Technical Information
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e050e-c30.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e050e-f18.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e050e-eac.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e050f-13c0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0510-958.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0510-1150.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0511-b54.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0512-1f0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0513-4f0.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e051c-4d4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0525-da8.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0526-480.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0526-b60.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0526-43c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0526-15e4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0526-490.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0526-1274.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0526-14bc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0527-7c4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0527-177c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0527-1664.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e052a-1548.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e052c-1874.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e052d-19d4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e052f-1acc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0535-1b7c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0537-1ba8.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0539-564.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-690e0539-3c4.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ca32cd7c9a17ce9b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000015
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000016
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000017
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000018
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000019
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001a
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001c
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7e3379bb4b240cab_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\30f36fe524435b1e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\51cb048004511740_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001e
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000020
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000021
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000022
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000023
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000024
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\00bfb44da0475330_0
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %TEMP%\.ses
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'ab##7.com':443
- 'mo#####.map.fastly.net':443
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'co####.edge.skype.com':443
- 'em###.#endtonews.com':80
- 'yo##izz.com':80
- 'ke###ovies.com':80
- 'fe#####t###nawards.com':80
- 'ny##g.com':80
- 'w3######ting-nel.reddit.com':80
- 'fa###ook.com':443
- 'ix##.com':80
- 'po##gon.com':80
- 'st####rnculture.org':80
- 'xk##.com':443
- 'mi#.com':80
- 'w3######ting-nel.reddit.com':443
- 'ny##g.com':443
- 'em###.#endtonews.com':443
- 'fz###.ttk.ru':80
- 'bl#####st.rkn.gov.ru':80
- 'cu####ereframed.org':443
- 'po##gon.com':443
- 'mi#.com':443
- 'cr#.####g2.amazontrust.com':80
- 'x1.#.lencr.org':80
- 'x.##2.us':80
- 'bl#####st.rkn.gov.ru':443
- 'st###.##ghtthenewdrug.org':80
- 'st###.##ghtthenewdrug.org':443
- 'cd##.bustle.com':443
- 'cd###.bustle.com':443
- 'vi##.com':80
- 'google.com':443
- 'fo###.#oogleapis.com':443
- 'st#####.polygonimages.com':443
- 'fo###.gstatic.com':443
- 'cd#.#hopify.com':443
- 'mo#######edge.shopifysvc.com':443
- 'sh##.app':443
- 'se#######ads.g.doubleclick.net':443
- 'im###.bustle.com':443
- 'en####enge###n.org':80
- 'ce#######tes.starfieldtech.com':80
- 'cy#####vilrights.org':80
- 'cy#####vilrights.org':443
- 'mc.yandex.ru':443
- 'go#####agmanager.com':443
- 'js.##ripe.com':443
- 'fo###.bunny.net':443
- 'ki#.##ntawesome.com':443
- 'ge#.bdg.com':443
- 'co#####.facebook.net':443
- 'sl###oad.com':80
- 'yo####ainon###n.com':80
- 'er############s-sessions-production.shopifysvc.com':443
- 'sl###oad.com':443
- 'yo####ainon###n.com':443
- 'im####.valnetcdn.com':443
- 'ca####berglaw.com':80
- 'fo####rndaily.com':80
- 'ca####berglaw.com':443
- 'me##o.co.uk':80
- 'me##o.co.uk':443
- 'cd#.###lpapersafari.com':80
- 'ch####otribune.com':80
- 'ch####otribune.com':443
TCP
HTTP GET requests
- http://www.yo##izz.com/
- http://www.da####ecord.co.uk/news/weird-news/mystery-businessman-pays-###n-star-5706124
- http://www.fe#####t###nawards.com/
- http://ny##g.com/nymetro/news/trends/n_9437/
- http://www.re##it.com/r/Justice###n/
- http://st####rnculture.org/
- http://www.po##gon.com/2015/5/12/8589553/atlus-dungeon-travelers-2-###n-calendar-pre-order-vita
- http://mi#.com/articles/108552/the-countries-that-watch-the-most-###n-aren-t-the-ones-you-d-expect
- http://fz###.ttk.ru/?or##########################################################################################################################################################################...
- http://fz###.ttk.ru/fz139/?or####################################################################################################################################################################...
- http://st###.##ghtthenewdrug.org/products/###n-kills-love-tee
- http://www.vi##.com/tag/###n
- http://www.en####enge###n.org/
- http://ce#######tes.starfieldtech.com/repository/sfroot-g2.crt.cer
- http://fz###.ttk.ru/fz139/page/TTK55.woff
- http://www.sl###oad.com/
- http://yo####ainon###n.com/your-brain-on-###n-series
- http://www.ca####berglaw.com/states-with-revenge-###n-laws/
- http://fo####rndaily.com/explore/food/
- http://me##o.co.uk/2015/05/15/businessman-offers-###n-star-5million-to-be-exclusive-to-him-for-15-years-5198964/
- http://www.th#####dictionary.com/###n
- http://www.ch####otribune.com/suburbs/downers-grove/news/ct-doctor-child-###n-sentence-met-20150515-story.html
Other
- 'ab##7.com':443
- 'co####.edge.skype.com':443
- 'fa###ook.com':443
- 'xk##.com':443
- 'w3######ting-nel.reddit.com':443
- 'em###.#endtonews.com':443
- 'fo###.nymag.com':443
- 'cu####ereframed.org':443
- 'mi#.com':443
- 'po##gon.com':443
- 'bl#####st.rkn.gov.ru':443
- 'st###.##ghtthenewdrug.org':443
- 'cd##.bustle.com':443
- 'cd###.bustle.com':443
- 'google.com':443
- 'fo###.#oogleapis.com':443
- 'a.###ppapi.com':443
- 'fo###.gstatic.com':443
- 'cd#.#hopify.com':443
- 'mo#######edge.shopifysvc.com':443
- 'pa#.#hopify.com':443
- 'se#######ads.g.doubleclick.net':443
- 'im###.bustle.com':443
- 'cy#####vilrights.org':443
- 'mc.##ndex.md':443
- 'go#####agmanager.com':443
- 'js.##ripe.com':443
- 'ki#.##ntawesome.com':443
- 'ge#.bdg.com':443
- 'co#####.facebook.net':443
- 'er############s-sessions-production.shopifysvc.com':443
- 'ma###umbs.com':443
- 'yo####ainon###n.com':443
- 'ca####berglaw.com':443
- 'me##o.co.uk':443
- 'ch####otribune.com':443
UDP
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK co####.edge.skype.com
- DNS ASK yo##izz.com
- DNS ASK da####ecord.co.uk
- DNS ASK yo##orn.com
- DNS ASK fe#####t###nawards.com
- DNS ASK ny##g.com
- DNS ASK re##it.com
- DNS ASK fa###ook.com
- DNS ASK po###laba.com
- DNS ASK ix##.com
- DNS ASK po##gon.com
- DNS ASK st####rnculture.org
- DNS ASK xk##.com
- DNS ASK mi#.com
- DNS ASK fz###.ttk.ru
- DNS ASK bl#####st.rkn.gov.ru
- DNS ASK cu####ereframed.org
- DNS ASK cr#.####g2.amazontrust.com
- DNS ASK x1.#.lencr.org
- DNS ASK x.##2.us
- DNS ASK w3######ting-nel.reddit.com
- DNS ASK st###.##ghtthenewdrug.org
- DNS ASK google.com
- DNS ASK de##ils.com
- DNS ASK cd###.bustle.com
- DNS ASK cd##.bustle.com
- DNS ASK vi##.com
- DNS ASK go#####a###ytics.com
- DNS ASK st#####.polygonimages.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK cd#.#hopify.com
- DNS ASK fo###.gstatic.com
- DNS ASK mo#######edge.shopifysvc.com
- DNS ASK sh##.app
- DNS ASK se#######ads.g.doubleclick.net
- DNS ASK im###.bustle.com
- DNS ASK en####enge###n.org
- DNS ASK ce#######tes.starfieldtech.com
- DNS ASK cy#####vilrights.org
- DNS ASK it#.#yttk.ru
- DNS ASK mc.yandex.ru
- DNS ASK go#####agmanager.com
- DNS ASK js.##ripe.com
- DNS ASK fo###.bunny.net
- DNS ASK ki#.##ntawesome.com
- DNS ASK ge#.bdg.com
- DNS ASK co#####.facebook.net
- DNS ASK sl###oad.com
- DNS ASK yo####ainon###n.com
- DNS ASK er############s-sessions-production.shopifysvc.com
- DNS ASK im####.valnetcdn.com
- DNS ASK ca####berglaw.com
- DNS ASK fo####rndaily.com
- DNS ASK me##o.co.uk
- DNS ASK th#####dictionary.com
- DNS ASK ch####otribune.com
- DNS ASK ps####logytoday.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.pornhub.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.porn.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.youporn.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.xvideos.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.dinotube.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.dailymail.co.uk/news/article-3085227/Horrific-child-porn-lair-uncovered-Detroit-home-Police-uncover-hidden-studio-making-sick-sex-videos-filled-soft-toys-decked-lik...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.usatoday.com/story/news/politics/elections/2015/05/18/federal-election-commission-foreign-donations-ballot-initiative-condoms-adult-films/27530379/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.redtube.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.tnaflix.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.sfgate.com/bayarea/article/Child-porn-charges-effectively-end-political-6267401.php
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://boingboing.net/2015/05/18/because-of-net-porn-hustler.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.nydailynews.com/news/crime/s-man-lowe-parking-lot-download-child-porn-article-1.2225147
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://www.youporn.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.xnxx.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.comicbookresources.com/article/g-willow-wilson-responds-to-the-new-yorkers-a-force-porn-star-criticism
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.news.com.au/finance/work/porn-star-rola-misaki-paid-10-million-by-businessman-for-exclusive-service/story-fnkgbb6w-1227359302544
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.thedailybeast.com/articles/2015/05/16/twitter-s-great-porn-purge-of-2015-porn-stars-and-xxx-companies-fear-the-worst.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.alohatube.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.fuq.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.mirror.co.uk/news/world-news/rola-misaki-takizawa-porn-star-5702773
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://twitter.com/hashtag/porn
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.independent.co.uk/voices/comment/revenge-porn-a-law-introduced-to-protect-women-is-already-being-used-to-prosecute-one-10257552.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://en.wikipedia.org/wiki/Revenge_porn
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.dailyrecord.co.uk/news/weird-news/mystery-businessman-pays-porn-star-5706124
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.feministpornawards.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.reddit.com/r/JusticePorn/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.ixxx.com/%3Flid%3D1
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.pornolaba.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.polygon.com/2015/5/12/8589553/atlus-dungeon-travelers-2-porn-calendar-pre-order-vita
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://xkcd.com/598/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.youjizz.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://nymag.com/nymetro/news/trends/n_9437/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.facebook.com/thispageisaboutwords
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://stoppornculture.org/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://mic.com/articles/108552/the-countries-that-watch-the-most-porn-aren-t-the-ones-you-d-expect
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://store.fightthenewdrug.org/products/porn-kills-love-tee
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.details.com/body-health/sex-relationships/201002/best-porn-parodies
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.vice.com/tag/porn
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.endrevengeporn.org/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.slutload.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://yourbrainonporn.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://yourbrainonporn.com/your-brain-on-porn-series
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.cagoldberglaw.com/states-with-revenge-porn-laws/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://foodporndaily.com/explore/food/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://metro.co.uk/2015/05/15/businessman-offers-porn-star-5million-to-be-exclusive-to-him-for-15-years-5198964/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.thefreedictionary.com/porn
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.chicagotribune.com/suburbs/downers-grove/news/ct-doctor-child-porn-sentence-met-20150515-story.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.psychologytoday.com/basics/pornography
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://makelovenotporn.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.tube8.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://gawker.com/chinese-mogul-who-likes-masks-so-what-hires-porn-star-1704711209
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.pornmd.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://zbporn.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.complex.com/tag/porn
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.dailydot.com/lifestyle/rola-misaki-exclusive-anonymous-businessman/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://makelovenotporn.tv/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.madthumbs.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.buzzfeed.com/iramadison/which-gay-porn-star-is-your-soulmate
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://chartporn.org/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.porn.es/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.imdb.com/title/tt1291547/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://southpark.cc.com/full-episodes/s17e02-informative-murder-porn
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.merriam-webster.com/dictionary/porn
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.komonews.com/news/local/Judge-questions-sentence-for-officer-who-had-porn-on-phone-304011401.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.youtube.com/watch%3Fv%3DdAS3XCxqekc
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://theporndude.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.reddit.com/r/PenmanshipPorn/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://xxxsexxx.tumblr.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://pornharms.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.amazon.com/The-Porn-Trap-Overcoming-Pornography/dp/0061231878
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.elephanttube.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://m.xhamster.com/thai.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.covenanteyes.com/pornstats/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.nbcsandiego.com/news/local/Kevin-Bollaert-Revenge-Porn-Sentencing-San-Diego-298603981.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.resistpornculture.org/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.cnet.com/news/porn-and-video-games-engendering-masculinity-crisis-says-psychologist/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.spankwire.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://mashable.com/category/porn/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://pornburger.me/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://la-xxx.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.reuters.com/article/2015/05/14/us-usa-florida-revengeporn-idUSKBN0NZ2IZ20150514
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.businessinsider.com/nielsen-pulls-twitter-ad-campaign-due-to-porn-2015-5
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.alternet.org/sex-amp-relationships/7-classiest-smartest-sites-porn
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.tblop.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://thoughtcatalog.com/johanna-mort/2015/03/12-movie-sex-scenes-that-are-better-than-porn/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.vporn.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://paleoporn.net/recipes/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://anyporn.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.npr.org/sections/thetwo-way/2015/04/04/397509157/owner-of-revenge-porn-site-sentenced-to-18-years-in-jail
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.iwantporn.net/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://kotaku.com/vr-porn-has-made-some-progress-with-breasts-at-least-1695539854
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://efukt.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.cumlouder.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.penisbot.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://xpornking.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://audibleporn.tumblr.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://virtualrealporn.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.myfreepaysite.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.pornyeah.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.foxnews.com/entertainment/2015/03/23/taylor-swift-buys-up-porn-domain-names/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://rule34.paheal.net/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.foxporns.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.tubestack.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.slate.com/blogs/behold/2015/03/13/roger_kisby_photographs_porn_stars_at_the_adult_video_news_awards_in_his.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://indifferent-cats-in-amateur-porn.tumblr.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.rabbitsreviews.com/Default.aspx
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.nudevista.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.keezmovies.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.pornografy.org/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.freeones.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.sambaporno.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.amateurs-gone-wild.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.aebn.net/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.yuvutu.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.mercurynews.com/crime-courts/ci_28094252/walden-west-employee-ensnared-child-porn-case-now
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://gizmodo.com/when-porn-and-virtual-reality-collide-nsfw-1660603261
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://games.slashdot.org/story/15/05/11/1414213/psychologist-porn-and-video-game-addiction-are-leading-to-masculinity-crisis
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.cracked.com/personal-experiences-1386-5-reasons-being-male-porn-star-less-fun-than-it-looks.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.dailymotion.com/video/x2fwqpb
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://chrome.google.com/webstore/detail/anti-porn-pro-the-best-an/hbepadcdhpahlikldbochnhfleejiokp%3Fhl%3Den
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.marieclaire.com/sex-love/advice/a509/female-friendly-porn-for-women/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.theatlantic.com/magazine/archive/2008/10/is-pornography-adultery/306989/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.latimes.com/local/crime/la-me-1204-revenge-porn-20141205-story.html
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://deadspin.com/which-porn-video-was-this-espn-recruiting-analyst-just-1680984953
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.wired.com/2013/10/why-criminalizing-revenge-porn-is-a-bad-idea/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.forbes.com/sites/julieruvolo/2011/09/07/how-much-of-the-internet-is-actually-for-porn/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://blog.eat24hours.com/how-to-advertise-on-a-porn-website/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.utsandiego.com/news/2015/feb/07/revenge-porn-california-law-bollaert/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.universe.com/events/the-10th-anniversary-feminist-porn-awards-tickets-toronto-KYJFV
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.newsweek.com/are-revenge-porn-laws-going-too-far-268292
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.kpbs.org/news/2015/feb/02/san-diego-man-found-tktktk-revenge-porn-trial/
- '<SYSTEM32>\wermgr.exe' "-outproc" "0" "1340" "5420" "5400" "5404" "0" "0" "0" "0" "0" "0" "0" "0"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://qconferences.com/internet-porn-song/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://www.indiegogo.com/projects/the-tfyc-and-the-porn-charity-live-show
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.perfectgirls.net/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.nbcnews.com/business/business-news/things-are-looking-americas-porn-industry-n289431
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://glendowerhouse.com/wordpress10/%3Fpage_id%3D176
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.waff.com/story/29093348/huntsville-man-arrested-on-child-porn-charge
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.guystuffcounseling.com/counseling-men-blog/bid/24369/Why-Men-Watch-Porn-8-Things-Women-Need-to-Know-About-Internet-Porn
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.northeasttarrantderm.com/constipate-autobiography/porn-wmv-format/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://biodina.com.br/porn-on-bebo/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://abc27.com/2015/05/18/police-man-killed-father-in-dui-crash-had-child-porn-on-phone/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://serialbasics.free.fr/forum/viewtopic.php%3Ff%3D5%26t%3D7849
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.turnto10.com/story/29094065/north-attleborough-man-sentenced-in-child-porn-case
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.wtvm.com/story/29093348/huntsville-man-arrested-on-child-porn-charge
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://www.sexualrecovery.com/pornography-addiction/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://pjmedia.com/eddriscoll/2015/04/27/this-is-cnn-23/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://www.youporn.com/' (with hidden window)
