Malware Analysis Report

2025-03-14 21:43

Sample ID 250110-dqs9wasmdn
Target JaffaCakes118_d96958e906d6cab2973e49241b5ac729
SHA256 1faac4cf8ad8c5d3268daeafe61510c7a5a5922819867cc97a4e05cc6e8ce0a9
Tags
google discovery phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1faac4cf8ad8c5d3268daeafe61510c7a5a5922819867cc97a4e05cc6e8ce0a9

Threat Level: Known bad

The file JaffaCakes118_d96958e906d6cab2973e49241b5ac729 was found to be: Known bad.

Malicious Activity Summary

google discovery phishing

Detected google phishing page

Legitimate hosting services abused for malware hosting/C2

System Location Discovery: System Language Discovery

Browser Information Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-10 03:13

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-10 03:13

Reported

2025-01-10 03:15

Platform

win7-20240903-en

Max time kernel

150s

Max time network

141s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d96958e906d6cab2973e49241b5ac729.html

Signatures

Detected google phishing page

phishing google

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c91db30d63db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb360af9620a04aab70a997bc25d1e80000000002000000000010660000000100002000000061aeda31b36c103cf8d7b3bfbbc94c55405d13dc9bd70e4397fecb789ec7de0d000000000e8000000002000020000000bfabb53f29aafb1822f868b893f4cf2e4e1c41493b62f71affed3df220928462900000006b2fcde786bd7ef7cb4518814bbf03ac59eb10ed3814569674102c2df1aebb8ffe82ba6d604818aecdabeb88eac470ec7fd65a39d3fbfe4c4a9126ec74a535eede3a7b7ec3bb4bcbfdedaa49d74713c20acc20b883acdafa51cc290401a654970c42728efc941d89a8980315525c203a2c02b85f2e885241e684b5f34e62bac4ebaa986e850a8faa64baad18a12e39a7400000005b1d6c422fc979babe0350eafc564d3d6bc1ad0824331585b32144ca75c856ae2c53302a5233a9e0b811898ed9c6185d2138b54650e201c8e028f494dc735b47 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442640660" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2AF9A41-CF00-11EF-A2A3-4E0B11BE40FD} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb360af9620a04aab70a997bc25d1e80000000002000000000010660000000100002000000065161d869afadb73c50aa97e76c574946fadd3aa6987b1136aa3dbbb1049299d000000000e80000000020000200000000b934f7134054602961c70ce1f4ad6b5b1052c716b86ab38a1df0c6ccaca90a0200000008bfa2e863651abbca56f2bd00f90299f04031ea99e3c64ba6227b80d42a9c17f4000000038d81b429211588cd172628ca50de78fb1922260bdf793fe6bb95a30a28f8b34271d5d09374a43b9101ac48cb78e46fa76c9ae8c72bd07b1553fe858d95adb09 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d96958e906d6cab2973e49241b5ac729.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 sites.google.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 cdn.ay.gy udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
GB 172.217.169.14:443 sites.google.com tcp
GB 172.217.169.14:443 sites.google.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.187.214:443 i.ytimg.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.187.214:443 i.ytimg.com tcp
GB 142.250.178.14:443 apis.google.com tcp
GB 142.250.178.14:443 apis.google.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.179.233:443 www.blogger.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
US 104.21.64.1:443 cdn.ay.gy tcp
GB 142.250.179.233:443 www.blogger.com tcp
GB 142.250.179.233:443 www.blogger.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.179.233:443 www.blogger.com tcp
US 104.21.64.1:443 cdn.ay.gy tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 adf.ly udp
BE 66.102.1.84:443 accounts.google.com tcp
BE 66.102.1.84:443 accounts.google.com tcp
US 172.66.43.117:443 adf.ly tcp
US 172.66.43.117:443 adf.ly tcp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.179.233:443 resources.blogblog.com tcp
GB 142.250.179.233:443 resources.blogblog.com tcp
US 8.8.8.8:53 publisher.linkvertise.com udp
US 104.18.0.75:443 publisher.linkvertise.com tcp
US 104.18.0.75:443 publisher.linkvertise.com tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
GB 173.194.76.155:80 stats.g.doubleclick.net tcp
GB 173.194.76.155:80 stats.g.doubleclick.net tcp
GB 142.250.200.14:80 www.google-analytics.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 s10.histats.com udp
GB 163.70.147.35:80 www.facebook.com tcp
GB 163.70.147.35:80 www.facebook.com tcp
US 104.20.3.69:80 s10.histats.com tcp
US 104.20.3.69:80 s10.histats.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
US 8.8.8.8:53 s4.histats.com udp
CA 54.39.128.162:443 s4.histats.com tcp
CA 54.39.128.162:443 s4.histats.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 88.221.135.105:80 r11.o.lencr.org tcp
GB 88.221.134.89:80 r11.o.lencr.org tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 104.20.3.69:443 s10.histats.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.157:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
CA 54.39.128.162:443 s4.histats.com tcp
CA 54.39.128.162:443 s4.histats.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 18491453fc2fd2cc3ba0c5bb6b4ebaa2
SHA1 dc8cdd263156146f57a4ca90229048eaeeed2e12
SHA256 b4a370b2c78d2526d642cf0029d90aaed725c7ea59c5b7df33de830bdd5b8a9e
SHA512 3cdea648ee88867d041ff0538b0394953d400a48b4b5ccd26adf737083dbf44f3781ea88d3ded0281757e10b9004118a682e9af29052b28d3a2c6d7649e97832

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 5fc6ec83d0ce1616da8090e121e5fcb4
SHA1 a1dc0c7cf0a8ae298a4434a9036f7ed03adbed89
SHA256 48987d21a25b7b95886240c9f7b2addf32fb430e1b23b02e859bd0fbf7b63224
SHA512 0cd9715bef597a108bc2cbe023ea4ceb5f21eaa2f84e2edbcad9b2e8ebbce32b441504ce2e418d84a5bb07b73090072de7d18ae3376dfaf507990ddeccff8945

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a6344d20d86df78079d49bdf68cba0e0
SHA1 c64f9b93a5d0a92379337a70f9d8ffb7ecc77b71
SHA256 d428b48c7602249d84291431214031b997a5cc291f8592610cc1b9a30bcd6da5
SHA512 0b9870136ed3763607f3151778a6cbde415fc5230fe0c69314568749de632ddb22634203d95e4189ca9de1444ec69453c1f60a97b9d2aeaa425256ae52e9b00e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 8ee221fc1064b233484c3f7c5235b21d
SHA1 f49cd89102234fa1ab9a112a6928d3f2a0993747
SHA256 b77fb95c91e04f6db2c030c0eea6e6f5f4fc22527eb64e4b8f88b7ba5f8cb851
SHA512 c5160a6865fe53988b7cd156de9ae54365fa6bfed6a960604f25d7928f5cba9d7454ffa5810450ee9794ed112d8abcea410e01c83b7ec7aeecadb24d1bb24003

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 a0487189d5f2af3530af6c1fb21c56d6
SHA1 c0433df6695230eb2c65b3502763b97551a97d77
SHA256 dc9674942e474f566eb1f2b932ac1837a1e63f6580b84d34d0f0b75009f4743c
SHA512 b2832021b3583243d6848dbdf4b3a3144c08abecc5d852b93cc1eb434d6f7b7b6d0a2792f475513c66d7cacee2a845b1d0de6c7145fda035884711a7ecb37bb5

C:\Users\Admin\AppData\Local\Temp\CabEADE.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 1124a1c744138f1a63d4ed0699bf3761
SHA1 8464ba0d13fd089b346e07f93fdf772937360da6
SHA256 2fc83a4802b98c01f7a3a56afd7c0037e276124f57b1301a35ac56fbed00322e
SHA512 1df2405a2dc74a7fe36e919af6e02aff487d2f313e5dedc79b05ef443105a78208174a4b0463a756d10e3c47d936b99465e7873d02b52430f897cdc71aa7dc0e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_DFB78462C65FAC2750B89E1A8A1F9A53

MD5 49c9f12014d8f3d433b090048e7e4fb4
SHA1 6f9b6242bc9165e012e09fd3ea65753780d2c8e3
SHA256 e4afdd47f9a9fd68d1431bed1a737a0c9de974df8086a93df80b87942b991d1c
SHA512 1b34782341afb1e676e27a018415b3f860142efa9e2f08a4ef74077a612e59c44f2fc027eaa34289a70c79380fe62aed1ab49d3bba8020c3572288a6abba2a41

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_DFB78462C65FAC2750B89E1A8A1F9A53

MD5 448fe5f76a909bc1299d42b10e2ea376
SHA1 769ecdea5641f149939b94ccb8ba04a84ffce42c
SHA256 ee85a9034e47062eb66c5047e0793be7e3010ce383ffa8f628be0d1c89fb3634
SHA512 4be280bf1f36103c223526a5608def81921a60043f080492594736599fce4ca66e471995c84b770b5e5c0bfc3937c5c6de145fb2b8ed5f5b62e157c91b0d43df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_DFB78462C65FAC2750B89E1A8A1F9A53

MD5 8377e945af5dfa56e8d7901c984babb8
SHA1 b6afdee24f70d21f0c07b704ecaa3129156e2c6b
SHA256 459bccb899957de6ce39f5d67e800ced58dec08bca2d57c3a29fc456cc59a314
SHA512 b66d2ffbe8d4e165eaa35a877dbd9c08e9e65b329a552c0ba14f11f3305a5c161ac1e16a6ae3a7539812c00446888bbb4b79352e48c97843927b9c7ade18baf6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\ga[1].js

MD5 e9372f0ebbcf71f851e3d321ef2a8e5a
SHA1 2c7d19d1af7d97085c977d1b69dcb8b84483d87c
SHA256 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
SHA512 c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\plusone[1].js

MD5 06f5699c1728d6915b166fe908f1f479
SHA1 6fe929111f9715ab4b3aab9a940b6c3908250761
SHA256 3a0414e021f7b69d5dfab91563b7b88d93d0584c26a6ba4d7614e642ba774a03
SHA512 9ec15f17e0385a767bbd51206d20185f165124acd2c64f571a4d952aaf3dbf262bc51e27ff364121aa7dce24aa805093d6da2d93311b3df693a3ef4e5e4b5fbb

C:\Users\Admin\AppData\Local\Temp\TarF156.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 206252ae35a36d5fa61b6fbdbda20d2b
SHA1 b31b17257f0a16d687daeaae8f58e00c86d7c2f1
SHA256 bce89439e8c2b82652c974b177a3b1104e47683c4ed2df441a7d1f3d10d67b9d
SHA512 13e95d9c0d8225f1c8c6d0aff32bde4b6634d951ebf8e77ffb9c48190f05cb84f943d347174d6d9b28949751f131f35eec70d9b75d88ac1a104cc538b7ef2ae2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 10fecb34704c43e7d0546b6d9a6ce3b0
SHA1 b1051f2700c964a6f8a38ee70995603a557700dc
SHA256 7ac997d15485f54e4b79326d8249b4a88df97ed3c6f56f881ae4696f4dc020cb
SHA512 beedb5929546863ed69f90998caec335b2290d2a6bb201d9f6864f1ecbca90dad056e6d111e7563b992964fab7420f285b697f760c17b03441c8cc698eaef3fa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\m=_b,_tp[1].js

MD5 8e974a1c8adf8ca30595885c9b523063
SHA1 b1df5f0c61d470270008eb435835d49bdd38ef55
SHA256 4292b7548789ca2718f56298836b37e50f39b94cf74ef2002a973bc5bb98bf3d
SHA512 0ec3a7c5572908e3014003bc418fce9cdfa6b7965c4c3419ab6e1a48e972e3ca191cdda1a5f0a4392c4a7605b6d178e6420b2021033f805fd9f7a009da5da496

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\m=VXdfxd,fgib1c,YwHGTd,pxq3x[2].js

MD5 0212f84f9b3c279098932d83a43b6448
SHA1 22ef0e934187e4a4bb70bce5a59e7eed3e45e82b
SHA256 9dffee8e9e10ba5883b18f8f0803e06bcdd3751909cd3a2ad48195a33a4132c9
SHA512 846ab48914f0d202bea88b83a3c81772dcd4a1afa47d3641fc8be2649783441def213b18d1fa82e58e0a3b699592d2be8421c6adb02c0d7f679f615b378775b6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\TDV9HG77.js

MD5 8e3ba669c421e761e60eba68f5ee948c
SHA1 9e42c2b2b44a57d5d4c22cf4d757f4f94f5c37df
SHA256 ca9dc915515e1173eae06f352f983247bcb4480c60ed3b7bbd98e0e58f5a6e31
SHA512 9cc1a4f0879511c959b871fddf3743793fa730cb7f89f27828b6b0c29db560e486b3828f421fa3f02262da490122d75573356ffc86c00cb3d56f0c38e72bdcfc

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\recaptcha__en[1].js

MD5 19ddac3be88eda2c8263c5d52fa7f6bd
SHA1 c81720778f57c56244c72ce6ef402bb4de5f9619
SHA256 b261530f05e272e18b5b5c86d860c4979c82b5b6c538e1643b3c94fc9ba76dd6
SHA512 393015b8c7f14d5d4bdb9cceed7cd1477a7db07bc7c40bae7d0a48a2adfa7d56f9d1c3e4ec05c92fde152e72ffa6b75d8bf724e1f63f9bc21421125667afb05c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e7e1ff2b0b97d4721da41a6455aa5b2d
SHA1 30d46b5a69f1c48f901f1fa6082d5bed5aec3873
SHA256 4258d9996508f37c2b699d5f9ed85deb2759ceffc2db9363a56ee91ea1f35e10
SHA512 ca89240c3fcb62c00b7371634c96fe5908f3ff7cb819b91d6dcb2f03d56c1e2dc5dae0c92da04fd1df4a8ebb95dc6414c42e9fe7677590ed2c95a35adedb1327

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a04dd5679cf1c2e7581f2a4488feb2f
SHA1 c1b4c59d059b9ffe96a3ae056f282e712953737d
SHA256 15b443fbaf0bae282d2eab771648560b622f7f044c5d4e3ead5b03a91c3a2fb2
SHA512 7e65f4c0bec420196735adea60302dd796effd5673b56ae1dfe1e8e468ef626f27f9dc643adafc1583decbfc062aecd33ab54447e4cf5bd5374e22de036c41a4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e3df9653e214f4725e0536ce5a7cf4d
SHA1 043ac48ad08f46861b9cfb00facfe798d03973c6
SHA256 0d3273120a3ce53b7f555ab35c80206affb1c55215c259c333bc3caaf6b09753
SHA512 3c737a48044c10bc5e5e3d9ebf07e2f08b4323c3c83d21a729cd10fae2c874a90c614f1405f4075238037909197e0df0bc3ad846bbff233c302dbc63b632bc3c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6aeef7d4a71c4b3a571a3363ca34c463
SHA1 74a6f8cb2b6c9f81f469a468814f6c7c5e9057ff
SHA256 eaa72253c02223ce509af83083f22814e9a6a45484e91868f8d2c7a2a50a9570
SHA512 c14985a1ee67bf63956de2067b22340170de06059303d7d23e19e6dcffbac4d7ede15f9b1320a7a7c3c01dfe89951364c2606a9a6b8aca56952961271a25ff5c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cbf52f0f6f447c4be292ada6d33911de
SHA1 81249a29ef0e70f8aeefb60edfd56b213367a84c
SHA256 49ee2de8ce5b3416b7f58c1cf86215f3d9c622b93c82b0a4fe1adb2caf3d200c
SHA512 56a4bcdf29f1fb08dc7725cd2f47fc88f6979b2a9463a35cdd52f4dc255eb9599008c72e05679fec02373299c0ce66e943b55eb0c86a58ea82ccb055e2d1401c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c63013c3988f12245b7fc7adc034d73
SHA1 4236c76ae5414aeceee29898e081d51aa38420e3
SHA256 227c7fd5b8d60b0bbf6bdb174fea0e11e616c2c26c98d979303373d82d604c3a
SHA512 a720af0dd1e6a7f0a6e6948b61f20f8cd99e3f27119e5f840e0d79def793252e2173b7cb262447aed9ffec3d61dccda2c1a89456d65d0f6bb5b0b20a8918c07a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a175fc19d0dd7079dd6f8a87cace2a9c
SHA1 cdd868c59a9066da49c558cc6640279fb015f33f
SHA256 0c08300511e0de01a55f712f543b1e48596c50333a59ecc9d3489b540d28a77b
SHA512 abd57ab33b5c9bb1dda70073a79a8d8326c594499c574f670ffa66ef78a0b0047eb7ac827e8ced25b08d32acc2f76525cb28f5df9e1357084d7a10711914e199

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd0058abf514b27cbdea2c0a77d90afc
SHA1 6394e95dab150435c437b68ea257eced6fae50ab
SHA256 00bc24695c63d4481de14f0a22768d54432f9f9b9b95c385ab5eebbf5ba43532
SHA512 a0fa6a70dfc88c310ddcc6f2adc9e7817bcc53011c193bc9382c86aea5f36da0443f4c8ba87d3b6889a71db59b4754e34e7bb3ee1afd791435a6fd55aaf505f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f074f8e9f60aac7e1893725ea6115cca
SHA1 e11719c6d3873e5e8a3baabfabb0106d28d33899
SHA256 45efa53a2cc98f37ac23d6b9e208e4e6cefc872012efa11964bcf7c6a318c582
SHA512 c4841065ddd33a35f2838b84ff97bbb9c5cfa91086f68b2a2561cc334ac2421eab9942f0769a7eb216e2d41027091d74cbba0de2da18f529d7f5bc13eeeb792a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d456b91fda767318c0247ad0da5daa31
SHA1 717e532feba1a926459af859b592667682ebde8d
SHA256 68651bea233cf5651cc6f6d400126fcefd99fbe2da275232b3371726860f146a
SHA512 a5529752ddb19e79a37d0fca9469534e7478d3d3ff3dbfad5472284e7d4164a22fdc5e79d3c9d52f9bd74f17bfc1c73cdd75b7b2a5b2e20ed11a485bf2d614db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e1760f7e1a34a2de6c951c79bedf16d2
SHA1 b0bd8beb94069c36c490ee258cd7a201686de63c
SHA256 9110245fb2f190771ec4cbc3dd501f36bf3d21217247c548d0ca211eb29fb6a7
SHA512 114bc2f42e2f661577a36ffc2bdfb5e7e8fa4fadc158c342286322a6acacda05235f177edaef2ac86e62bc1374175d41e27a0fac0db0b7fd90b6166611395af0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 363fdfe55f4b6fbc9a445accead21c6c
SHA1 d3a073342a9a86f98381b8b1a71dda072b2295e9
SHA256 024cffd804db13714edabc3278aa0a7ccdce45338f7bf398299d1350fbf28dcf
SHA512 ef83e72382fe01ef1bfd95fabc28c291aba51776b49262298fc0568d8faeaee47658f2c4a38ad6aea2864854e8e3a8d4acbe1b297996d0a0ef9da104cd3683fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 48fd1c87db0850e3833e86f614e08562
SHA1 1fbe4caa9e81aa826bf8dd7cfc533d495f956686
SHA256 e9b8fe97abb0dd77faeec81305795a84dd0b36005c7e2c9a3fd3c91a5a79fb85
SHA512 b4ed0b7e4c607278e8f97a1f88a21e2a6741ada550589241943c68b6350cb0fc2dd3c9cdd5502ba16fe7e09a7909e63fc99f60349366b50cb3ba2171da09d191

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b178f84985ef68f689f3e1c48f3ae9af
SHA1 58ef7492c2b0b7d5e70acb2dd33a9bff71a1d5f3
SHA256 3655f1f78736f9e2309298b3759ca1d879be6ded222c5a9226231a7f42885630
SHA512 3764a3b156d50193f872bd2a56e5cbac591ba9ed6c43fe0b520529060bbff0d955497200f9058bda22bec4d3bf1aea28534c29c50598e34232f8bab7982f123e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f4764388f63337738a618127569dc06
SHA1 88f67b671c464ceb67134064cc1a90e916831c41
SHA256 ac0c24ebf7bb5a066aff29d2a904c57194c44a87c132a0c49f081ff42839e7ec
SHA512 16488367d3c2f6afc0abff40774eda44b37ca82e0836d32f2f0574980d4f8e63d35c292c2cb91a0531f4a74d89b6527f06c501f936f6d3de5140f04c53b10f3f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f10443b2ece0dcb7c874e2783c83464
SHA1 c1e2fca17c56f9a2d910d52bb4db11b403795ca8
SHA256 f2c55e9e959289d57d4ab3babb4efd6b24222f2928447de7399e6dc95ee7072a
SHA512 d0c70d602c430ac242f412da8790deefd4915aecfa5275d9e08b7f1cd31df365f26d23aaa949640b48a48d2ba80aeaae98ad655effcdc027938bf4a751b041df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c6c471451d4204702d10a316e40b148e
SHA1 46df394c825bb9d17977604fc6b21c40ede2243b
SHA256 4461c7a23530692c6ccf2d75a7e4fc3470e08834b8a7f23d9f9f6d1e33422a86
SHA512 fe276d2a4fc4f43bfa884b4fc3ca166b2ea94feb95ef14dea99b30186b29ad709196b74b7a2326ed809b747796dcd56184ba3428b0d3a495c064c71241ffb437

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 4145f87a19f8edbacf3b64a445867cdb
SHA1 664246affb676c629e921cb23fb9546413a98c56
SHA256 646386b776632cafdc440c3c2a38f4a036ccc135b647d347036be3c01ad535a0
SHA512 932a5e05764e13c56724f06fc2a87cbfde65d96fab92e49c979b12ce6aacc5ed6e650eeb648de944af5e72eb1884b725b6c25892409328afa181985ba9ab0b50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cdde8782ba38733c9542926e5daccdc7
SHA1 3730d0727951ec69e0f15426cee5e1cd19113aca
SHA256 4007fcd67d9beab541413cb8ecd6188538aafea30e7aa3f3ce2f520aa9cf2ed3
SHA512 84f6f9f419ea1c63a25ba07de87a57e7f1e288facbe4a28be7b111b458849597dd5199fc82f740802b6801b266de7801442ea240ab30e9866ff8d01a0de9c6eb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 148e20d222b4958c2ddd2d4036f6eb0e
SHA1 db6169aa4af7ebf57a44635bf35061eb7da24f83
SHA256 5d085f37c66e3d64f5a82977f1a36a4fcb86e4b31553a704798cc74189943ec6
SHA512 9df8ddb0ecb0c42bb41251753024babcd27059f82b365f91b6d273646bceae18d13a5e500034cb158dfd21b08b9fb9190336ee08b92ce63e78fd398a3a2b2aca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e50735a07bcb8bd86d2bf42a26287587
SHA1 dd4c6a9c4ae618d48ab8577b9a4e7666bdc61de2
SHA256 3427f3ca5a806e25c8f4dc74bb467390970e9d90fc640285a62b43e723c78908
SHA512 9e53f2fec8b2f6fc0ec2d9d125d4e0838a0b6e182e6878c26aac0496c578b2c4440ffefc9173e2e45d51359533bf9642ca9617be8cb96ce3fe596e36a82777d9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e222ea7df3d8ade58686df3691a3954
SHA1 c401dc454da3c5794966130a873255eaf8fb3d7d
SHA256 d78fc2203acac0772e2a4b1dbbc7d0886bf04d918d854d1a592db0ea9bea0f35
SHA512 3c5f479ae3d5024c2712551c3bb85c3b25a50bf9ac1e26d352a9e441f3f040555247ab155bd9a17de0feca567d4abe998482f01615a78f00aaaa8c64d24b5604

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-10 03:13

Reported

2025-01-10 03:15

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

145s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d96958e906d6cab2973e49241b5ac729.html

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 804 wrote to memory of 2560 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2560 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 2716 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 804 wrote to memory of 112 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d96958e906d6cab2973e49241b5ac729.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe9e246f8,0x7fffe9e24708,0x7fffe9e24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5260 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.179.233:443 www.blogger.com tcp
GB 142.250.200.2:445 pagead2.googlesyndication.com tcp
GB 142.250.178.14:443 apis.google.com tcp
GB 142.250.179.233:443 www.blogger.com udp
US 8.8.8.8:53 cdn.ay.gy udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 sites.google.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.178.14:443 apis.google.com udp
US 104.21.48.1:443 cdn.ay.gy tcp
US 104.21.48.1:443 cdn.ay.gy tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.187.246:443 i.ytimg.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 172.217.169.14:443 sites.google.com tcp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.179.233:443 resources.blogblog.com tcp
GB 142.250.179.233:443 resources.blogblog.com tcp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 233.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 1.48.21.104.in-addr.arpa udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 246.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.169.217.172.in-addr.arpa udp
GB 142.250.200.33:443 lh3.googleusercontent.com udp
GB 142.250.200.33:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com udp
US 8.8.8.8:53 adf.ly udp
GB 172.217.169.14:443 sites.google.com udp
US 172.66.43.117:443 adf.ly tcp
US 8.8.8.8:53 accounts.google.com udp
BE 66.102.1.84:443 accounts.google.com tcp
US 8.8.8.8:53 publisher.linkvertise.com udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 104.18.1.75:443 publisher.linkvertise.com tcp
BE 66.102.1.84:443 accounts.google.com udp
GB 142.250.179.233:443 resources.blogblog.com udp
US 8.8.8.8:53 linkvertise.com udp
GB 142.250.179.226:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 117.43.66.172.in-addr.arpa udp
US 8.8.8.8:53 84.1.102.66.in-addr.arpa udp
US 8.8.8.8:53 75.1.18.104.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 1.bp.blogspot.com udp
GB 172.217.16.225:445 1.bp.blogspot.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
GB 172.217.16.225:139 1.bp.blogspot.com tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.179.233:445 resources.blogblog.com tcp
GB 142.250.179.233:139 resources.blogblog.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 172.217.16.225:445 2.bp.blogspot.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 172.217.16.225:139 2.bp.blogspot.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 172.217.16.225:445 4.bp.blogspot.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 172.217.16.225:139 4.bp.blogspot.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
GB 172.217.16.225:445 3.bp.blogspot.com tcp
GB 172.217.16.225:139 3.bp.blogspot.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.179.234:445 ajax.googleapis.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 172.217.16.234:139 ajax.googleapis.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

\??\pipe\LOCAL\crashpad_804_FKYIMCWEMBQSZTDT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 77bbe505c515b77d6e7b51f27e60e2c5
SHA1 5042d18aa87e7ade58817b7174b0208a0c64c5f6
SHA256 5447431de118b35093e3119fd2157fc1c2e632b95722d05ee7206d1ffe53a980
SHA512 1551678d8399521a8c7a75b8e264a7ac9de9a9441add5630bf06314237396e6237c25b7804fe63345086e39cbb88aad074079aa976687cfdcbecf241571c04c7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

MD5 d79b35ccf8e6af6714eb612714349097
SHA1 eb3ccc9ed29830df42f3fd129951cb8b791aaf98
SHA256 c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365
SHA512 f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5aa395f7e316378b6a3524e2b8d6f49f
SHA1 4ab342db3aaf5739a4c13930f13f994eb58b7f9c
SHA256 80523cd4afc494d90dd9c3d8075f6eb7dd26195f05668fdfcd2074628fed239e
SHA512 67f2893d603892d9f9fda73b6d7bc955a6cfdde5c62095181176f6375c0f2b41c524a009b53a0abb3d07fc732241b8dd72f7202a265c3bcb7a2974d665d4501b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ebc932695c9188d7c0eb64190e5b457c
SHA1 ae0eaa6ab7f09e7251f4f70fea7d2f9c24246d78
SHA256 5860ae463f22d7d8b0d7e4441756dfb62c969d2ecee4a66c1c253fa764c783a5
SHA512 5f4bac38d945c9f3c8056f8e84f59cab7d6b4ca1b4aa52a03db2635f79edc21abd3a7be330a4e85fbcad23cd3ac7e09ffa42d1edb6fd04ef3ce7ed716f163aa2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 219127cfa9affee0609cbecb32f22f3e
SHA1 7cf43250d8317f0449f04e092d8e72eefd10bab6
SHA256 253acc75d0b1bddbcafe3a6b6b89efd422a985b8b317b901b2947067dd4cf73e
SHA512 724958217c3110a82b71ce1f197a6f9cf3187980f090cc02d55338a4cf99a296a91ad2dfff8d1254d745baf2165cc917f411d7a0fc66a0b71143d328ff529654

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 7e9488a69cb07759c64ae5d8bc2bf847
SHA1 1ee1b671b2a8ac7318c35fb36ff2939850230a2f
SHA256 466e47f66d5fcc3184ea8d8b47092348d1436278ce7a45337a62dc72375df114
SHA512 9ac1d4ff6bc04bb2e42286e29786a0801d963cf5c69c3f4785730e8221d850f0a7973b40f041c011f33d1022b69c448fe7abe82033c47d111b89e93e44b3ea9c