Malware Analysis Report

2025-08-05 15:46

Sample ID 240527-xst4qsff56
Target 7a3295bfd86c4d9f90594e4ecf0d470e_JaffaCakes118
SHA256 0e94e58d9c4ac217c3a4ee60e0457e9a4186ef53dc358e62cc434273c2db91d3
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

0e94e58d9c4ac217c3a4ee60e0457e9a4186ef53dc358e62cc434273c2db91d3

Threat Level: No (potentially) malicious behavior was detected

The file 7a3295bfd86c4d9f90594e4ecf0d470e_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 19:07

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 19:07

Reported

2024-05-27 19:09

Platform

win7-20240215-en

Max time kernel

145s

Max time network

146s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a3295bfd86c4d9f90594e4ecf0d470e_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422998714" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000edadbad2307b7b478960862b27daba9b00000000020000000000106600000001000020000000d794abee3854f54da5956d2dba0c9d6997953b67f3d36e2f3c307c2a0970a12a000000000e8000000002000020000000d2e6fc7951e66eccf91e94f18f501bb4a1cd92f79152876957a8e9b8db38b13690000000d95772b36b1a721f150f6e32f561ed16b1bbfe526471de988fe3d0d7f45bf99512e468fe72e6a1a36e3ffb76ffb46f3040a2d3a14ede1d2d67502e86b1dd0943f6659755d5ba9b52c8e65bcf5e55befd396b21a6854268772bc81d52b0c19a8dc73eaabe141ea3971e50bbad7accbcdd89a6038e01874731bfd219b4077bb185d28d9458fa2278cb79469f1e5322ce9f400000004cc21a62168cd96b7425e222816c080ac1c6c2df6f5f0b864291465a5a6b5d9d21648e6bccb44a35eac16fcab7bf8166e02ab52bef1e07ed3fbdbdfb16698279 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000edadbad2307b7b478960862b27daba9b00000000020000000000106600000001000020000000cf5f0d60bd9fd4cad4f18d1652e13577df1cda6e1eaa537f40d4b163cd5075c7000000000e80000000020000200000009400fd0ca92f96e75a71f60722eecafdb53f227c53c014504280e07b149235dc200000003080bd48baf3693a875612c459ab77716ec6a7cca3369c70a56a35316696a6bc4000000085d43bcff9883299bc3bd52585b32e47fdad699b4f65793d4be73ca9227a700b9ce3998bc8980b47ad8f482fc7ef1a20d402fbe0be5ec9c313cbbdb086632ff5 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B1EB9E1-1C5C-11EF-B6F2-56A5B28DE56C} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10207a3269b0da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a3295bfd86c4d9f90594e4ecf0d470e_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
FR 216.58.214.74:443 ajax.googleapis.com tcp
FR 142.250.179.73:443 img1.blogblog.com tcp
FR 142.250.179.73:443 img1.blogblog.com tcp
FR 142.250.179.73:443 img1.blogblog.com tcp
FR 142.250.179.73:443 img1.blogblog.com tcp
FR 142.250.179.73:443 img1.blogblog.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.179.73:443 img1.blogblog.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 216.58.214.74:443 ajax.googleapis.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.179.73:80 img1.blogblog.com tcp
FR 142.250.179.73:80 img1.blogblog.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.178.129:443 lh4.googleusercontent.com tcp
FR 142.250.75.238:80 www.google-analytics.com tcp
FR 142.250.75.238:80 www.google-analytics.com tcp
US 8.8.8.8:53 cdn.printfriendly.com udp
US 8.8.8.8:53 accounts.google.com udp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
GB 143.244.38.136:80 cdn.printfriendly.com tcp
GB 143.244.38.136:80 cdn.printfriendly.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.178.142:443 apis.google.com tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 ankitpatelsblog.disqus.com udp
PL 93.184.220.66:80 platform.twitter.com tcp
PL 93.184.220.66:80 platform.twitter.com tcp
US 8.8.8.8:53 s10.histats.com udp
US 199.232.192.134:80 ankitpatelsblog.disqus.com tcp
US 199.232.192.134:80 ankitpatelsblog.disqus.com tcp
US 8.8.8.8:53 developers.google.com udp
US 104.20.18.71:80 s10.histats.com tcp
US 104.20.18.71:80 s10.histats.com tcp
FR 216.58.214.78:80 developers.google.com tcp
FR 216.58.214.78:80 developers.google.com tcp
US 199.232.192.134:443 ankitpatelsblog.disqus.com tcp
US 199.232.192.134:443 ankitpatelsblog.disqus.com tcp
US 8.8.8.8:53 s4.histats.com udp
US 8.8.8.8:53 widgets.amung.us udp
US 8.8.8.8:53 builder.extensionfactory.com udp
CA 149.56.240.127:443 s4.histats.com tcp
CA 149.56.240.127:443 s4.histats.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 172.67.8.141:80 widgets.amung.us tcp
US 172.67.8.141:80 widgets.amung.us tcp
FR 216.58.214.78:443 developers.google.com tcp
GB 163.70.151.35:80 www.facebook.com tcp
GB 163.70.151.35:80 www.facebook.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 www.google.com udp
FR 216.58.215.36:443 www.google.com tcp
FR 216.58.215.36:443 www.google.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
FR 216.58.214.78:443 developers.google.com tcp
US 104.20.18.71:443 s10.histats.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.152:80 apps.identrust.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
US 8.8.8.8:53 a.disquscdn.com udp
US 199.232.194.49:443 a.disquscdn.com tcp
US 199.232.194.49:443 a.disquscdn.com tcp
US 199.232.194.49:443 a.disquscdn.com tcp
US 199.232.194.49:443 a.disquscdn.com tcp
CA 149.56.240.127:443 s4.histats.com tcp
CA 149.56.240.127:443 s4.histats.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
BE 74.125.206.84:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 c7a5368935b1f14dda86bc8065257b0b
SHA1 9f01a63d7733803a67729a805a527af7fa2acc5c
SHA256 2ddea08baa0bf8eb47d1c7cc4d548818bdc87cbd539fde0f960276468a354532
SHA512 a900ebb6f14b953b78c2579425773870b487066c1df691787ae210848812da64668bfcb6afb30b3d992e4454e4b45b7a33cb4681fca69ded365097b13d0616fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 e7e25a7c342a2b782db207545eae3405
SHA1 44b1e50f06a37530c2f835be3fb98db40872eda7
SHA256 6b4a89d18a5b093a0e4f0b4131ba454a10e09bec471c5cbf173c4003e902bb1e
SHA512 d18a4092f3900d5512a38588e42aa88d1244ea5b9bccb718ccd17609745eaf92155f74dc19e4a10e1aab193ef8d3421d59a2ff0e79b3cae9e0b6a2885c8c4841

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 2c739a4b275539c8972e0b1216f6e8bf
SHA1 b9732b99ec0f1c6b026cb7be29f2effe836721ea
SHA256 bb34da576b45df5bc2e9ba6e58c0a96af15f06bb12db2d743ff45592d83591e3
SHA512 f5ee713a6cb593be3146e4cb1df071f71369c023119ec96186f732939c559b2004833c7ab084c3d6ed63b971c79d9b58554a95847650fb33c31c4dd8d8e4c8cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 fc369d25a7820a2e51aeb0414b8a57ad
SHA1 2e2c58f1780c5ebbb9e8e58c7f8d132bd807060f
SHA256 93bd8223e96b174cbbdd22876cfe2de364b95a82d3a2ab9f231c2afad92af1d6
SHA512 406d4d0167e78dc2cc9efb1392062a051cfaff61849504a64ea8c4ddffb87a91196a837305feeed3f1ab791a32667cd9693551b0a9e8a01f613d0e146c3114e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 1865bb7c285da4fa9d40971e15ecd5a9
SHA1 6ac67a54d6971a5a065c303fdf5d6b85cc1b1368
SHA256 00a9a673e23e1d94d38a10fd36620ce70919b62722198ef5c4d6a9b0f8554979
SHA512 9cebdc1e675a9797039bb581520af665756bbc3983ad2b3e6ac0bd98cb90fdef8d85ef8e3abaf3202a65476d0cf133fd67f24317afa25f78a172707122fd119d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 8fbf610ccfd375ca77491221d35691da
SHA1 137658a0af69abc62d93804849885027f62edb30
SHA256 66edc18996d3f80f3f4b0b7c8818b7cb219d00df96c2da3d3c33d4ac492aa5a4
SHA512 6b8b7d62f041f9716f8b6fe268358bba8705ff68d493b2eef2809c7ad20f60942eb7a1713b6d5cfe21abc4c75be6a4973245f045893d51a9afe255661602249c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 5ca80a24bb20e8654cc0a9da895e49ce
SHA1 46e5d78b20dfbe090228f32ba595c9033a2b5cb3
SHA256 40aea2eb70805776479e7f35c2a4ef159a672555195f6413c9aeb9356a2d3934
SHA512 cdb4e4c04b9dc9da383deea4f341d0324d0f28e664b2a94d1a27248f486e14fe8369d3e91b848ebe7b72f6913b8718187adde3d64b571d3e4180ad7361f17536

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 88560daa430e9b8b226017bcce8f5931
SHA1 ae34c7c14fce9772245f7de4bdd2f688a03b2890
SHA256 6b5e9e14832d3d6fb9421be960a15bbc73a3fe0cf29b848a5734504bf0aeaaee
SHA512 353bf4a0e1e53e6fb7344aee8fdffbef7e5de4ea26b680145d15ebb94180cf0c6f2d30cbda962e67724481d074a01fec2d9c6318a70164e5b9e5ef3531a9693d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 cb57ac7a24a5b172dfc943ab15ca9e1d
SHA1 1dee05414b03854a70a47fb18f414519af848441
SHA256 6eaac72b5bd4c00aba7e907647c1b439acc82b8483bf38b29bc31a64c995be30
SHA512 545b0325400f7917e8700ba59ab88073762e6acf6efcbb55fa3d63535e1d5e9d49892ba94d7ff621d80754008e8e07f8b59495537f3a5d6a4b16c7d89437e39a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4

MD5 6b167fd9eeb2662becd287e9e2f9b307
SHA1 867a06d3d272608aac96d45338a8f81697a64431
SHA256 b18a38a213f4ec56e4e01dd7c6cc9b05448de518968921d6d6f3d0341655c37e
SHA512 5000008890f2b9a46654a11e0bebb1aed4d5c51ca7320f85e90d190b90969150bd79b96f439ab5ab1cffa6b60c9a57ccda5e29f2a70a584fdd27cfc717bef86d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4

MD5 a746ec14ce02c4939e7e358c909a6462
SHA1 7a4fe04a00a6426d339f71a5439b2e4138718a63
SHA256 d14c1e8db8c8d699f7d2970446d453942a5e550da021992db0eb0954a4f9b3d8
SHA512 de9d4195bdbb1c75d323e13cdceb05c2860eae18b2bff348ae470664de96728e36ff4660cd5922a10815bcadc2ae3fbc15bc5903e4a8003e935f8e824856bece

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\platform_gapi.iframes.style.common[1].js

MD5 7ef4bc18139bcdbdd14c5b58b0955a67
SHA1 afe44fd9a877f81a3c36f571c0fc934324c6cbd7
SHA256 192bc707852c5986f930528442d88a79e5bcf4513aacc2b722a3c5e964501838
SHA512 6c2920e80e4d5059588a32f75bc2b5dcc19f8d68224c0935d74f9fbf49476ca5b1ce43c279768f3d36871dfcec39f36db3fcad559c2f93cc540154cdbb04dec2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\cb=gapi[3].js

MD5 4d1bd282f5a3799d4e2880cf69af9269
SHA1 2ede61be138a7beaa7d6214aa278479dce258adb
SHA256 5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693
SHA512 615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

C:\Users\Admin\AppData\Local\Temp\Cab17E6.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar17F9.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 339c49949d4bc2017bca0acaf8090c23
SHA1 afa2c1ee97d23dee320958fcdce19fff41603998
SHA256 14bbeab580bea304ff64ad22c59b14076ef192374ae00635c6e7282a79bae335
SHA512 ca381b8758611e0b9bcd9631f88ba3c8fa965d6abaabb276d43a4364b8367dd79f90b67dec3cd8ae53aaec1258b7140eab07564975a890c1529bdaf93d88ab3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b7d6f1320b1c61f0e292b1b8e26e0d21
SHA1 28555df5e1737d6596fe7600c74472413f0b4c68
SHA256 950d5ed26f6c18f7b269046c1e7c06be7ed3d68e9d8f8bdb9aa269ef7ceccc36
SHA512 8e784c26c8c9ae1a5ce1a681c8e749525c563360a636ecf32eca5be5ab3d02c700b8ae796f220ce13afcf201b395a3634ca03c56b3e2996a233bbab90e4bf13a

C:\Users\Admin\AppData\Local\Temp\Tar18E9.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ea147ac177d12aa524318ba0b7641b03
SHA1 51569e82d33297928b6690a62a0bec1055292c38
SHA256 d18cb1b937d8bf07b110a88cf67e336654242153f82d6670e74ddc449078d1e5
SHA512 05a9d84a0c1ac8a2c40819466e9068a78eb97d89084f7b317723bb29ccc99d5a2f8bb270007f84751fa59b942849cf8d8f4e2c59b81eaeaeb88cea80a1042269

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d90853f5b1dafbbeccdc417233d05d63
SHA1 c7faa5d336903307c89e3bfcda48d4d11158d2b4
SHA256 691178bdba76f2042a45d070756aaf22929d6c3723a479add9a543152e71865a
SHA512 f8b6b9e0f31523f41478910c9bfd17ad1f768342778dafd9c95aa8e9d1287471dab2687fbbe53b552612acd4c42b3a698ffbf74568f9badfebbc6d2ed47ac3bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a5730a3bdeba8b5f5e8266bf7b502c84
SHA1 2755cd024b770a74df83b95778342d64add7a189
SHA256 0bb3434d5911810f85d59f169856d39131c28d9046b16938a988d1bb894f8ced
SHA512 1f3a39bc1d677de176f50ec0f8caf31d2211e062ccfdd9a8437b5cc2d59fe14a843dcb36a847543fba9286655bc1ce70f197f0c0c1e742b10530dc65e687a24e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 adab381cd377521fb96b461ec7522372
SHA1 aa21b94e6a8c3b88ae5633df496601aaa8941c77
SHA256 69ec1ee2a7ab54e1e898b248b58bfa45962fb7cf4e105303243df137950388be
SHA512 b23ac095b3697a840032cac5a08bda5e6d8dc3ce47291c38f8f195b4764847f623ddb77f756535faf2ac1f421760b46d7accf1a5b28ead2cfc81b25d4d374a08

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 077acf3d06e9f74cbf58ec93b9b0088b
SHA1 9461f18488b9927b767c2da0d689b2e3bd555d25
SHA256 6cf4bdbb023af6eb4debb8c8a5b149a001e15831123e9aa21d31685f4fa69bdf
SHA512 9c53fab01026b5c50907d779042f6853505a8aa73d8a9f7492d4294fb9034b0f48ea7ac0d99768d48fad163e2f420f6b2081768fd6d88cabee1950fa00c3122f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9105d7f85823f329aa1e2c00df41fb96
SHA1 e3f0dce5cfd747a27b3346bf6f08cfa86f52ae0d
SHA256 4e9bf5153310249fa9447bad3bff76cd9997fc204c15864536f6f913446e2ab0
SHA512 86761abbb0a46620fda2f936b1cd84c537f86e28e369f7dac1e14df91e945748badc0dbb27447db91488703b05b664ba0e0362a171d60670c05712486daa61c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4ccc1d81a7046159a755e212df7fc730
SHA1 563643174572a0e58bc7f933ed89d654ec7bf9b6
SHA256 8c43433c0c0fdfaf91daa202f71aa654fb21a5ba1c811618ea477b04f51dd9ed
SHA512 f0d4da50b479b50216b26e5b7facb58a4c839a3e1eaef0f20421c519d91b7e1382a76c20e849d48306f37c8e6a8c9f4aa7ae710ef1f90cddbf5ac479b7b13ece

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63111a97a4c1d349ed1fc169900e7c87
SHA1 e825ae47241e95a483b76781e4828c7775a34bab
SHA256 065e39a0f30d38ea30d3ab410ea689975c4f60711ca6534af6f5efff441f9f38
SHA512 928b48a63256ce5f3ae357175248501de217d42d7ffc400de34a08dd332d66fed2252f92fa3a0b10f4db2a1345a08df700c06ef4f4c8a9bf1cd419d9b893333d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e451c01a66bb26017097ae3f22b3cbed
SHA1 1899119b9096b78969816338a94822d075c55ae2
SHA256 4ef1a6b16684d361de543aef85d922af44f09dac343d6fc2c6284e4815a4c2b6
SHA512 08a3b27513304fa0bab7abe4b2b33bf17522320e870a4c7cc2ffc4d726cd89bc1439fa397a7870836da7c0647c9f02c4298b8c63c2436b399c907a6bfe2a5746

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c63f6e9d077d6c489393500038cbc274
SHA1 beb88348b8ae738528a3739dbb9d34477079832b
SHA256 8dc84ee3ebeaaaba6d286f20aef2b038081abc00813d5b1f9f0532ddf21efa35
SHA512 5c86ec7ad208f01985adc161517583a3df023c260c0015701b3892d930881cd6c77b9dd6e8c1d74c4a09c0ca009e93c5251bd9823008e662da392ca4ef1743b2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a7554e9682f79ad7d46d52d665382d0f
SHA1 3445227875f65b8e566425343f2fe373bd8f43c8
SHA256 61980e23ee0541d3ee3989d4db1b47c54dccbd0537d6fb916843b7ba5513665b
SHA512 dc333726978d50aeef09fe0feffea563e80cc2d54e737af508fb9710fa1aebf9b416a5799209defd46c080e8e255fe5629e021bec2ea6c44df35d470871e61a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4946199bca1c6a79920f41cd90f9d7f9
SHA1 c755f8d5726ca2542d8d05ef75374876ed7f4f05
SHA256 7a6c62a38fa29114b24dedd68987a7bc17b3e61392c469b6bd915938e1ddb815
SHA512 c9224dbea4dabe33d3810d129085e101fd520afead1135f9cf368b1cea51fa9342f94c9fb8e9ac80d230b4e72e03d1d736d9dea4d5ad47490149d299a83c0bf1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 95285ca0156022e983e7b33552793d8b
SHA1 e81d6c5cbd3e1a61c762e46ae962f48b0ae03d31
SHA256 8273fbaa21bf864a4289032b6a467618a842720a8b3a79ed17651d631b7f89c6
SHA512 605834877b582d6ff47f8194da4dd4f52fc0d50908dc0e13aa1c019340dc9e6f3413aaba6f030277c0192604a46235da0aaeb1849536fe3fa7acfe6318d577f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bbae613916a96ec0ba9257018fc96228
SHA1 352ce8f9db0888e8715c3c9d37e760a587819ac6
SHA256 84cf345f0c01a75db200849e399add0da95c184136f021db72a88c7e5a76bbf9
SHA512 92711e52d847aa794052cfdfbccf5e26bb936a73aeea003d7d7983d37c0d07cb87253c3d60633755400079b2d8e234f02efa81729edac32af9060ee724b67ad5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

MD5 c5dfb849ca051355ee2dba1ac33eb028
SHA1 d69b561148f01c77c54578c10926df5b856976ad
SHA256 cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA512 88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

MD5 db0d3394f00001214302a9e9c2fec801
SHA1 8f77f5aac2c1dccb3e201857be8456e1f1af73e0
SHA256 0fbf4a2a6c8eed164512656170fb1b8979a4ca3496072a99f392168b64833d09
SHA512 6f65374520f8214146bd37a668c80962c337c9af154d55adfc9392bee50c3576b169cb75484eda628bb9c348d59ca840731eb311e08ba5bdd999a319e6873eed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be587be2022883d405e2c5ddd650015e
SHA1 9d6f70520fdf1b75bff636056adf4fe15657e5cc
SHA256 274fa30c02b35a47f590b3b4f9d46c4f1b59b6d973b93a507630edaf5d1def65
SHA512 2332c5d9f5fbdd3b3091063b5bb42f5703eb7afd1d54316b436bf2977e622d2923f4bdf013aad3cad588b89c2d3a894d520e8660a1f63e4020141c0cbc55a8a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6092a56c1c95ed8e5dbeffb9d7693844
SHA1 70a7c7ee8e1b0533048b9716255fd69074d04de8
SHA256 a63b50160164201ac99c97cc7abab775ac9446e74ca8b7d7f2e3c37a494a7720
SHA512 89b9ee084202b73b0bbc88625a8f055d16bb6e6f2630ff99334c127772e4a2bce2f5c49844d4c22693d6f491114e7563ad4447d9f536df9a8f476d1525962266

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5fb0c08a254443b1b9d938a4c00f0f09
SHA1 4ce4b4016859f6031c544b88fb6a8a1b5b0e6a13
SHA256 e97a0a513a14887fc780a5ba3fde96f57c8a7b26f0f8116c0fac3bee1967d704
SHA512 da739203874b6cea031f723435fdde51f073c7cc9ee1814ae1c8c573c1d34cabda535450123960ebfda8e78095066db8618e468ca093e9c959afa0a0ec2f1c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91261ea8b87ea7fe9790f0a509fa0b76
SHA1 7c0f536591a28f66f9c5ae1b41dec223d7130957
SHA256 74855474fc6994743f7023e7232341e7e06b7bff1555f7a8138a54f658d8cf5d
SHA512 6bbeeb16bc22540b05635a41e888c990107e355187b2752cc13626a5df76416b2a059d24cef354f2c4283c83d71346e6e61d9047f319773755a8455a90bdc358

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6d2ef41660bf119198b0ad5e14623c00
SHA1 9254dad07a1b95229d11af8eeef1f7cd96119716
SHA256 6e1e68b358ce7d59f7931fee3f41787eeeba859a696467a2f4b23e559a23bef8
SHA512 477d6b20bd22866f2efc7343794512206a5db60e06c77b42a827ed698049fca88e808e4dce400d0fcf0d2a5e5b1c892087b2743f8bd857b7940bb8300f8df0db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a6ecc2a13b51beaaf571fbf7b0dfe25e
SHA1 8ccb899c677276b8d2264195fd199789a48a8967
SHA256 e7619894c21fee85df7634679cbb530788bbdbfb9800824237aa9e980d49597a
SHA512 58cb4619e7df2d8b81c5a83c151a33d64297dc969c9724c61d8eba3a73e9394c282712e9616190c649aca9c5317173a81d65aa2b6ebe99c16e42092900e1761e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f057745bb092f33f316fd37f5c1fb5dd
SHA1 e02196a4cd2d7dd8813542434859a6215dd1b0d3
SHA256 6fb0b23949d5295735b0fdb970e11d2bf7ca0aa74102af96db6a93af2f25dc6a
SHA512 8c0a0ef0e428826dce26d6d2905ed8c9519ed4f47f4e12eade18d8317e71abb481b0c78e0ea95201402dcd1f96de7d51198c550a027ab04b2a5e00c903aa69d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 607eca08b4179f544bcdab545e7dc3cc
SHA1 e96e5642bc2eecc06106bfe7f7d84c84cbdfe48c
SHA256 baaf9d4c23851f4f139340709d2a481417c85eed7345b62fe6c7060f791ef1c0
SHA512 f408021625027adf7660e878bc1b2dc1a5764503231cf5f9cae08c7eaa9722e75da7946ea9027c45ef0a6045bb02d7a13f4ff555a1fd6c3345e318931ae7528e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6f944721a9c63d3c84ff58d030556ac
SHA1 fbc788221a3d84a61d21f561a40cfc7dee5c1711
SHA256 d92c19f492ace26d1111ad4535ec53601685c92911ec41621de44c17c9efece6
SHA512 2978e0f0b6ce9df41b93210d739c31465aeb0c174c4273c111d75d36efa57d842d6754080bed7529d5da43e84dc0993c605466471a10592d8dfd6f6290099924

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f836c3fd396aea70e16e1ae1f9e8de9c
SHA1 c5b360fcddd199bcf4111b0c3549cb9b99c873a2
SHA256 37993bf9e9296aacf381e25b97fb8094515c9f1c6289777fe826da0ff648bd3e
SHA512 fadd4e4093d85aa426aab8449dc714b572f18b30680f8de83c38e7a3c9c9edb970c8723abb59c8204cc3189f6e881ea9652ee99e91e023245330c01fc5f7dcfb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8e82d16cfb10eb4bb9fc6ade2acb4b9c
SHA1 5d67014e163f4d60f8665f8f9d0cbc321a2d840f
SHA256 b6a48312c1e31f610480306a54d65e96a3914ed708bff321b60d0b38cbbe84fe
SHA512 9b00ff786de96dbd4b8a7af18799a82254423893a8ed935dc495a3fa9b9356d4f45e176362b900a625c3b073f362e3960cc09a8cb7959b03bfdc1f4e88eeeee0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ded8eef1b22a2ea56f9b6080e1afde6
SHA1 81fa2951aee52e3e3d04251956d6824e4247559a
SHA256 a6f52abcf5d87d948e0a3572236d79f88221481f35bd68dcd95101cdd1245c67
SHA512 11a3f47828ddac0a89bfaab3b6804126fecf1ee88fcfe328c5aaef7e736ebef6a6eeb4d09b61f2cda319c6410c92e272813e9e5ca6fd21da0b630617b599a43a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84d364d7a49832770fae08b6b4b1ab27
SHA1 1d51a9a9644a962cf82b05a7bf6cea202f71c82a
SHA256 3f9a385ef36527cda612bbf9ed5e4d7c5bb0561781a3586a372d19c51c48904e
SHA512 d0c8903080bda3df18349a3c4d4b22b38d2e404adba83525ff2af5221b1ce9f70dbd0173634a03a5f904faead2fe51ab9ea7efdc31d1582b3e903c63acda9a71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 98dec98ce29063aa9c189501f6d130ff
SHA1 691feb3315dbd3e38cb4bea35469cd66a19e7e14
SHA256 70fccf0b9d8875f54cd714aeccaeaea196394a864e93ad353e1c1b3da91f5f30
SHA512 466659ede8461689d32bbba60deeb0912212d9ca7be0dec1fd8f80c7718ef65a1de627598a41602b0b7b72fb7b6476c589314dd7174fdf0fcda616970e1a5015

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5af4d0b27c779a10528bbc1db206ba41
SHA1 1e4cbb53205c383a87e23ec7dd34a98ce07a669c
SHA256 db0ea697b404ea1c8af46ab105af248ca6d63d28576b6c7180a302170fa0c646
SHA512 82d77c361b047e970174ac6ef9695f2bd8de2ebafda914bee1c4faed78a9a642794196306b6b3801a76a4b96eb313fe69bc03689f6a60b451ce9d06eb98e2815

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2420c3c608e1655967f24c4d3c3a3f57
SHA1 375cea31b5c3363b2e5f49aa7268a90a0f876a83
SHA256 1014b3fd9cbeb65c60d40fe1d847fd1c3f08b8aeb3fb8e63eb29e5d6cad86a10
SHA512 909716eb15bc1767b51bbbec73d44c6aa56aa232e8eb588d013cae8f7c7191a5a8a9b494a3ebafe438f61487df0fdac1a19713808ebdadb47d6662d07460537d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 397d1421f5c68ce7f755d5005d220ed1
SHA1 d021ce4962073f58ff3bd705c3f1b9afe0314b91
SHA256 8bdf3dea01ab5d12cce8e08f5a06046685f567b15d2120e6baf193fb0a5bf0f6
SHA512 c9ef67b4a77d0d94d48641e1c2e5aa7dac469525979dfa2a90c519ca17a9bdf71744599a332716c44bacebc95dedd044c467be201e8128e36f5a22c8b498adb3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b08485cdea30c2a1cc6732ff377596cf
SHA1 55a898cc442a57c5d869da7c7c0085abfd6e13cf
SHA256 5bf0852ed780dc537973abf3b12f405b35342ae710cc2f834fde9b91a80b488e
SHA512 446c625a3c1a6d10665a4a36c1899a31394fae897f4aeb3ecfb3a3fb77a82323159dbf51b65b7527967fb8d40dffb990dce7fdd9867ba8ff9b8e5f7b1e15a045

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IFGNZ1XG\rpc_shindig_random[1].js

MD5 23a7ab8d8ba33d255e61be9fc36b1d16
SHA1 042d8431d552c81f4e504644ac88adce7bf2b76f
SHA256 127ffe5850ed564a98f7ac65c81f0d71c163ea45df74f130841f78d4ac5afad5
SHA512 e7c5314731e0b8a54ab1459d7199b36fc25cd0367bc146f5287d3850bd9fe67ba60017d79c97ea8d9a91cd639f2bc2253096ce826277e7088f8abfe6f0534b63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e557e357b4121683bf92bfe380a25b76
SHA1 8539c3e87ffe2e1a6f8b9c1dd6654a56f3638662
SHA256 b5dfbc5d593a9d38238bc46ea1fe5a49fa4cc3b59e11c453eaf4e4e45a41e0ad
SHA512 db94e97d11f79dd9ce195bec6f996b9ee6485c8b93db8118587300dae1d4eb0866e9ade45f1bc34205fd7375a8cfe96b529d90d9db4264254be15feb5c847b6b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2adc9eacde4347f12a145c67d65e9ce6
SHA1 3197148723b8a5a4b08d5a53a61efc7826a16db9
SHA256 a08a7d1c7063d5ede7489059b154776cd9ccd87bcf0dd3be281d8589ec1e1d85
SHA512 96b40c3ef4bc394ea7c65a0ab34a7b0b3cfdf65343cc8cc504acc06e7b1b064f2b4f8f7527fa9f1b029be4d7055d00f36a8878d09bf3ef99e21260b13d6f9596

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 863f7b3392b19b651b7e05e84b8781c5
SHA1 b81b759e92362749fd7ca6658f78fca1ff291b1a
SHA256 2dae0ddbd28bd8cf1b73fa83dc9bf8f8051a70a8399c653507ae78bd0445e6ae
SHA512 e61acb1bc5f27c33a03806e5e63e34c868e3f0973bd227b87580112f5a56a69d787d88e46d7e84200214721f66832c4442dc95e834aa2c5af78169bc7214a3c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 940414f6744859c081fbf9b20dba88ef
SHA1 c1324312b206f9972e0449fdb68155d25e995874
SHA256 7b88aea91d9f019a94baf4353514003e7298e6d1fd253e3658ed1e1989dffb3d
SHA512 32076d1d6a01db8222a796901a8275e88fb5e0b50ba6097722f1f0a4b8627ebb5d4c821d27b30055177289efd130800ab726dac3af358456f0630d6670c4901b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f139db47b93eb0fd4e27f43b98efebe
SHA1 8d0b1dda6c9c507836b270cf4386c29002e43266
SHA256 1e8523a3f4f7e8921676879bacaad7e109fdbb4df5e6eb8edd8922c56dd4c6e3
SHA512 9f241c570dbfc69918fb040242338b45d70b9c41d1a16aef1dbd6e3274512d8b043f6c6091b344aef61c9955e18a5cd721f8ebd7f727b18921bc8bed3fda98bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57bf0840815178ddcac09c3102ee1476
SHA1 358bb6589b6dc8b72d858ba209d161cda02347ff
SHA256 aaf1bd9d806b3dcd78de63e943e8373ccf9ddf3e23848c200ee2020ffa2f5f9e
SHA512 b7b115049c72badb7c6427886aae33b1f62d1f70e69a075888401fb3dad85e3131d0adbc7c79938993221d05ca7ac2b2297d70ffbd9efee56b86e927e963cdb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c083139c6cfc3aca9509623ae8609ba
SHA1 e92c8f0f6e9a1132c733cb3fb6e00e93486fef91
SHA256 3dbbf7799cc04f628888e106224d018399993291383321893a78297e306b42f2
SHA512 2c5a5ccb62d44be059c73b822aa96e8bf7164dd2f0b5a157c199ae952a698bf05480b2e901d679653ee2c823deb1e570cb95cb5cc31494d741ee7bba5a6928e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52f76ed1bb174dabf1b14a6c9fe0a2cd
SHA1 6742c0a4bebb562f9b213f7d0c718c551d12e29b
SHA256 1e3874a2d4bec4784669b0a700efe8dd4edcc05ae4293a11cb9992e903c86e13
SHA512 33591031f6f3e915caf604ccb35a0377c452ad7e0088870eeefd6ffec31f7b58709c9c3acc8afda353539419fe6a378102d65d135d4b530b41633d0ef16215e5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 0f9854f876cf5de0a84a591376fba803
SHA1 1449039025671f508d04d105bdb8c8a8cf83616e
SHA256 552813ff5cc5afab60d935d33336a966a06817880429d228471675fc435679ff
SHA512 42f74c8f479fff1ef83ad64d25fce013937d9cac0085df3f8c28c6d61aa7ffaf29c6789a00fe1ea0a980252d5f9baa231ac099235513f8e8003d54d8b615922b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0cfc85510c8cbf96d5dc784afbd30246
SHA1 1de31fe78104433a7daf628ab2d7eb0b3cb04063
SHA256 99f8202d60c48a443c3edf6b338ba2059281d875a212a3a9d4a3396f525981ef
SHA512 fb1bb352be52b95b1d5e63aa7933f0c545edc1b904ee3833dc7656de00cb96d675ee7b4d12fe0ac1ed5240c166c64797aae0109e798f18a3281e039372e02504

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4eb71f57b476f982dbe65e918cf2abfe
SHA1 81e7e7ada3735f19966116ad1db5895b0e209ecc
SHA256 a37b75b6c535a3286a0f06dd3a4404401a0f81f2d12f770d83c7b5176e90750c
SHA512 dd921381d0f9f0ace89cf4bec14b2aac9d7bb963d8108e5eefedef5c5ac11876b4003520e21b0eba9f9b7f56fe344f412737430603315de16701c18f82cedb18

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a693ed9a04709672628b48ad2903be88
SHA1 802c576c1f114325d568c349127f2e2be21a6c2f
SHA256 8649e64f724f39acd2e02eb1d5812e21f813db3dcf0712accd3626909dd09aef
SHA512 cebc92eeac6126c918a19968244de32bc927837dff19c87945ba21caf8f2bcb650f9f631aef505563ca9f16a3e3c01975e2aaaa2745449e2f4bd223b470f5da1

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 19:07

Reported

2024-05-27 19:09

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a3295bfd86c4d9f90594e4ecf0d470e_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3572 wrote to memory of 1060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 5064 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 5064 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 3640 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a3295bfd86c4d9f90594e4ecf0d470e_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa75c46f8,0x7fffa75c4708,0x7fffa75c4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,1175158302697867744,8813318679157180773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,1175158302697867744,8813318679157180773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,1175158302697867744,8813318679157180773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1175158302697867744,8813318679157180773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1175158302697867744,8813318679157180773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1175158302697867744,8813318679157180773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,1175158302697867744,8813318679157180773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2748 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 netoopscodes.googlecode.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
BE 173.194.76.82:445 netoopscodes.googlecode.com tcp
FR 142.250.178.142:443 apis.google.com tcp
FR 142.250.179.73:443 www.blogger.com tcp
FR 216.58.214.74:443 ajax.googleapis.com tcp
FR 142.250.179.73:443 www.blogger.com udp
US 8.8.8.8:53 resources.blogblog.com udp
FR 142.250.179.73:443 resources.blogblog.com tcp
US 8.8.8.8:53 lh5.googleusercontent.com udp
FR 142.250.178.129:443 lh5.googleusercontent.com tcp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 73.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 74.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 img1.blogblog.com udp
FR 142.250.179.73:80 img1.blogblog.com tcp
FR 142.250.178.129:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 netoopscodes.googlecode.com udp
BE 173.194.76.82:139 netoopscodes.googlecode.com tcp
US 8.8.8.8:53 129.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 ajax.googleapis.com udp
FR 172.217.20.170:445 ajax.googleapis.com tcp
FR 142.250.75.238:80 www.google-analytics.com tcp
US 8.8.8.8:53 238.75.250.142.in-addr.arpa udp
FR 216.58.214.74:139 ajax.googleapis.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
FR 142.250.179.73:443 img1.blogblog.com udp
FR 142.250.178.142:443 apis.google.com udp
FR 142.250.178.129:443 lh4.googleusercontent.com udp
FR 216.58.214.162:445 pagead2.googlesyndication.com tcp
FR 142.250.179.73:443 img1.blogblog.com udp
FR 216.58.214.162:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 bloggerblogwidgets.googlecode.com udp
BE 173.194.76.82:445 bloggerblogwidgets.googlecode.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 bloggerblogwidgets.googlecode.com udp
BE 173.194.76.82:139 bloggerblogwidgets.googlecode.com tcp
US 8.8.8.8:53 ankiitpatel.blogspot.com udp
FR 142.250.178.129:445 ankiitpatel.blogspot.com tcp
US 8.8.8.8:53 ankiitpatel.blogspot.com udp
FR 142.250.178.129:139 ankiitpatel.blogspot.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 kona.kontera.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
FR 172.217.20.193:445 4.bp.blogspot.com tcp
FR 142.250.179.73:443 img1.blogblog.com udp
US 8.8.8.8:53 accounts.google.com udp
BE 74.125.206.84:443 accounts.google.com tcp
US 8.8.8.8:53 www.google.com udp
FR 142.250.179.73:443 img1.blogblog.com udp
FR 216.58.215.36:443 www.google.com tcp
US 8.8.8.8:53 84.206.125.74.in-addr.arpa udp
US 8.8.8.8:53 36.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 4.bp.blogspot.com udp
FR 172.217.20.193:139 4.bp.blogspot.com tcp
US 8.8.8.8:53 img1.blogblog.com udp
FR 142.250.179.73:445 img1.blogblog.com tcp
FR 142.250.179.73:139 img1.blogblog.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_3572_CDOBOBVWZHBPYAJE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e16c10d842ff06883311db05f636f97c
SHA1 041403f74092384d5ab631a191e4bccaa9b37af4
SHA256 f57181614c5e6e276ae40a8058cb26fd6f5b2caaebc4557ba656e93a60a793da
SHA512 bb3b08aa34d9a5348f468e39ea1582a0483ecde311793476426f1e72f0a711e56e93d58c276be9216632da6da421e9ba3a45a6d70cb7d9ffef73f380af07bca0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c4873222bd3c45b511ae39e52c72ed73
SHA1 28be187b92c2ecb0bea47a5c9a2de4c6afcddb09
SHA256 0ba62228f752ca60fd73620fefd7f89e35a934a884b85cfad1e37ec88abf6beb
SHA512 7115ae57b71075aa08856166200de46ab9e43538c82212f26e87b943e1f8a2f8ab6f94f92998dbf19a5594699331f7a352035fba9c6156bded72c954ea5b96b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 20ee78b5ac0547ab568539f0cdeb6305
SHA1 4bfc1007a1fe14d1f0bd7d256286c2590f0b75ba
SHA256 745e0bd001fd1d1b52b85d837fc88f1470f2f1e00702c7ac73baf390ec7a8171
SHA512 bba3a9448f9623e4f96e8e946f8e19182a607df0a2b82c904dffe2219c87a12dd7ada4bc9950a17e1f255d2b32f5b253c339a78e76a1ff3427567c3b302a6d4e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 978acb488130b5d568f5752feafc7fd0
SHA1 e44f630985e932da9c6934132784c66123fdaaf7
SHA256 a22ef32e10b6a6012d3741cf3ddefc24ed309a66d841519282891b2930f5eda6
SHA512 185138aa9452f6ccd87bfd82bf74125ef93b09432616249204b7dafec7712bebdabd8a87aeb7da9b166dff1f1380d23dae7afbf29fa78a1e4abfbace7b054eab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 24d7fd2e6ba5927892ae3813976708c6
SHA1 a4ca71ea9a82e599161a2c7858ebc45f887fd6b2
SHA256 17cc50e32bf78949bb100e6b65d8a6c8756c002417fb33eff378a786884d40e4
SHA512 cc6be9510a31f691bde4527e5be4e93f6d88e638b8f0fb8239abbf76cd08e83e44dfbf6f57a8f66074f8af5527997c4054ef16b529aa3ad30cd9c70e90bcea62

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 af15f91ce7df127557a16c8fa7544bda
SHA1 1fba78ca7493267fdc06e0df25e0a1e52bc60748
SHA256 64c3fc0c6e44c8575a3c2bca6c7a12a327c57bde6eaf7aead76b1be17eabb695
SHA512 c55feae68a7e8f4ba85610bf500bcde2257281e28e307286e0e09fece66892b2b7c27a8d4c0db4acc09df6fa7165091d20c58c40ea54233533ef0f05fb63c507

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 70b823170282a282541c8cfb795aab97
SHA1 4079f3582c9f89d82b1e915ff728e4e9f6dd4d56
SHA256 4fc92148ba7ca8b36f0eaf316eb27775defa01a51e607c572766fb780a7362a7
SHA512 c860f2c100c54b439d4bca80cba2c31ec69c3ed4954a3a1a4ed9f655d8367bde02f64e83dad783c35487afaa97b5cd1859e11e92bdb5c63897fb736698c4c4cc