0d4819d159039f20afa01c150525e1b1e9e6381979185cf4ae26725e71d633

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 947b8d0628ecf02b8cc9ea2a7f0d4ed0
SHA1 5221f0854b9e55910d63e188029ef0847f91c53a
SHA256 12e5fa06fac2879eb27680c63229189c910e113a96e9f1bfbabc658446e7d8a7
SHA512 db39f0ee9fb44dad9ec1cddab6e2ab59209e59dfe92438f1276d42074bf2b7c497b413214e356532c873fc31ad6c0efbf2ddc1504526b266fbd64ba913ea18c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 d564f922be77fffe6bfbfb196a29366f
SHA1 e1c42dd8ddc2f7c375a6debe4c580f45f309777b
SHA256 cb18ad51703930d7f2dc045f85cd721cec77b41d6fd69923efae0c9de6246cc5
SHA512 ed9f3e2193ca4e08cca08758f73bd7d9adcaeb8613735614c7bdffd2f7a3abfd4634b3b0578dec522344b5ebeaac54333ed5a3896f038feeb22c9173e59c685f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 dfda808ccebc3f660a70b4435105d903
SHA1 ee0dd7b0e650244785ec07adcd5bb492827b9aa3
SHA256 4994f2c4d58629f3df1680301cf58162137af8caea5de60611c8753377f455fd
SHA512 01a6067b2325bc96e572a7df50a6c4ea27f177ded6084cb0dcd68b5aa206601c70247d241c7e2030c873d7005851a058b67db284c4aeadd4a3a702bec35ba35b

C:\Users\Admin\AppData\Local\Temp\Cab2261.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar2293.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 facd1339e915a58061306bf430029d40
SHA1 bea9d8922f2522ac119e55a8a3b6f89c935eb481
SHA256 6f2039b7209270e196403d7de7cc3ea2dd5391a19bee79f60861aee4e8de4bd8
SHA512 2109164d0971f2a439aacf1ef29e80a9d778810b8f4936f4ad65d8d383f725319bc6b0b39a2a7d5f447799d5099cc427fe869003746b057a5042e1d36b0f23f6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\show[4].htm

MD5 0f952b73d3f5586637ea9a5a789d48f4
SHA1 b29aff4ffa1d4decd77db5160f920e1c6417e5e9
SHA256 69d11528ee32902d0c47ed215877f0610399536f755db03ed02a77ecedd74751
SHA512 6e7f096fd4bc4fb7ebe7fd24d861e0fafe819ae969978ec3a19be3aa1a2e270cf2fd93dd2ac0c7087cbc137c47402055e4fcc14ab669cffdf761788f22db28da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_1866E19A9EA470E8F26D259D51C89BDC

MD5 09ae0be87cfca10c9fd052c5486e23ad
SHA1 7083d8bd1da4f980e563bc901cb1c8cd5c22d3c6
SHA256 2b7320e87374d41fc4fa137a333667f845bb4173944ea9b2868de37d91c8a024
SHA512 edb313a20e11526ffeffdaa29c75b2a7f5316961a6b420e05b70dac91e7e4e4f007acc50102ee671c22177be1ec64ccf823f2c0007587b9bfb20c384130dd405

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_1866E19A9EA470E8F26D259D51C89BDC

MD5 418a90e43ddfba15f4771a4baa56c0f0
SHA1 74be932f36117524b825521a03adc46aef0716cd
SHA256 703722edac9ed2be20d046574a2e959910717f6fe161d80c8d22e4330f9b45f0
SHA512 5b6a91431aed52f58861bf3dc0a079de4ccd5845e5c771f2d393d9017352dc27725a8daf99e770f05d5bfeb18a33ed4eca7091c9ac35ad675a5bd4e3cc828eb5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_86F2A83F54EA52E2D59C5D2EE00149B8

MD5 59d2d9ab1cea7aee3e2829b42711c84b
SHA1 e972283c7f52ae2265db2aebe555611d79836da3
SHA256 98b259151b7fc9b7ecb53a296f9cf1018c82cc50ce334279eaec2c89a9ab6d13
SHA512 cb1d8a2454ed665b3c38dc931005a86a541ae779c5424ab4fdfb8ed64c0ae83720ad7a986fd6c5b138c1ac38e92bd86c21dda152d62b8aa49625d3299a4450c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_86F2A83F54EA52E2D59C5D2EE00149B8

MD5 39897533f4e9be281a2e9a24e3ee21b5
SHA1 92d7084bcf6197a8d3b2300c20f6552e378608b2
SHA256 8c0d0807b0efd163537ebc778d6bc3a76acdfa964c0e5d70c9f05774f4292ed0
SHA512 3a39232ed2a67737e7c5b9eb32e261803d6509e21fb326edbf9c4a33f6f8a785e79ebbfa5aefd2c03ed92f71129b8b70471081f2492b8f94037af215cc39fa93

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab564da77191d1b30ac1c607f0eeb09d
SHA1 9b817f6111cc208bf0a969f1aaef8e4648f89a66
SHA256 75a69a351326edc3cb7a62c840445df085f6d1a97a91931ca78ce0fe6ca77d78
SHA512 a1246c1d4b206d20344e2cd7d3b2bd0d1d54c48559642528e3a25aaa86183dbd38c5baea793901f4725519c5a3837633ee95f161040f7568d6e7b555fdea763b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 93b8ba4d3be0f6a7a0d20f904aad8754
SHA1 67da88d7da536e3549c5b47351f7f91b533f198a
SHA256 803c475af8bbcd9605b98935931cac66b08634f066b43913f3cfbd03a32062f6
SHA512 2bd02d2d28ef049e7f5ef98ab2ed4f5bf10107483ee7b826fab6136dbf4114f36154cf8ef9d73c5338b2240bc4a223cffb758d74865a8a88b1e5e4798db02e4b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

MD5 c6150925cfea5941ddc7ff2a0a506692
SHA1 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
SHA256 28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996
SHA512 b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 8d02e7aef8b57ee620bdce3da1fd0fad
SHA1 c0512027f5638533fb26a12715bd15715bfc15a7
SHA256 f3f0b72fef46298610192ffe7acab8c9d45fe9e85d1fe2219929f9763b9cc7b2
SHA512 13103b045db028ff4ac545beee442599f8ef9e7fb0797f68e6b109fff466ab8729a746dc489734cdea4f8a582b297be06811dd8575362e332bea3c19b93fa876

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7

MD5 2013226b6306b6c0b212a5bc5765e183
SHA1 b1536b09c1a7431cf23a23a75d53d7edecf661fd
SHA256 c6e6c2c3670f71e05c8127f647e6bd8cd7a355f121a243024922172195e1d8b9
SHA512 f3272ae1357d44a682831eeeb81936a0e4fbd7811fdbb32246b69735e7ec3edbf94189fe18c228a96eaa4273825c1a6ad40cfdd194c37f257bd221b89b8a2442

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c326744858d32259ee574866bb37fa0c
SHA1 29cb9bd0cb10a2d6d4f10a29f2e39416c1575ef4
SHA256 1b4b7af97cbcaf206148daacb27116f1722ed7798a6d48878f525a144cf00b73
SHA512 c51bf09d09c5ede9d2f306c30c7dee4cdb4a96ec20c5c875af102e44438c57b45545a714653767165d17955b1e9a4db9796ef521debc8bff39448b9674e0854b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19d8a32c52a7bab31d088b2adbde67ea
SHA1 f9ded27f1c9fc81454a2845914229934469ca4f8
SHA256 b6fe3d4313097fe96c5d7a7fe2026a87c003d73d9dfa7980bff5945b3ce27630
SHA512 105fc90258c18739f7e5283320417beeef638f9a5e3fc09dadccfd2efdaac429d6f7cff78aba2deb0c2dc5af9a7c2a2437d6901aae18613136f9997d31da4b0a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f311af65050ab06384f339cf1bce386
SHA1 d558247530e50e551384be0a6a54fc8808333ee9
SHA256 844a40306664977df3f821dabb5e7cd1df9aafd5e61f07a9fc81ead75615f233
SHA512 031fcd2cbd5a6b4ddc249646ee42463776310366e031e448d80431e71225e1f2c83412ea07864a1801eae3302b7ce967e749c2cc222031f3fe31c85bb97c958b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 e192462f281446b5d1500d474fbacc4b
SHA1 5ed0044ac937193b78f9878ad7bac5c9ff7534ff
SHA256 f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60
SHA512 cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\fb[1].htm

MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\jquery.min[2].js

MD5 a34f78c3aecd182144818eb4b7303fda
SHA1 6fca78dac2797c02d86a4bf6514eda398b7dbe62
SHA256 c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
SHA512 ddec07100503fdad6655d4e90aaac246719e9667611b35b112e4694e2671b43f4c4ef0b87371d3a6e173f7ade9dfd2058e5e165a41c3a250007d49ec18f2419c

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 42366712e579a655f8331ab20f67823f
SHA1 3494ce2216f0b6b59189c862bd51b12ccecae663
SHA256 a70c05e19ddb99d29d55e2f59dad101b654bb2ab1fe5aad3f6e2a09bd34c67c2
SHA512 2cfc640cabd194d9caaa9dbaf19534d104c50df672c606268ef39a95ad069a2e7e53b2f87ed0b40e49a63578fce4eea4d1dd311fa15c0e49f2325703edee7459

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 889d7a7b10cae0bc2f23bfe84f808c04
SHA1 ef8f6b2fc4c0cc8dbf9604d7a2a5b764e22b7fd8
SHA256 4ece9ae133912d5de5d2a1969f192d753759946fac7bcf24a450e9ce5ecd7cc2
SHA512 3ba2e3fe87b7c13ec0a0530bc550a3029096c1ac8a4a39b4fe6211455ed78915675ddd74498a7adba70a0d02b2095f1487a3c2ce5de844115a4fdba4a9dc99bf

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 6a9203b3a4cd36446c9d788bb66caaa4
SHA1 93663bbb8d0097da2d04b711afa08bde701241ea
SHA256 e914f0aaa775654459af8c12b340849fc1492986e38339491d41e4e9a978fa85
SHA512 179e0f6e5b464b38414f59c0bf63e36a8df405264b8f921bc97519a0c1bba589c39804dd67dcbd6805335860b11a7303d4648dfaa22be95c72588a6baac5dce7

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 5978004432383660d0ba7b2a62e71b1d
SHA1 84afc1af4ed316eaebcaa252516e7fcb03403c38
SHA256 0901a0e3cb78ec2bc065f9125a04057414cd9d3e841f4140e94179a41053b23b
SHA512 9dec8d434fb8c2262cc7c0a679442060f54fafa9e82ca93ddb14186160cb522052bb0eba81ea2606b8c99f007464c04a11ff245cb45141138930f43b3473b9c8

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 3feedef52781759e1ecf5af5322ab0f9
SHA1 39bb2129fb73ee795ad67f5ec7d978817b3a22f9
SHA256 20bf8d70dcac016d86311b84ccd6a1030f902ca8c2b2e1716fab9ab540d712f9
SHA512 d3f3ef81c8451e88f847042837abe38fa73d8d4b5de9fa7e6ca50a9dc39c41600439910e5655a21151c1f6c2fe175e76e7fb8bccb03e5dd146fe22d8afbc96d0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff

MD5 de8b7431b74642e830af4d4f4b513ec9
SHA1 f549f1fe8a0b86ef3fbdcb8d508440aff84c385c
SHA256 3bfe46bb1ca35b205306c5ec664e99e4a816f48a417b6b42e77a1f43f0bc4e7a
SHA512 57d3d4de3816307ed954b796c13bfa34af22a46a2fea310df90e966301350ae8adac62bcd2abf7d7768e6bdcbb3dfc5069378a728436173d07abfa483c1025ac

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\KFOmCnqEu92Fr1Mu4mxM[1].woff

MD5 bafb105baeb22d965c70fe52ba6b49d9
SHA1 934014cc9bbe5883542be756b3146c05844b254f
SHA256 1570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed
SHA512 85a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\www-embed-player[1].js

MD5 390a18444749ff1687c35276c0117042
SHA1 3942e2f36c9c62cfaf8c179550b278ef6c570b47
SHA256 460695efd3945db005d79592c92768f4404939da71a3ec4338f5f96bdf576baa
SHA512 34a540ba553b15c63cb93df639a35189ff13441e9fc053d16c8b50064fd300dcc6aefedef2ccce4db72af0f6dec55f1b333fe41cb7556f9456558b49a9bb3750

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\www-player[1].css

MD5 d40f4aba2c94932f3ff32710e76271a9
SHA1 a99a9ba2172aeb27f1ee28454c01c065958304ff
SHA256 ab4f3618647d7f83f07977628600eca4726338c3863119a42b7374e8c4144a85
SHA512 ef1a5b8c6009c68db1dec4237041c1ce24b50a232bc8213c0fdc4f6c7d4f836635a14e48f5267cb14b710fcebf94c85fb41cd5632dd402d3f6756e2af53fa955

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\base[1].js

MD5 dffd0e78d2a33bb0404f98e7848d6b96
SHA1 c335a1bc309e53cb713bb2d0cc4f019e183d0a3d
SHA256 7862b9dc103362c7c2c4311a421f0ac223522f9e5e39dc7c06e81ac03a700893
SHA512 d88dd77dde3d3b98ca27b52e87574f47aa89ad61e7c034cf03662cfb3b83084de4b22f65c7b2cee463139680ceab5d4b4e3fa2aa89c570db8a1a1d90a7af3034

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\ad_status[1].js

MD5 1fa71744db23d0f8df9cce6719defcb7
SHA1 e4be9b7136697942a036f97cf26ebaf703ad2067
SHA256 eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
SHA512 17fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 8aa049bd4566a2ae38ab2f28ff313a4b
SHA1 58223f26c30e3aa743025ad386012eea28d53144
SHA256 25182ef19df4025d87f924dd969fff603d5fe5d02479a621eecbf370e50873e8
SHA512 f0a0d71b16ecd2c326812c7327e35312e19ae191d6fda3f47635a8a45395d4db9500b5793399d56ecb5f9fb960f3f278af567954fc5719caa604a79f82e8ae90

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\embed[1].js

MD5 2fe29ece9b34ebf5e40fdf5e18bbf7f5
SHA1 786d5faf73ad1d55483701929067296dcda53711
SHA256 eba1e9985737a9a73052fb2c5568eae0a6fffa24cd5474437bf1accb4442ed35
SHA512 7ee26b0e7e0f59ed8444c712581b5b4e3c6e1d0172229e8786756c3677a6c84574d67d2918f373e2508f14838a4af06b82b2cae333020909ed815b3c0bceebf4

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 cc700798006269dedb336c0af95887bd
SHA1 76775a9dca88db55ff10c63445e741a24cbd5486
SHA256 7e1da37eaf41b71ccc809837b3eee12358e6020b91ebb506b3eabe3c991040de
SHA512 1bdcebb0d13add34c0d5930f0fbe0575b014a677df3f11c87622fa83afb2d04438a34655d127d2386f16bda1c5708ec28f113e16b7a5e585768d5039e97de636

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 784b3e9d3c37c3937c01340905ec1b9c
SHA1 b117b913d1821abca33e7536375733b9370cdbd4
SHA256 55a0d6ed79f9e361774fcef621851a9f58342b5d848f1b33bf81475215f7abe4
SHA512 733a40f3bb25d664e0e99785815abac9d7745741770229a0ad7c741e170ea5ad2a726e82b1d9963a95b84ee49c4de3b610811b751bdecde77cf5dc66b88793df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b6f11595424af6bb821d378a656899e
SHA1 5412134a8d8afaf1eb609675b910d492ebe3630f
SHA256 0550b1ddd9eac0fce6decd0dbfbea511e692ce5a045663ef7eb0ff421b2e760f
SHA512 b4af61b90233bfb711a77e121a807a7b40536ba03b788fd3f6c54f37221243283a840073f8ab2f54d8b72a8bdda102d3b56afbbf452777136c5f7ee697ed68bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c59a56f247a7b62964b6a817c51c2375
SHA1 e3b232a0f28b7e58c7dde6a8d1c56969844c804e
SHA256 a404288c17521926efb9de5f6fca25edc9f94b688f3afe78a2ceffde20f8dd59
SHA512 dfb842893a739d840231e4144918aa94b77038b126bbd36318409c8c33b11bc843eb7907a879df0463165c7bf3f69d6d62e7253040f7afa3c1e95a307a5a2988

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a07c0da00f65877c89a75db7459d136d
SHA1 9c3a283237964da230c27bdd18937efb99114dee
SHA256 7853c280c2c6484f62982584b1ae38e447878d2fbb5a07efcb4f1055d6dc06e4
SHA512 697c31baf9a670d0fcdc105ffe16c776a5e0556b4b7b4c8081344c8d7de345e91a4c90b1619c5578e833d10cee48285689b76d86a7c57c0d6f2cd630b2fe43c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5dd932b34fe74cd71a7d20e20b4edc1d
SHA1 22f3dbb4c688e031ec0124753cd00c2e5b2d70fc
SHA256 71abe3680d0589c7d01f32a4701daaa34cdd170462d8b2b9cff8462a454404a3
SHA512 7f0deb87124f3c8d202391ee220a9d5026c3832115cfc8b0b177fa0e7051ec31617fd5b7e581f31a825d1965d361e086e65d70ba1bdf4ed3efd439bbd3a42167

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a61a2dcee24e5ba9ba8084f0d5bcefe2
SHA1 9d214a653fd1e931b92a4b08efc2029932e343a4
SHA256 324b87d94ba5632214f576c2a82914af4bb63b8e792a0137cd844ea87cb3ce3a
SHA512 b4f3c210bf3aa9ce7446885bfd78116c70064db1ce12c1201f8a733f4cbe4eaf693b97cc39d3c355a06d1e5aed56aa3ef287069bdea77eef5b204cb1ac185932

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6cec7a0e079876e714ac6aeda77ce44d
SHA1 73e4224810cc606ff63700cd404e6d58a41761df
SHA256 80bca5bc873b14b2365ea660278ec7d3153754efe250027a4efb6580282c2c62
SHA512 1b820def12e0657ba3d269c3d717359c9f0cfb60909797dde827b067f906f8157497c563028656bdf90e726373c8a5e2bf0591bceda8ee41f0400f8e2b147cb2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fddd508def7d9f95bd2eb21c0ae39a26
SHA1 225064ecd5918690aabc34ff15ee2f6e7916ce4a
SHA256 5a3709ecf48cf489869a7605199add19d669a5e3b9ab5cbb763396f77e6dedbe
SHA512 568cdf0f2250cc7397e62039c1d9422d40334bd733262d2f74f33865e1649018868c15dca2300493627b9e1b8dbbe2b9b78d816ddf57e99151c4d5c07dbb4a0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dae79cf1e051f2a0ee2fbfb6e6dbb7f3
SHA1 a75c9aa1fa09dbe72656e3e08fc60627fc7c11a3
SHA256 e2a78a9f232b180818db7a9b717222569498c75171c84505f7c1b0e395d1fb6f
SHA512 cc3820350decc495859260c05231f401c47be7b2c722653b36050a3ca255cc4f14b9109a9ac3be29e6c7a3cfa4a77a2fc9398d40ad1f5aa6a198fdcd3576128f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 66922e56a5cdaf280412c045712eeb97
SHA1 f54640a7efede1c64af58692acd0f68edbd54fcc
SHA256 560c07fea62c2c0dd7bab1fcb8ba4170fa79a3d81dcb0940e21ec9656c89c0cc
SHA512 56cbcab99342dffe4c97733782f277190021ceeeb518d042a1b91980f4f3e4b5d5aac6548a2fedfbd735bcf021d567ab6f9c7b649cc9933f5eecc5780ea50904

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 968a113696608140eada57814420e930
SHA1 577e3df673c5d8ebaab7b5738498eac75133d763
SHA256 af39cdfe7238e9082c38cea8688388bb330262ea385d6b92a3358550cd08b28a
SHA512 4b2903290ce3d4ec5090015640257d8bcbe0d06797a59be6882677ad9ef3abfd8f5d86b344a6afba8bef1e85f42e2816b18d9ae2c4699c636d83cfc8430298a7

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 25fa59305db4ffbf8fd1ff8793ca7876
SHA1 66c67a2ee9531fb15ede9c63cb3434d06fc57e99
SHA256 1eb77d8249a3b18ad7798d4798f22b2a56c0bf61fa15a46bced6af725a68facc
SHA512 601ee92f9b2490128780983804064277c4be81edf92431967167b06ce297373c91be2e04cd56bef3ddfc9b3a1ac07dd5e83db5f91354fd97643e63db92b031b8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\platform[1].js

MD5 da179f14fa23524b7a46d44fdf71eb47
SHA1 238c5064c2139e8a754cf74e44ea46ab4db5ebf8
SHA256 0d205e3611c526c7d6f6c936609ebe4a3979f8226f1ae2861629333cf078aa8c
SHA512 561e6ccef7acbda472f876ee9aa4fb0725327c36d8e610ee6c370ab14a7fce63301a3d28a50d9c2a3d2c3c4a668f063370cc2d8967128131c1ad3ca3f0ecadd2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c19676c18d864d5c303c2c4f0dc8478
SHA1 81e86fb01c9b75a3df8adb84e82fa28272b1c28e
SHA256 0a45d94912a7b73fe9bd73673b529c80bf68ba908d892413d582656357b45cc1
SHA512 890d34359bce44a6e072263bcb1947109ba9aeb5f461458a303eebdd3af6fe0fdb32d891a0c96295736505ea54413eb6ee2a09d683b3d888483d85a3d89d46e7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99f983ddea750a1fda5f82a2c0460993
SHA1 554c86cdbb48c22bacc2f0a481097216d070525f
SHA256 a840ab91d7b74498b34d8cda09c4405706495aa91d13e9c45b01f2d16b1ca2ce
SHA512 59214366c9bbe8f77c8efe05d50eb58efa21052574c3fcfa735e2a4f661492e1ce4b6c9d00fc43db6d527865a63d00b3c98b0ccb48f6c8315f1d529ba315b266

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 50c8c90d9b3c7160265b7d1947af9043
SHA1 4fee2e12279b8cf2a7a4a3320b8c47e518dfa621
SHA256 c13b98e7d5f50110ed4546fc0800a0c679b3664bbe7c411785e769f739fb20fa
SHA512 9cc4eea806c6cf047df49f2a07ce92dc566dc271b9cf1f70c21081266fd8eb0a5ff1e14d6fcd2b1a17b420e0ecf56e2da4793d8dd121e307aaba7319aef231c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92bad8c7f2e02847073fcd4b6a00cf9e
SHA1 7b50e39707f430f19ec613890ee68538efa2be4f
SHA256 98111a996991105604bd8755ccd4aa5f726be526246b3f7dc51b3ebb8120759f
SHA512 07b21294938528432698808e730384c4d27abf8ac8d91c6af621f59af556f25a8da999ba3e8a93c64a7c1c9973960caf1a73c82aaa467ade9e287d9c1880c0a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 98b9a02bc03321d5cbddb8f60e7acf3e
SHA1 a8513e06438be4e6cfc883d7b27f68191666d5d4
SHA256 8e3eff089165f7b224ad5bb973ac52d0a648a3cf55d482fcbe1779bad4f7779c
SHA512 6f4545172653b929e7ecb26a49297aee8d46a539581883a6a7fbc202969c9f84e70da194cec459990f88f686cf5ca8295d95fe939faf09d9f280902f61913dcc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e345ae764e38231107ba23a40a9ea3d4
SHA1 bc37930f25d6753e0c1c516b07e0a51d293e9fca
SHA256 4987337579d3a7416fe1c49739a7420ab7f7d0932f96b2e3933b880ae16855a0
SHA512 8ec7e6d76268aa671d21af0cce4ba751d31aa20bf1857d8d6f94e5ca4bd4dd187d436b95cb6dd21718b4d43c40c6c9934ca28bfdff10fa1a8ae73bfea3620330

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e0fb53a888d2af2a06242e88d7b02df
SHA1 5c5b4a71300ec23fce95c5120f246f4ff9aea2a8
SHA256 7ea596d42a21af850b59d88bda57c765f4813bf215dc62fe04907834c432c9f9
SHA512 852029e492f7d94bd568ca5a72f1b2fa6dd0f04b99ddd7d367a333b2b6870f3545809a86b8e48885598ad29a9a4c72132d4f769f1f2ff62a886ef85893e9b016

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19858453757236b3d691c4506ca22094
SHA1 2b4bfd5d39c0c110e2d5b45c0397fcaf76c4a9c9
SHA256 a50d592ccd5f0669deca637a1c5c3897dfb8958cc30974feca0bedfb526b3642
SHA512 048e0b94cedcb6cdf2a7a828fc21eb0b38c281081ae24a28f7eaf92a392fed6ef4f3d8240ce7755757d45f141eaf5b51c30a756b226629e44bcb5e9253921b7b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\all[1].js

MD5 9a802f9166ac036ac106969ca9cd6e96
SHA1 ed57d500169442159dab6337d95a334f74ff7b42
SHA256 cfead7fbcc04f99816db1825870970d55f9020e84a055072c365a18d715ba98f
SHA512 30ccaa2af26dfd0777d2803ff5d353f867014eb25bcb8a330ae86513fc877cb6ad54da0f4ae4d128a958540fcc50c46dcb9e601fbdcbd8a46b240e7792a21b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7f1f0409ddfcbb995c6ea654614457ab
SHA1 ad2bcf93e5edaea5941ecd37a3bdbc2b2455a174
SHA256 7064e0017dca565065f84027d36ca4852c52a04049bad90381d01b4daff769ce
SHA512 148f293e33fd9749d64eefe5817a333e04710ec8de3e5b6f20adc27ed7a073d7f38f6af5a5f87c6bccbed5e76efe29f1c58b15ff09d153cb92e822a5221ec9d5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11058f733d22fda25ffd54e93e7fff15
SHA1 5190c412fcca49c966f8fdb44d13a7992e79b9f9
SHA256 be7e8cfda532f29e73223978b0616df72917fad1a37d78c62ee56a7a007e1cfa
SHA512 30b70bc3bc2b6cdcdf97d3cda989b40e4da537d33a1f371a632ca3b6baaf7422814d826a68fe6b3ff7f401a5308e1d7e4dd09afa05c47cf101d7de2da9337650

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\cb=gapi[3].js

MD5 4b631ff88bd736ff7ee1d027c647d328
SHA1 0ccec46ba9b399fdde5cac07e68d87165a144ad4
SHA256 7d1ce7035000d38d825e3ee7cf8d8eb6971561154ff5d48fc3896523074a8601
SHA512 a3aee28a91b3cb5d9b1c99d0c4a51abdcae5fa486373de02233ea0b947aba3052c1cb44ee66cd92dc905680e5568232e1edc0608069cca94602748f406163087

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ade0082fef445418194e2d7b5c784ae6
SHA1 86910704cfb8b6a61c914202bfd4b8d8afd93c6d
SHA256 b3bbf57f32afbf8f7d0eb9cacf3bb79e8c3084f374b3babcae49b661814e405c
SHA512 9c0fa594e6c10eb4f4546cf5ba9e42ca54e8ac597bf5bcb1fcd5f3b3de75ed36f1a322f3576e200a83e31d3def6691a3da2e4621772328b1e311de34d83f9d9f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 47b9238c94f2eb2fbb330bc10a8a4184
SHA1 ccaecaef2c55796067e6710ff3fa73f5e6d69623
SHA256 05736ee715277962bd68a6a4dea1d271cef72856d1fb5da2ed9fbb44d6edb7cc
SHA512 840d09871a450be845435ccf79e9433ada17fc39bfa774091dbc5491cc60e14d6467ad1a1ede9d6d3681c700b33db3753094736a53a64d81485b3aa2f45267c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c77cb0fa5205bdfe0c17cb4097ad170
SHA1 38f3d0862487135431977d03e2cbf4806b1564a7
SHA256 0fc2f233bf5621e1cffb17fddb034d6306b3d7da884b34818fcf6f94f91cd123
SHA512 f02193056fcbb4d584c30276e80d426b59de92ca3c40817562cca52b0e172b97eaeb0bf9e5780bd04ec2caf092db6b37573e0af6b1a72f061a844ac8608f1bf2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ed2552f7d7dff79257c3263044dc1cb
SHA1 0bdea43a2513828326f15244ab8b4086edbd6aef
SHA256 f562846823b8996527a5e757f7e043a58113cc618c5a379711734afedd3f986c
SHA512 54606c8991dc10dfb52a03e89a9217da69c520fcf927493c5ab684a1e31ae4cb5216f666953a725e66a5d9da34f79bc61b0e5002d227847b18fb44774fc1e0d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f51b3cad5c124ef1db3411f72e228981
SHA1 7fd475d4b637e81095572130cd9565eadb21e98f
SHA256 15fe227e725d1b6ce306268714c9729581523406523368e1ba9048dc8e6c1fae
SHA512 a8c00dfa33a902d215f7c8b57c53aaf6afecc932b23966e2bd823e917092e1d6d9cd5d0da29646de06551976584b8254bb69a11c46c6ea294402eaf8b0112512

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 17b19a029310fbca45f9169b277eb2ba
SHA1 ddf60f0900f3c879ff7d4771c6e9e3868e36bf66
SHA256 9779fb6172aa0f0ac89ca8ec36d78fbd25d1ee2c17f5aef79667992af39e2265
SHA512 e699ab0d962f2d3b113d9bd358c0f91d0acc5d4f57f52a3e97ca0ca90cf93e3e3d30a36529a201f4d2350b12bd4ddb085302ec34bfe54eb1f288fc4a03c59610

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 43448f097e517c18dbefdfc6e01cf269
SHA1 07a48c8323fe8f08eff2b9c21cc67bcdcf5a2dfc
SHA256 3bbe793c17d27192ec62a07f97188be0b947937756cd7fa2297ff7f2bcb4aeca
SHA512 262882c2da8e8dd0d095864ce7ee61bbc449cf9b62e68e3b80fd00ff92d0bfa544d114944dcc24853f698e37edaff859c9e9d76386dcccdd4d73e27ed86d9551

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2259885f0c15643234d71b745433d144
SHA1 5fee86c5280c69fe8bae1300a6f6ee722c9f4fc5
SHA256 3ef0b92e6c8bd57d34ab06c176b7c48e7d73e7f72512a040ae36213310843fd9
SHA512 287723bfe9f4da6c141ecc2f95f5dd8b3714959cfd9552c273dd65efd0c4718799572cfa60f0b9c1e4b14bc3743ad182a69a46095a1c2827ab94616867550b36

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 ddf297f63ac50ba328a72ef2d6b065d4
SHA1 6a57c1ee2a11823298a011c6ec626cb7a21c59c1
SHA256 edd84e5e13205045aa3cfc9be3b67a6569e5c973ce8b55b43751164ada739a01
SHA512 52575c0e18f3e1d831ae6f26358b756f4d6b60b4e4ee0ff28d973910ebfdd8ede520195759e3624a3bcf5cd19a462237503271653fe914d3cf3e113338d753f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4fddcd10477a91b2f349954b2968cb9e
SHA1 810893a077c63124b31617b1ec11a6889c60126e
SHA256 0c3746b52e7bb73807b9cdf120efa3c441600d73bec88a670eb847a9cd2c8ecf
SHA512 969df958d2609a6cbd1195caf8a73b6cf1659dc5278e854a6db86ecf16e6948452a41b7ee739b0d23e402edb26bbde2e51acc646648d05f18d36384bf3ac8884

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\414I6U4Z\www.youtube[1].xml

MD5 5b6c040e3dfd50e73e39e60cc8f6ab05
SHA1 bd57ccc54b8cebbdb52b06f00d9b3bada6101593
SHA256 b76a4507565195d19b80aa9411d912bc4eda96026b07753da4ca8a25d3c7fc6c
SHA512 24783a2a1b49484082e5ec26cce0ebcf33ef81a49887f9fb421f4872899b73ec2063486b2e7a2e632259fb2c40f64d3ddded3b86fe7a7796a3174ec5fcfad943

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\favicon[2].ico

MD5 871c1f2e03f0d59f06d5d5262ca7a337
SHA1 546bff947a8917533e8a0ec56c689bb364e0cd11
SHA256 2fa2f956b179e8c6009c18d6e25c7bdb2b9e946ab9a8df2f3ffe35dc7244d4d1
SHA512 f86d18613ee477dffc952a4a73ef85ae3a7e87c64b03a6a88723a7c1d938cbdb8c543775d1d3196d4cd0986dca02525b989b924a0f6898586f2e1aebda799422

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z8d0nzh\imagestore.dat

MD5 bb914c82ac00e9765d62f12684569a48
SHA1 cd98126d5b4df7e155c9ecacd7d50d76d9a18e02
SHA256 dbd9c6b293be3b82f5113ac52fe9639bd1ff516328af89c8bbeebeac8b5abc01
SHA512 6c37c0e57f8fc614a606c125bb3501d6e85f7c97c01d7ab81ed677df80f359a9993af24f0897f39ea97df3e669fa8efd50025b7fce2cf71680e39384313e41db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd502643e4a51e0298185a6de97f0dbc
SHA1 0f26c0896076fdbec104be3075df3f8199045cc0
SHA256 43106c180556ae1b22bdae3c3e542c70d5cc14e373b9e58b79fafc89af1c83b7
SHA512 bd2500885d04c42e0650952d204c0e26f1a0c7272e8fe886d41fc1635fba1f740d3d6b28dea5c73ae83af01191386c7580bd6711ae51858ab2f809e8fc2e0e4f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7fd7f11cbbe7236001b9fc528f84eebd
SHA1 44cab5debc9f1a04c35258c664c36cb93f200b49
SHA256 8e96b3f2b86d0656a7b51e3a058837bb6887ac39ab56deddf2184833060d78ba
SHA512 64f190fc4ce55c394e895cd35407dc6fcc37f84434e642712ff4fd25fea6eb4138e68d803d6aaaafaef8d5a724af4e94c72a84f8ce67fc63f8d8b8931f13496e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8dff5505309fe29a04b48ec006109e92
SHA1 2dbc01fc388c34e30caffd48d0ca1304aef15dfa
SHA256 dc2f58103af92a72b0c54d3dae99a4b458e9182e90657532625e49b67186ee12
SHA512 b87e39a51f0a2b41c626ada6d08b770bde64eb9b7b60757118a4859b037f313d49ba41a03afc0d9814bf025d3d2d45e92a5e9dabd978b2cee3846d7b9452c991

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a0c0cec0e182409dac163a6b010e57ed
SHA1 eae53cb2e954a0ed750b3cb6eacc9c142acb2280
SHA256 20e49fd0b82099bbb84088afec3d7d0301959252eeafa465ba505a57ec158e80
SHA512 7ec3581346e4c555b4e3bf14627409061965223e64182ba39fb40ae08ac851d59178003d70803d48430065bd2b3ece706442b5bbf6d157d422f4d07a5ea2b401

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0a5b1c3cc5c317aabcd9242cd62f0e5a
SHA1 c157781a9e8dcb22a97c484694208daae0e495bd
SHA256 8c1b5de8cba7ce339bfbbc7a7ef046b3de492187ab83a53aa95a1284939863d3
SHA512 5fff1c3df81191e33b507d552882e77d74f4bd7efa53b45701d10ee52f32e93110170ae07e469a91b88c651db1324664a36ec272a2120c086a54245fa130e5e4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 102af38298682b9816ac4b6a502f2472
SHA1 80f5d0c6812ccf73579b6f50e73e705f16ea4b66
SHA256 5ac2305d912b810f81bffecb958696f0290824b739965f8931ee0e10e4f1b445
SHA512 fb3d73538be7d51f1955730a56ca3b70b36dbf058d4fdd3040831a156c8e2476961edc3441072ba3f7ba036185f5a154cca89454f99e28e69c5a070fd217ddc2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 36d8c83997d816736cfabca0578f98bc
SHA1 e270064940e3f41a4e33b7492e585f8c8c341175
SHA256 d6f1dc9d491a97e8ae753e06bcbe5dfe079379b949404d5a207e85433e202cdc
SHA512 05ca599a3bf39f6198e717c241caf7c0d4894a56fad75a1c0d5db4ef66d8ced896ce3889150f4e8ac17a9381179d29033a65fb9e54ba28e07dc6efe181d1401a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57fca0bc559027c30796f991eea6803f
SHA1 94d82c696b691275ab78bd1d8820e8eb25fd63a4
SHA256 a1e96ea4b385203ba9c60092d944401ddb984bb29f7335d70141e3cd998ff28f
SHA512 ff488bd3ccbe0e1784f1af39779d43cc70b35c26050b234eaabc270024fa7837167b7120506540720d79b68ed8cb90dd3a553335f6d3c5b1723168df86f916ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e884626267d62ba4e50e2a3535c015a
SHA1 ef9db05e462ce474fbbe73e9ae09da3230d0a9fc
SHA256 c1bfb39c17dea88a3fa22a81c79ad5609b9419eedd991dc4f1313c2b508bd5eb
SHA512 d4fe77c72ae39ff53b7501c5ba2c94f93b7a835bd1b0b99570b5bf955de031c61733ee6e65e2114f6f31b7a345d929cb0fcc4ba5f15a91a5568b8832e70a8b03

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a70f5e959999e416b89494930e3fb311
SHA1 968247133e230a88c6af3d0ba325709268f7763f
SHA256 c3e5931df5dabf7f9c251add20384c843f650458354d53d8627b578e4cdb95cc
SHA512 2b29b3e1b74ea04e5995e71b42b0b794acf26fafbdd6fb66d8e4350a72fcab2470d4250016253a057cfb832daff006cb6bccd1a8f944c8c4d0582180b6fde1a9

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-18 01:53

Reported

2024-12-18 01:56

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f9a3d2bbbb7a682ec3477db1dedfc1b8_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2764 wrote to memory of 4384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 1940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 1940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2764 wrote to memory of 2148 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f9a3d2bbbb7a682ec3477db1dedfc1b8_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7088 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4ac 0x524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7188 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7188 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,4268701193282025779,11979578707294415158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 layanan.oposisi.net udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 dinhquanghuy.110mb.com udp
US 13.248.169.48:80 yourjavascript.com tcp
FR 172.217.20.202:443 ajax.googleapis.com tcp
FR 172.217.20.202:443 ajax.googleapis.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 142.250.179.78:443 apis.google.com tcp
FR 142.250.179.98:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 adsensecamp.com udp
ID 103.30.145.12:80 adsensecamp.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 202.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 169.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 78.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
ID 103.30.145.12:443 adsensecamp.com tcp
FR 142.250.179.98:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 12.145.30.103.in-addr.arpa udp
ID 103.30.145.12:443 adsensecamp.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
ID 103.30.145.12:80 adsensecamp.com tcp
FR 216.58.214.169:443 www.blogger.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.179.78:443 apis.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 imemovaz.googlecode.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 andreykusanagi.googlecode.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
FR 172.217.20.164:80 www.google.com tcp
US 8.8.8.8:53 mybloggertricks.googlecode.com udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 164.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.lintas.me udp
US 172.67.215.31:80 www.lintas.me tcp
US 8.8.8.8:53 t.ly udp
US 104.20.7.133:443 t.ly tcp
US 104.20.7.133:443 t.ly tcp
ID 103.30.145.12:443 adsensecamp.com tcp
US 8.8.8.8:53 s2.sigmirror.com udp
US 8.8.8.8:53 vicahya.googlecode.com udp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
ID 103.30.145.12:443 adsensecamp.com tcp
FR 216.58.214.174:80 www.youtube.com tcp
US 8.8.8.8:53 js-kit.com udp
FR 52.222.169.3:80 js-kit.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
FR 52.222.169.3:443 js-kit.com tcp
US 8.8.8.8:53 31.215.67.172.in-addr.arpa udp
US 8.8.8.8:53 133.7.20.104.in-addr.arpa udp
US 8.8.8.8:53 82.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 3.169.222.52.in-addr.arpa udp
FR 216.58.214.174:80 www.youtube.com tcp
US 8.8.8.8:53 resources.blogblog.com udp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.214.174:443 www.youtube.com tcp
US 8.8.8.8:53 feeds.feedburner.com udp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
US 8.8.8.8:53 lh5.googleusercontent.com udp
FR 142.250.179.97:443 lh5.googleusercontent.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 78.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 97.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
FR 142.250.179.97:443 lh4.googleusercontent.com udp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 c.gigcount.com udp
US 8.8.8.8:53 www.reverbnation.com udp
US 44.217.56.195:80 www.reverbnation.com tcp
US 8.8.8.8:53 ib.adnxs.com udp
US 44.217.56.195:80 www.reverbnation.com tcp
NL 185.89.210.20:80 ib.adnxs.com tcp
US 8.8.8.8:53 icons.iconarchive.com udp
US 8.8.8.8:53 banner.adsensecamp.com udp
US 104.21.235.213:80 icons.iconarchive.com tcp
US 8.8.8.8:53 www.alertpay.com udp
US 8.8.8.8:53 50.201.222.52.in-addr.arpa udp
US 8.8.8.8:53 33.215.58.216.in-addr.arpa udp
NL 185.89.210.20:443 ib.adnxs.com tcp
US 52.223.39.56:443 www.alertpay.com tcp
US 44.217.56.195:443 www.reverbnation.com tcp
US 104.21.235.213:80 icons.iconarchive.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
US 52.223.39.56:443 www.alertpay.com tcp
US 44.217.56.195:443 www.reverbnation.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
FR 142.250.179.110:80 www.google-analytics.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
US 8.8.8.8:53 20.210.89.185.in-addr.arpa udp
US 8.8.8.8:53 195.56.217.44.in-addr.arpa udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
FR 3.164.163.87:80 crt.rootg2.amazontrust.com tcp
US 8.8.8.8:53 110.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 213.235.21.104.in-addr.arpa udp
US 8.8.8.8:53 87.163.164.3.in-addr.arpa udp
US 8.8.8.8:53 56.39.223.52.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
FR 142.250.201.182:443 i.ytimg.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
FR 142.250.75.226:443 googleads.g.doubleclick.net tcp
FR 142.250.75.226:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
FR 172.217.20.170:443 jnn-pa.googleapis.com tcp
FR 172.217.20.198:443 static.doubleclick.net tcp
US 8.8.8.8:53 182.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 226.75.250.142.in-addr.arpa udp
US 8.8.8.8:53 163.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 170.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 198.20.217.172.in-addr.arpa udp
FR 172.217.20.170:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 play.google.com udp
FR 216.58.214.174:443 play.google.com udp
FR 216.58.214.169:443 resources.blogblog.com udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
FR 142.250.75.226:445 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 chatroll.com udp
US 169.47.242.252:80 chatroll.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 s10.histats.com udp
US 8.8.8.8:53 developers.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
US 104.20.2.69:80 s10.histats.com tcp
FR 142.250.178.142:80 developers.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 s4.histats.com udp
CA 149.56.240.129:443 s4.histats.com tcp
CA 149.56.240.129:443 s4.histats.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
US 169.47.242.252:443 chatroll.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 lh3.ggpht.com udp
FR 142.250.178.142:443 developers.google.com tcp
FR 142.250.179.99:443 ssl.gstatic.com tcp
FR 216.58.215.33:80 lh3.ggpht.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
US 8.8.8.8:53 252.242.47.169.in-addr.arpa udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 69.2.20.104.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 129.240.56.149.in-addr.arpa udp
US 8.8.8.8:53 99.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.scri8e.com udp
US 208.87.227.250:80 www.scri8e.com tcp
FR 142.250.179.97:443 lh4.googleusercontent.com udp
FR 142.250.179.78:443 www.youtube.com udp
FR 142.250.179.99:443 ssl.gstatic.com udp
US 8.8.8.8:53 dw3mgzt87vzb4.cloudfront.net udp
FR 3.165.112.155:443 dw3mgzt87vzb4.cloudfront.net tcp
FR 3.165.112.155:443 dw3mgzt87vzb4.cloudfront.net tcp
FR 3.165.112.155:443 dw3mgzt87vzb4.cloudfront.net tcp
FR 142.250.75.226:139 googleads.g.doubleclick.net tcp
US 169.47.242.252:443 chatroll.com tcp
US 8.8.8.8:53 connect.facebook.net udp
IE 31.13.73.22:443 connect.facebook.net tcp
US 8.8.8.8:53 155.112.165.3.in-addr.arpa udp
US 8.8.8.8:53 250.227.87.208.in-addr.arpa udp
US 8.8.8.8:53 170.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 22.73.13.31.in-addr.arpa udp
US 8.8.8.8:53 d167qii8h0pw75.cloudfront.net udp
US 8.8.8.8:53 www.facebook.com udp
FR 52.222.196.33:443 d167qii8h0pw75.cloudfront.net tcp
FR 52.222.196.33:443 d167qii8h0pw75.cloudfront.net tcp
IE 31.13.73.35:443 www.facebook.com tcp
US 8.8.8.8:53 d33tru5sm6wy0x.cloudfront.net udp
FR 18.155.128.195:443 d33tru5sm6wy0x.cloudfront.net tcp
FR 18.155.128.195:443 d33tru5sm6wy0x.cloudfront.net tcp
US 8.8.8.8:53 35.73.13.31.in-addr.arpa udp
US 8.8.8.8:53 33.196.222.52.in-addr.arpa udp
US 8.8.8.8:53 195.128.155.18.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
FR 216.58.214.174:443 play.google.com udp
US 8.8.8.8:53 platform.twitter.com udp
GB 146.75.72.157:445 platform.twitter.com tcp
US 8.8.8.8:53 platform.twitter.com udp
GB 146.75.72.157:139 platform.twitter.com tcp
FR 142.250.179.98:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
IE 31.13.73.35:445 www.facebook.com tcp
US 8.8.8.8:53 s2.sigmirror.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 142.250.179.98:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com udp
US 169.47.242.252:443 chatroll.com tcp
US 8.8.8.8:53 e.dtscout.com udp
US 141.101.120.11:445 e.dtscout.com tcp
US 141.101.120.10:445 e.dtscout.com tcp
US 8.8.8.8:53 e.dtscout.com udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FR 142.250.179.97:443 lh4.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 grasakfuckaudio.blogspot.com udp
FR 216.58.213.65:80 grasakfuckaudio.blogspot.com tcp
FR 216.58.214.174:443 play.google.com udp
FR 142.250.201.182:443 i.ytimg.com tcp
FR 142.250.75.226:443 googleads.g.doubleclick.net udp
FR 172.217.20.170:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 65.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 damncok.blogspot.com udp
FR 216.58.213.65:80 damncok.blogspot.com tcp
FR 216.58.213.65:80 damncok.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
FR 216.58.214.169:443 resources.blogblog.com udp
FR 172.217.20.202:443 jnn-pa.googleapis.com udp
US 13.248.169.48:443 yourjavascript.com tcp
FR 216.58.213.65:443 damncok.blogspot.com udp
US 8.8.8.8:53 coepoe.googlecode.com udp
FR 142.250.179.78:443 www.youtube.com udp
US 8.8.8.8:53 s7.addthis.com udp
US 8.8.8.8:53 nwidget.networkedblogs.com udp
US 8.8.8.8:53 blogger.googleusercontent.com udp
FR 142.250.179.97:443 blogger.googleusercontent.com udp
FR 216.58.215.33:443 3.bp.blogspot.com tcp
US 8.8.8.8:53 fbcdn-sphotos-d-a.akamaihd.net udp
FR 216.58.215.33:443 3.bp.blogspot.com tcp
FR 142.250.179.97:443 blogger.googleusercontent.com udp
US 8.8.8.8:53 connect.facebook.net udp
NL 142.250.102.82:443 coepoe.googlecode.com tcp
FR 142.250.179.97:443 blogger.googleusercontent.com udp
IE 31.13.73.22:443 connect.facebook.net tcp
FR 142.250.75.226:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.147.35:443 www.facebook.com tcp
US 8.8.8.8:53 194.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 platform.twitter.com udp
NL 142.250.102.82:443 coepoe.googlecode.com udp
GB 146.75.72.157:443 platform.twitter.com tcp
US 8.8.8.8:53 157.72.75.146.in-addr.arpa udp
US 8.8.8.8:53 img.youtube.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 syndication.twitter.com udp
FR 142.250.179.97:443 blogger.googleusercontent.com udp
FR 142.250.179.78:443 img.youtube.com udp
FR 142.250.179.99:443 ssl.gstatic.com udp
US 104.244.42.8:443 syndication.twitter.com tcp
US 8.8.8.8:53 8.42.244.104.in-addr.arpa udp
FR 172.217.20.170:443 jnn-pa.googleapis.com udp
FR 172.217.20.198:443 static.doubleclick.net udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
FR 142.250.179.66:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
FR 142.250.178.129:443 ep2.adtrafficquality.google tcp
US 8.8.8.8:53 twitter.com udp
FR 142.250.178.129:443 ep2.adtrafficquality.google udp
US 8.8.8.8:53 66.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 129.178.250.142.in-addr.arpa udp
FR 142.250.179.66:443 udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

\??\pipe\LOCAL\crashpad_2764_XQVVHEXZSVNLIWAW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e288b41b8d06e916f57f1e08573d08bd
SHA1 2be68a94906f4c82d824532af77bf01f87959b8e
SHA256 f4a927939426e016ab2366d87fc36464b4062d89409d850d23f8918a6273df69
SHA512 37629cd79a5108e06d65bdfc1f58336f8290f32d3a4509c79f1a91b93d20e8400f32c60bc6a55027aaca0aaa799a60fa0a1b4cd2abfcc20397c530996f9f33c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e4de953ca25e87c49f5729da2f427863
SHA1 861e3cc908ed020f04cb0022c35f5345d2050bf9
SHA256 5855b63c80b78564ea65a538ed9502812bb5d02cf7c1d98acde5c4d2412738be
SHA512 34ba6a3938c8bad64d2dfc4528b6a11271a91b5d37ea0c1e042b1eaf3335ccbfabed213fabb5bba070fdf25b06232c3811b410d05a5ff4fe1eb998a02367ce9c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3da37c73971fe065561f55bc73fd901b
SHA1 a346ae27925cca084b039035066ae4130fdc352a
SHA256 913ae11c285f7f34e6685b8f4232b2a0393a8bf75f23799f36047aaa7fc5c591
SHA512 2323fd00af5691ac3c5e698234da630816ec1ffb04cbc90aac8faaf04436329dd20fb16d961d527ffee513c149e23521f26cd3a08b84f372fbc3e68b49ed817e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

MD5 2ebfdbd309ee762211b4a2ac39708c4d
SHA1 b002922c672dbe1dd4caa02af24d0b1e7da616af
SHA256 54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797
SHA512 d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583505.TMP

MD5 c16565c5e040d99269ee75a2d06f1951
SHA1 2056a6e69128e701921eab779c7ea0aebed1ae1c
SHA256 fbdce47b94fc7e2bb32b03302c4d43bbb25a89b89536fe5af585666a1313f74d
SHA512 c368868d8d4cf92b516aa5f4af432439f7daf79bc4cefe3ceb6987d50ec0d69f2efd7b98e2814a10faede3a945e021d601743bd7f527a6f19aa3b6c13e6cf177

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\03a0dbfd-7fb4-4243-aa09-aff4d3cdebc4.tmp

MD5 300c18970935aabc2766f731344efc9a
SHA1 672599e880c7777ab62c645825b5c54e936f65fa
SHA256 7fe5c97eae527540590227a005bd46ed5bc8402aae62427d27201faf76e68064
SHA512 b9cede7ecddd95cbd0fbf1064d18d995a15305d8827b07e10750a4ba28223c6a2e1d5e6df7acc1e0c23188ce43571e8fd731db295cdd2c6e7f439ffa888de380

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 2091bfb124e86a39302a4fe321d2aa11
SHA1 801db57d61d9d259c16e7214bafcfc329d3fadca
SHA256 f5ebaa95bec11ab0dbdb9ac4b637d7286332814a592d43703c571464262b07a6
SHA512 f89d81ba5a5c495c08b70f88950bae791ef925ece58ddca758aacc7e5497483c43c82f5c61cac951a11b59799a4607903eb6b92c5bd896f6b592ed12b993d47e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 eee560b5d951295c5e2648d5f0159619
SHA1 2652fec3eaa3ea04cc9c5a938cf43fd5a9a3644a
SHA256 8a841d4ae11eea4f23499039d52970a4e5b2b5842ff7ab842cb9afc9661efde3
SHA512 f63aa2f098d68c31e20f916097e8ae2ccaf603c822d9a915524601a9f64196e04aaefb8c22c458ad0ae6dfffeb3b1ae18e41a0d40f8c857d316c4c6700cb14f0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 e627c6652295b66c523a46c0b579bccb
SHA1 63207617612a0956c7cf1854978db945866fd1a0
SHA256 6e4907e8d639c255e71d07f70a0d6aee9ae0b5ce9723df6897873ca9cfbb0e76
SHA512 dc665130c42ef5d933c844950e8775bd202501c87b1acf38e4276f7d6fdd137af3e61211f750762d1001dcf76de8b937571c4830f04b6348c9943b49b9922951

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e81d697917ab3648902bbbd8aba0386d
SHA1 58bcf7a5204a97a77dd320d6eff0204d45148114
SHA256 8bdb20b4a5a0bf09b592735750b4981975bbbf11d65b262d7a06864efd91dc52
SHA512 1b399c94c41b3187957ce4c722f776a001df92a13288e17fc1f97cdc86200721748e4ac57f79ad9146a8b93e9631cd73a3f48f00f0d40dc617af6c04dccb6e94

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9c68337799db8e068e9ddffefa241f5d
SHA1 eb15a1a7ac64e51ab0ad429dc09fcafb0d7c40b6
SHA256 03ec7a82ecc0caed532c40131b5baae6b83afe27a16680b2e0c215bd22fc16fc
SHA512 a3f5e3b22f93daa3838e4ace9c449f0cda5854437b704839841c74592170dc77ba657b5e443d35f9f7e5b94622299ccbed7bc5830b577345ff498ecc5b4f7599

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5721aa1dbea5cda13213b88603c6db3d
SHA1 f39290ceb55eb71416a0b7e3a5b2cae4b78c9e27
SHA256 f3ad36aa582cb5bfca0878aba145646ced9cca6dba5ced0641de6a1dec03d460
SHA512 20079a4f5def56887656c57e0e090a9be4c3dc0533f30f6fe4fe2c153d04054aa270ef34646feaf6e6c7ea0e0e3c36fbc1ccc2d26936366cced80fe2bea45c1c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 339ce86a0b7dc494b91de3947fc0ed40
SHA1 f30fd4d858b5b289e78f2940c509b1289f28d6fa
SHA256 5cbd6e7d7713deb029ca5b7a45dc09fbedd108cb39b0119f309d6cce32c353a3
SHA512 fb905ad595bd808d31b2248d3005739fefd9f4d5ab63fcab637e6fb652d8872a3107f7dbc3cbee65679de789ab4ae5afb653f07956ecb7e0dbdd3df78aa2531c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b18fc60d3ba5ffd9a6c4d70cc0a1e7ba
SHA1 b08e97268a5705f08bc92ce8ee165b852c820515
SHA256 fb50bbdc28b13716946abb80028ab8565a8c6fa3b0cedc1b78677386eab17d7e
SHA512 c00b65139c0377012f79b021e48fc88ab2297b639310011278903b20bac42ba5b8e46776c8ddacb6db7a0a8517a933097050757cb49711e119f95b1fe236b198

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 53dba2e33389eb9219055bff210e371c
SHA1 880d13482f7aa8fb8765ea793d22b197bc2ca601
SHA256 494fe5b73c3a75cf84dd8dfd0b0bdfd384504a8a0ea350b2fd71ba9b112e1fac
SHA512 31bdf914c506b913d53eb9f3d2931c81fbf67aed080da72c9ee6f0257f578cf965bd42dd9d9d910e5bc877a4b773b7bb286f03e00abd9d2f30c98878cd97d06d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

MD5 7ca090d5f0c1a9e7d42edb60ad4ec5e8
SHA1 7278dcacb472ec8a27af7fbc6f8212b21e191042
SHA256 4039fef5575ba88350a109b2c8d9aa107f583acb6cbe2ac8e609071567c4cc76
SHA512 c4f2d23eacf74f87de8dea6e4532b120253bb9ad356341532f5e1aaf2ce90d137f46b50df7de5250bce4eca1fbfb74da088accd7c626fa853dc524abad7bfe8b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

MD5 facee74c789253ce2d2a63c6d49aeb94
SHA1 79b895ffb82ba8363f8a67f8380cd6f32a5fb907
SHA256 804c9c6d6384db9e246de900d22b3f4d79a7265bf42ba72513d3a060302b3f10
SHA512 4a1078ed20af2a83f3a3f1893f4f1e6c5f94f8608ad85c50ae232aff6b8eb931167c082ce80dc51da4f116e4cff970571b2d51234f9777ead0d5b9a5de4fa8d4