Malware Analysis Report

2025-04-14 00:58

Sample ID 240530-q9j7jaah4z
Target 8462b1faac877090721aa469c657a091_JaffaCakes118
SHA256 5d27099b4f2cceb6cbe0943673a30741e34e4b0bf88dbc2a88ffc1f2200b1660
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

5d27099b4f2cceb6cbe0943673a30741e34e4b0bf88dbc2a88ffc1f2200b1660

Threat Level: No (potentially) malicious behavior was detected

The file 8462b1faac877090721aa469c657a091_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 13:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 13:57

Reported

2024-05-30 14:00

Platform

win7-20240220-en

Max time kernel

149s

Max time network

140s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8462b1faac877090721aa469c657a091_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423239325" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f9b06899b2da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007893db4dbadc5141b3d9b2de759a703e000000000200000000001066000000010000200000009d5e610bf4ecb33f653e698cefa44830d1426783747614863e1b417fe27011f2000000000e8000000002000020000000eac3834b0bfa38ed15da09636d421e8525ea7288011b6ba2bad2dd55ecb63ea220000000bd36da82cf57a839db3e2b571418bcf01f6c27af69f64a3a4e0e24b400e91a4c40000000d65657424dd1229611897d6f9a93352cdab5024ab73d672771b15437ac5f1f26080d373eceeee3f576a999df3af31087a2d800660e1948d84336f38ca795269c C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{926E9C81-1E8C-11EF-9A72-56DE4A60B18F} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007893db4dbadc5141b3d9b2de759a703e000000000200000000001066000000010000200000006292fc2d147dee54a63029e2e0453f2471ef6a83f962a03e404fe4dc865dcb81000000000e8000000002000020000000ab4d9cbab2a91e88fb6404ca28c430469ccd78a1d2282528aa6b2f43ab424bc8900000005c22a37ce0a2b99af7afd2a62e952e1edb56c807060995751ec20890d6f05be99436186e2956b13558c0019de79003c6dfc331c710dd6ccfa3d3a399d7eec5803f6649b15092e7d8868a22d35adf8ec07ceecadc75fdb975d8be66b81c9935a69f2898887e273550f61784100e305ad2d6dd38c3c6312075f4af02b55d29522ab2fea46a291154222ae741d1d82dd87440000000f196f8a4de405c12663d2b00107a56032d30387de5419ddaedeb5739ae3100be726b8da371ea34c945a9903709a48c6947995c01bc1bb560da67e91e9a8d39d0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8462b1faac877090721aa469c657a091_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 makingdifferent.github.com udp
US 8.8.8.8:53 sabarmuanas.googlecode.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 cuerosb.googlecode.com udp
US 8.8.8.8:53 www.hostinger.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 media.go2speed.org udp
US 8.8.8.8:53 ho.lazada.co.id udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.204.74:80 fonts.googleapis.com tcp
US 104.16.146.108:443 www.hostinger.com tcp
US 104.16.146.108:443 www.hostinger.com tcp
GB 142.250.187.202:80 ajax.googleapis.com tcp
US 185.199.108.153:80 makingdifferent.github.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
US 185.199.108.153:80 makingdifferent.github.com tcp
GB 142.250.187.202:80 ajax.googleapis.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 142.250.178.9:80 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
NL 142.250.102.82:80 cuerosb.googlecode.com tcp
NL 142.250.102.82:80 cuerosb.googlecode.com tcp
GB 142.250.178.9:443 img2.blogblog.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
NL 142.250.102.82:80 cuerosb.googlecode.com tcp
NL 142.250.102.82:80 cuerosb.googlecode.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.200.14:443 apis.google.com tcp
FR 52.222.149.41:443 media.go2speed.org tcp
FR 52.222.149.41:443 media.go2speed.org tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
IE 52.16.67.239:80 ho.lazada.co.id tcp
IE 52.16.67.239:80 ho.lazada.co.id tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.jasfora.web.id udp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 accounts.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 104.16.146.108:443 www.hostinger.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Temp\Cab13C1.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 66d1f71702c1ef556dedf6366558c482
SHA1 1351a8d97e101fd17381d7d0dc232af4b08b86c0
SHA256 f001a03aa71c553fe7bb4e9fe8e42d495ae726c657d8542ff8f1a6041c1be8f4
SHA512 ba6909f4997d6ad9211a5d660c2c4ef2a0cf5560f49f0b21c353ee4e400ec06f625640a46ac1300944d53dd2c025f9c10467013a15857d9f7946c5206b7cc672

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 5f7db879ee79c54deb8a54dbd459991a
SHA1 b2ee698b098e943aaecb3edf627916ede2b4685a
SHA256 ddfed15dc6590851f9c7aabe124ebcfed3539208d9f0c9d793bd9218ad73e537
SHA512 e7e97d6999cdebf1e45286c047b79a38db568b5a988a9f52c1fcbe9495813f9ffcc68f04cf58079c8681ab9b7be98e1f824c12e82136d9050f622ea8c4823633

C:\Users\Admin\AppData\Local\Temp\Tar147F.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a28499ba9f088c0253d5c446984bea8d
SHA1 5d82b4de8690cbef81781e8d33894d94df58fe98
SHA256 0811935a66c4c977048621cff69f58c99a38e1625df2504935d0b7b46be069ac
SHA512 c0142f2ec3d43a7e2b8e89d46734d7b2c980e854f832be05a605fe599827c86180b7923f2ac3b5a4f3059edcee57fb6a586ecdd6569fd02b0cd0f3f22b666f5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar14B6.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 c70e0db2fe28a97f95bc54fc7de1ef22
SHA1 fd9ccd754d97ae5ea15fb0ba953fd204c14d57e5
SHA256 f46f769b04cdf33b5ed997d74ac8033f5224b117b2490496df235d915a5d8fc7
SHA512 6bc05cece59a5de60aa960543197f1ad4ced619f3f5f4dfc98777c3211f0bfd78c2f488ed841341369e666f94fe0ba0359a92015ae2ab5e504799cd005b94e5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 7e766a6ee57b28ed28e262b4df97b4a3
SHA1 b8af86fadbc023113d1e384cab56ce4fa4492e8e
SHA256 155e2483f1e7b198a750ad11fb7d919e41067837a5b2285ba3650e34fef37d14
SHA512 9f0c58cbc040a1325e8740948fce9d41d273c6ab7479b7ac30e1d82aaeb08220e1d20ce9c1f9a37383984a01f5b0bd010aa94b29e8f846944893355998e933f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8f7d951ed54ac07c5100cd68b1c980c1
SHA1 4847abd733c473a62c133ab370c177626bdcdeb8
SHA256 a48ada5f81ec8f48bbcd02c462bc37e2f83c4599eabeffc9019da07e8f582cf0
SHA512 bda4983bb3a2aa78f8cf42f9decb9b34b08888f5dd7f4448d2ac3890625b49b354196ca867b1dbdff76b1f3dbc864e9106fbbb14a66e5c85a66eb8cfb4369e41

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d7e3cd9c86d5fa790bc0ca856209802c
SHA1 ede7d405d7a1adef81e91297ac3af5a74681cd81
SHA256 524046cd269c2079f538edb6c3683cb77f39a599b2f0f71a8b16ddda613a7341
SHA512 f128c727f8213d36287b0dbd149c2abf921146b49b896b7fef6a7981f21f1ccb4ab23b4b1f506e905b7c2cb18c9286253f4481faddac650ae31ce8d8acc3df88

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_02C4C6ED250727F9B08935C0A9565568

MD5 b47125e9fd35af23769d171e1b08f4b0
SHA1 667608d19afdbd435a775b3a70b6809c44695a74
SHA256 4cd3c5651785b64e4cc988c43372ee4a9ebe0e9f1fb7f0b5ffb2cd1b03cfeb7e
SHA512 58f629028398eae9165980010963c34adf661dcb6489fd3bdf98ea7aa6438c0088f9e6b7fa4ee4a775d7817f6646aa316561e4ec56ab62d5c9c094b05f7308cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 721700ed5bb16eedaac986498b8ed41c
SHA1 9c8c55f235295b5eb23816705a48d2c02ec1e7ba
SHA256 7642b51a8279ab619015f24cbb83c5aa1c602af8485d46ff8e29aca84c39dbaf
SHA512 caa12bb3f38cd0dfff625751a663614c04ffd1c21f84aa0dc10cb5970bacaa26dafd812fa65bb8711d6ba290030fa6e4ec3bb121111b47a210c85b2a5e0ce556

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c31aae25ad02e3744cdcfdb5c94778ed
SHA1 4a7ba921afcdd370883be0e2540113182ab20f7a
SHA256 6ef3a0dd7f01b31f4b891515d8bf7b93e5f619ad210857eeb52f5a0ecbd29ee2
SHA512 b0061dfc48fced17037146d6df91a5067df0cc750b848d1d0627b7aa263dbb8bec4f6adbdd9a3321b4b383845792ff84f924cedd001fa8d5f416e760ced1218e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 64c0288c187ae33b858c4f209c31accb
SHA1 9d29b710ba9e07ae360c80df3c5c6c94710bd37f
SHA256 45aa9eaed0945bdbff79b8fa568e995819dbb8d01b606bed29ca1481172b8407
SHA512 1365166f74400b3234bd897551881bdb152a4f824ff6bbc74447616b9f1e2527a8ba938fee866be3d10b2e2fd1a90fbb8c89aff81f31684ef9fb5d82219c6332

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 76aa4ab5d27e4ae2572bea0ea9d62393
SHA1 12d4bfec834b3e2aff023ed05eca76ac07a572bf
SHA256 16fdbe53cf86f411bcbdfa03ee93d461aad2110b9e6a26347ce31987823dfa69
SHA512 da9c1f64ab02589a50434f719bc05a2451a3a625084c2d2387f248fb38cf1546af554860e9f484d4a9e13db7fe455dfe27198a6071795c11db0ca7b894227065

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\fb[1].htm

MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8860b83ae74a15e60537061260a4f02f
SHA1 382af0c8d25b90acef83a916d0edd3c5b034cc6d
SHA256 f33d17fee83832825c3117b1ba5bedf743b129770a696f52b6062469bf1e39a9
SHA512 5e1070cf285ce5d88a14c22eb0f827e31c6a2d80f8eee88d0aafb0c73f9d6a4c935d44355735e8cc4ad3977ebd5e9aaeec7cdd3605aa435270cd6ce7f5321b0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a1b9000d422d2773cd2c1640e646c552
SHA1 eeb9da4495c80ee6ef223a7ea45df194a76c2f00
SHA256 762150d1c3151b6fbb39f34727fccf752ae4bc890cf4521019b2eedbc5e9d5bd
SHA512 3f39a649d424e27491412748e77dd5032027fa077dbde776153f3dde74b8151d96dde3ece6a6d3241df79b231888552d07ada5a419adecf7ce188f556cd04306

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84003c32821254c85455f4fa403ee264
SHA1 8535eef6a5ed5ab035c3f11058f6626d756fc433
SHA256 fd112a2b6e4d5b6b6a38f596d91b644de71c967fccf72dc19f25c3f21d1a6993
SHA512 72d7e00c19589ec11343dd90ba0446a137a5b170774b41ca312a1f15ab9f1a9265f19b087433ca472c6c5d7f26805397fbf3c52ea5c4a104043aa0d8af55ea9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b83bfb6c5f5d0ded27a989af01415f29
SHA1 7df01f4160831a9c6cd2ce2245c34444b9c957c5
SHA256 91c806beecc7ddc014fdc20bc7930da404540fe71a269c1c3adfb307ae07f67f
SHA512 a879437f661c323596b7e306ca6727937cd1b9a1b647731e5b94e8cc7eb657fa89e3e1b3c31ba57374d8410c5db105da537402e7f8d5fbd6fbf3bab21506c2b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 54c8bc95bb419b6b0dbf8f244ddcfe54
SHA1 2c30abc6cebbb3d81a37dc47563cbdf6c3738292
SHA256 640e7aca6ed21771af56d3b10f64d4633cacdbc7cfaf09012b3a926f9f5275f6
SHA512 395f75b56fd84fca70f2112e62a87faaeaa5d26eadb941b57874b9927563f8be2efb66f7936c2f87d4927cde9a53c4c554c9d9d14dd9fb96d4f603b70cde0580

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77bea8276fab93de412f8e6bb9fc0e6a
SHA1 9f420839f3fec3debc5628b4e67333299d58b44d
SHA256 346d8bb5f65dc1a76d01b1786c0cdf9ea0a83cd07eca86089db221ed0b7df7f4
SHA512 8fe19aa7c6074df13ab21f52944c074a3f93b5b2134f248b7b77cce6367422d1b30e4725c16edc63731e86164eea6ff0d91e3876c07dd62e3f30510834077309

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9196eddb0ecadda847698756728f155b
SHA1 26eaa375e9901a2142bc308e8e6b7f386cfbb4b6
SHA256 03ebf0d0fbb2f046842b65a6d5e2b8c3a63a77f0e6ca5f21022cc99e2330665c
SHA512 c2e6d9662e3d60fde42f0dd2b0a29a29b8e8194aee069e85eaf7b4c0ee1b7a62c9064152f8d0b6fb2584bbb976982bd16580fa658f6f551872f4668e3a8ce1bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 628a4babc279a9caf2afcdc27c1a1c4d
SHA1 75994d2269b591cbc97043a5d0abf35a94678a85
SHA256 d1eeec3c380755a714f0d0db507ec215b8621345fc04bb17e772fe28eb1df5a6
SHA512 d93e13172fe5a3b9845f4959b81cfcbbe993a41f08e2979ad0ea6f669b0a613ef23ab2adf762a87355fd22f70602bd472446655281a266b633e5c672dba713d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7835edd581502c08bd9a82701b4c83bb
SHA1 0097d045850774f5b2e783904908083c5283810d
SHA256 8b943d2df4702dd795f8ce0ac52cdd8ed764645d1ae14b7e38574543d60669c3
SHA512 bb24865fab6fa9857c6326563ad77935a9a422810ff7514cc881656c6623b0bdbd0334d741c4d368c1ab1d80a6c63817ab07c19efd074c17f360ab22316aed78

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11140de0e952d3abd48d4ed74b325112
SHA1 6b3ffb851a87ac306db90785f25971373cc4ecdd
SHA256 c878a465a86c50e8333964d3a6229729317d0e46654fb11b616dc9892a3f841f
SHA512 6fa2c538db9443fe272789a88fdce4e28f231e6e383699e16e22d32d66cbc1bcbcda3c99ab1554d19121c40a9ca5b6365cb754a076b6c6d3877d05d01bd475bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7b184c9eb1c0b22c007b9d71e8894b94
SHA1 be8c644f3d1d0dcfb3619d9404fddb32a6a77161
SHA256 e013559abd82fd2a699130d8dbb9340cda94c2de7d3b5b51e7958237c9309532
SHA512 994f9b2365aed81e275235c4d8df430f0fa1eb98bbf04c241e7cb41929361512845ac928bb207a2563b8e18e7df30302690f6004f727163b91fbdd3f5a6a6e81

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\cb=gapi[1].js

MD5 63e5a0b45632b3dde3694ffcaf0e3f7a
SHA1 923736d0cdc308331d5cfaa0ea159bfedc83d53f
SHA256 889109910477919b3457416e7764bcd0add19fd959848253026125c7c35c43db
SHA512 5b886c4b5122d61f0209ede748aa84445c9388cf38813316c41b3dbd2308216e88394d9a45cfc27113c0cf3bc93b9c37d808f6d3c67888244c176ee095d42259

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 faa198c5729297dd1f249cfec823e96b
SHA1 4211d9f2c57fd1c561fca5ce0b98132f2cfe9694
SHA256 21b672df3ebd9bb097334515e69abf240591472924fa21979cdbfde02f03e574
SHA512 7b3e5ea4ceeccf3ac24f8c04549b2de7a729cf04b497170b62c91ba741f474c55b014b72fd15266086cc932d91f056df2bc5b697a88b2290f67fc43a245359fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8efa0dd288ad65ec77283b589a248888
SHA1 b0634b47cb3ad65031255163fdedb7a62a969310
SHA256 241d631714638b453d060760197e7c40700d0ff2bd4efa1d17b31f50417d2b67
SHA512 accb4c76cb714c61a34af448bcf692921b155f9d32e674243003c0557cfae0a82cc222ab3e88a8c9b267c22db269300cfecd50cf3937fda4619a1bcdf14c8335

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7f9b82115e8feea255981a0203368a94
SHA1 e9ad46fa5f8ac0f21259551499f7ccaac58f1085
SHA256 be5dcbaa7abf48a66f1129b5b27c8451284d0170f4499a3d7a18cfc40197869e
SHA512 36ce250138401b39893cb5f0e0eb6098010df829d9f77051367c2fc398a9a89bc01668b525211945a5b201474a7092f1dc514e66fc23ee5c93908ae2b5037f14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91b819da9e663882852b271da8e4f351
SHA1 c15f14d5c173646e67f2874731e28b9e4f15e18a
SHA256 13d7b416153f80e05330e8c94929e58252abba65eaa57d644f29a64abc88c82e
SHA512 09074c6964cc0c29e2c8766a9a3f7699725576bb7e44c947882d92d62542b116e341d32052fadce6245e1dcaf59333d190152dc9b1a06d236d6a2a09ddee0200

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce869e93d8f78b365fa568b68e022bbf
SHA1 9c29d463c8034b3f2c363838f46cc396b8d0e657
SHA256 884b56290c460c2758493d82774b3a77c290e11ab2cdd3378570dc88f6359446
SHA512 5b379d629164ff6d80aa12ae5a83c788678463ae94b17a2421299c2c8f07e3617265e39f14340b08db62ca037e1d9ff99edd2e0982e0621709146c78543f1484

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3b95fbc8ba9a6585f71c1a009a7dac1b
SHA1 1adc26c6685c4e1d94a6d526b0f238a72a04c664
SHA256 fd2ed6d9eb6938a122919be7ed9aae61cc7873f2290996e392924e6d4d31c1a9
SHA512 f808bab2cb48616010480a7f60011d8547dc470d207265bca56b5822becdfb3f58dd54d4d2c3cbd6b7c1dab3dfbbbd1ca063215ae2301fe7fab15ad46944c441

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 841abe9523546678b87b489e475b9cd6
SHA1 fc4ec0bed74e1f7b9c3556022a337f232637eec9
SHA256 a93e7441ee45fdda245d5b4988534cb14b50ff54294b066797d07e7926960638
SHA512 3787061c73b460a9a3d8a0868b9ef7a0d6269f6a186fce965d23b590235a0faf143df8ca624fdad65d43a89a9bc02cf968d5531e344f0361b184a2dcbaa3ccf2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f6bc13696f27f9cdebe5f5d114d82c42
SHA1 690276deb24e48b275a9a44d263f9f85890e81d9
SHA256 e3bc155614c199df541246bfe8d64f8ae93d3c00442402dd55a8f2fbf25df925
SHA512 48d7517ef4e755e22d5c3fff0846f96476dc38fb851bcb8224f779f1bfb684e6ba3438a1de40288ebe249bf8f2a9ec9f6efc0b534abf92f5f11ec5d7c0e40cd8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c4d884683d0c8d00887aa51179d8a484
SHA1 577c0386a7559b0454f1c8d5db578e8f75e10efe
SHA256 fe310fa019899901b5e7e81fdb712000144d8bc2c1ca44233c5cbeade793a4ab
SHA512 973c63ad6fc8ac166bfcd8faee544e8374937eb86c32da971481b60ddfdd366e85122df2d4aaab151577e2d30c452562ebabcbc603eeca74cc64b41f670743fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20a99dc1990faa7fd2523ba76edf1bca
SHA1 d226b5aa8bd6345ef13270481e1cfbc1f11e7833
SHA256 b678502f035aad0d4485ed54f0eeb39891d5ad2d4e132f1518ccf413b98c865e
SHA512 6d0cf99d61b78fa223a6fbc0120c771e08367d6998fc886a61acaa79b472102b98be4de801a0992dde0762551f434f9a4840661a99a6648f1a90790824edc8bd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\rpc_shindig_random[1].js

MD5 6a90a8e611705b6e5953757cc549ce8c
SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd6601ab685681817e5522b3ae3114f4
SHA1 6def61cff6038cc7daf03608bd0cf1a5192b113d
SHA256 992b1c5d14bc9975ee79004610995b756fe1dbd659f043b0dae3f63684b91c9d
SHA512 3cc745370dc2da0f327894c7fe914584dcf8ef12bb6be2fb05395649aaf37ec0144bfd9b3bfd9575f58aa3ba7be236b532b1dcf213c19c2deebbeebcc89de5c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3d210b4260de3c735b265cdbb7148f3
SHA1 224f4431c9fc845e77be8cd25aa5b70047ead3d2
SHA256 cb442f28529a0a71b8e768287dc50cbb252a2186323fe8979d7144986fbfea49
SHA512 4dfbf2a0484355e798fd882747189be022560060c1d35499800cb12ee2bb98eeb072f0ed29315d9bbef51ea6fd0dde181a2386b8750f35501c0a7ea56652561e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 540f88a467092a31ef6fc9a6e07d38a0
SHA1 f1deec8581a0f1a06e3e3e4630391ecc69a97519
SHA256 9865ae4409f2e1a6d4de3e924e7aba8a5e14cbfca4859cfc0dff6a6c6fdcc375
SHA512 193bcebe856ecfc531d2841ade07587602a3c267f36268ac23a0f253a6ebf816be8a7ef8d1a8379972acfcc838e28d396db16c67ad2df5c1f2b87f964fe62db0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 72509a438320c702dbb35e401ffbf5f9
SHA1 7d339dda30251456d3c5f2ac4fd30b2c5bc79efc
SHA256 6da9de50a8e2b613228171bf8645d138841fdd79371700d5f361dd6205a1f442
SHA512 2a7689039e5d4534a2a28ffacd34813819dfbdee6effe583c55a86a8a0318619623a8e02348253ce41aa07b34f79de224f57783ee500cbef61ab1b8d34c986cf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 806aa4733e79b2ae6f35ee8183e5cab3
SHA1 91626eb25d0e3c8d7a4d91160c0f5f3c5c5fdfe5
SHA256 efd95b8129f82673eb309572156ef0fdf26155b24f001fcc3cc258934d7f0d6f
SHA512 e563e5c9af96ee909bcdc9c89acc7a1e266a998eb7b1e017760636a9ff17a55dbffc2abcd58d05ef9af115c14fbdc88e5c720d2c3a46a321682736ea952de4b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e7d0e888bd85b37b732a3065bc99164
SHA1 46597947ecf1bc5069bafad87a31c0de324b1e10
SHA256 b03459fb57270d9d151d6dc7b3d596ec10935278b20a3aa848d3ab64c6f275ab
SHA512 b2d045d27ac4579ee6a5b11ea21b03350a561845673179f03ed6b4a39cc8f7ed6055da371e4e51f7ab4bb6818fd4be7d939629818934eca7b0788f79e43300d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46fe57b4622fd164dd41c27b10a7f963
SHA1 14d279cc42245c8ed4502bfcaef0e085ce21f3ff
SHA256 337af44a637db8129fec038a22c3c387aadbdea0acb89fcdaf59673985a165ad
SHA512 6ad7a72a0dfbb74b54c32094fbf70677952f340483c4ce791a8434dd47c7e171bfc9dd944f4353e99edd81f5d80c6a369602a595b676bcd36d417ab40dfa8b8f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5729d5bfe9784147cb55ac5785a2a9a5
SHA1 9540880fd74ee8dc1cd604cdd51d2086d1ccb227
SHA256 2be25f23b396bfd1933749e2c25d4896c1d5f9aadbb84a11eda95c78c5f623a8
SHA512 39f0bb4b405a62145c62d3c6300caa4c449ae8ed7069629e4ed0b8c03562c7e881b2ab8064c94d115b978e3e53d2f48b0767cfb4f46b94722033736c5c0e8fe6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f8b2c40e14a773898d003f8ce4ef02ae
SHA1 bb4c56ff78d50a5e569b3f5aab6c567fc3ca716e
SHA256 4f8f612a625a3e6188d1cfb2ac9d74e5f03721c29ecacd077a8c0e3a7ab4d72c
SHA512 e65065a586ac09f684a1225ceb637873a0bedf67d212aab1fda83b49f42c0bfc7d8db734b8fbb7fe40c5c21e76a79137d93f9f6aee62e2facef589c250c080fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c9391c4870dcb2a7ad0656483b1f9874
SHA1 20b1d3a7ad3add23a8aa4c15ed53dc82d901dee0
SHA256 a8f5a975ac38b2c584c75f5271b398624475b264bd75f237521794fe34a4c5d2
SHA512 58091fabf1d0484436f96587f7f3c2f5e3313b4c64fc1fa499ed929d3be8b17d74530ad03100f0d6cdcd6b2952b4d9c7311570a34cf5ca2c08881360d824bb4c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 f865ecda7616636c15ade67aa507ebe8
SHA1 6d740a3214c5020c50067bcdf8a6467c462612c0
SHA256 b5586bed812110ec86c2fe65871c273ef83de0d0ca587171c30206362a10fbce
SHA512 ab33cd35cb8adc79a80af2a0d80035f6b6a80d2372efe94da02f3f7a27dcbc7e9b7d12e0ea2ea8f92422a9edd0cb792adbf3781b57a974339ac3cb1bf4401a93

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 289d63b37686224c72b710269f8877c6
SHA1 83776413bcde526bf98dda72cb3faa69d582d009
SHA256 025f68a7be721909c5c83bd150dcc62c17cf12035d29167ffdad14f61444b895
SHA512 60afef97455aab8248f6044052f6bfee34840e2b82ad3c523edb8314d38a1fe1abb69b5591d45bd2291d9091ecadd1c38453953e69982fd24144669ffffe051a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5c3466286e3f033da3459de73b3db82c
SHA1 b618c73cb96d2107beb4fcf6c6bba2b7b94ef999
SHA256 c9f025a0036ab4d77952925992c443e369bec8effb349699f11e8754040bd011
SHA512 634ed2c57073853fc17bccc117a192bd410953a6f1975fa550ada050334e374865136040cb70dbc84ef0debad80ce9e06655650629544ad2a46b9b4bc3b55dad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 16d524cd261958c89743c3c8473dad52
SHA1 1046ac5b05349085a43e16ec446f4bfec89e6da0
SHA256 5e1f7567501951d6ae6bc795fe92a2e84c2f25e35be12fb217bf39ef54156312
SHA512 e46b46ee24f19758726f08469ccf76ca80875f45b1d52594c84d1c0e7877aacc848c8f92fa6d8f935e3d06264592cca35f8ca6a1fb8738dce0589835d836bd08

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 13:57

Reported

2024-05-30 14:00

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

139s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8462b1faac877090721aa469c657a091_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4848 wrote to memory of 1308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 1308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 3132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4848 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8462b1faac877090721aa469c657a091_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c0ef46f8,0x7ff8c0ef4708,0x7ff8c0ef4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6396 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6396 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,8736676300480452944,15775543414178762355,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 sabarmuanas.googlecode.com udp
US 8.8.8.8:53 makingdifferent.github.com udp
US 8.8.8.8:53 cuerosb.googlecode.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.178.9:443 www.blogger.com tcp
NL 142.250.102.82:80 cuerosb.googlecode.com tcp
US 185.199.108.153:80 makingdifferent.github.com tcp
GB 216.58.204.66:445 pagead2.googlesyndication.com tcp
GB 142.250.187.202:80 fonts.googleapis.com tcp
GB 142.250.178.10:80 ajax.googleapis.com tcp
NL 142.250.102.82:80 cuerosb.googlecode.com tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
US 185.199.108.153:80 makingdifferent.github.com tcp
GB 142.250.178.9:443 www.blogger.com udp
US 185.199.108.153:80 makingdifferent.github.com tcp
US 8.8.8.8:53 yourjavascript.com udp
US 13.248.169.48:80 yourjavascript.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 www.hostinger.com udp
US 104.16.146.108:443 www.hostinger.com tcp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 153.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 82.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 img2.blogblog.com udp
GB 142.250.178.9:80 img2.blogblog.com tcp
US 8.8.8.8:53 media.go2speed.org udp
FR 52.222.149.103:443 media.go2speed.org tcp
US 8.8.8.8:53 ho.lazada.co.id udp
GB 142.250.200.2:139 pagead2.googlesyndication.com tcp
IE 52.16.67.239:80 ho.lazada.co.id tcp
US 8.8.8.8:53 108.146.16.104.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 103.149.222.52.in-addr.arpa udp
US 8.8.8.8:53 239.67.16.52.in-addr.arpa udp
US 8.8.8.8:53 17.201.222.52.in-addr.arpa udp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 160.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.187.234:445 ajax.googleapis.com tcp
GB 142.250.178.10:139 ajax.googleapis.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 21.121.18.2.in-addr.arpa udp
NL 142.250.102.82:80 cuerosb.googlecode.com tcp
NL 142.250.102.82:80 cuerosb.googlecode.com tcp
GB 142.250.178.9:443 img2.blogblog.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
US 185.199.108.153:80 makingdifferent.github.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 www.jasfora.web.id udp
US 8.8.8.8:53 www.facebook.com udp
GB 142.250.200.14:443 apis.google.com udp
GB 163.70.151.35:445 www.facebook.com tcp
US 8.8.8.8:53 developers.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com tcp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.jasfora.web.id udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_4848_YYGLYLDMTAPUBWBO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 65a1cd795d96517776081f9747a563c4
SHA1 3ada90ac7e6173b27733348a7d73c8ae8d47bd2d
SHA256 d665e6c69ca9c426890773b4efc20b0ea9ac1c2cab884110311f5c88e6787fa7
SHA512 05a326235040494ccb5d22c15714cd393e458a3805c81378c18d8a44c4aa127ca71427d8b3ebb3939ec9ae98e6c25cf52235cf332dcd2e48248d74d42d854136

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3e885fbf0119f7510e5f95ac82214b76
SHA1 f1b0a8dcdc325da25c136d424625684d0ef84596
SHA256 b2bfeae08330926697e24e6bb7325d777e6ff74a10ab921725e9178b679752ae
SHA512 2af8cf4cabe55196ce52a2de017870c187d71333b4003fe4ce6782fd269961613f036dc4b5122bdd244f072e72cc507d694533f1e9a75ccefcecaf44cf45b3bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0a0f86665905f0230e0a432bd40ac45b
SHA1 3033a23d9b4c88495011464b4cd157df8590fd49
SHA256 eeae8fbd2cf51199dc14c3e4c207d2e67ab819241edb064925c5d6ff5ca7bfd0
SHA512 d2590610765c1bd5f69a9387b5baf94466d01bf96bebeb54b2af8ce9c25d3d7e7b14dd7c41d06548a31f8c3203327f804d961a188db9b64de22ca2d77e9a2668

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

MD5 5ce7bdeeea547dc5e395554f1de0b179
SHA1 3dba53fa4da7c828a468d17abc09b265b664078a
SHA256 675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9
SHA512 0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bf2308517db04c2a13453d106a9a15bf
SHA1 ea8ba134e578a3f71e32eae823f984d12a21c972
SHA256 e260293f09543e3d0dc840f50dd285e8033ced0828ce40acc0942322e92fded4
SHA512 1c559c6bdd2df371fee48f5dce43f32401c5863297da25ef71782bd81a5da6d46da5fdc1654057f709447652fe6574bf41f47503b220af1c93732f2ab3f0dcc6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 96dbb80c2c0d3d7d8e774d6a95767250
SHA1 32ce9c06a5ab439720ffbb15e1b359331f8ab863
SHA256 413ee875dec7a2271e232cff297c209ed7016b0773cda8814557c83dd1e01681
SHA512 abb536e3bc91ab8c1efab6cd38109a4247e8b404d7a2349865143f195b970980ad84d35dadcdb1a5d74688fc348d71781555cbf4956e646333441741fe066c8f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b70.TMP

MD5 4be4313bcd40afc062f79bbc923dc20b
SHA1 3fedfa06a7c4f9f4286354b12e02a4dc327841c6
SHA256 66ff51975de41974625232bcb2b8796c694e74fb7113c9c5e12d6792f6337d92
SHA512 c9f896171a78a1ab96eaaad79162e22e3a43064031046e846c8a6ff8927ebbb51a01ef4c5ac3c5812d02cd8af166582ad3e6d8eb3f7ae0f95e108a9d59575ab0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f85c7f3128a90ad70034532d3716e792
SHA1 43d3c2ee8aab42694be42d039d51398c312e901f
SHA256 5544f8b8cf400b7fb7d8f3f629f9e13bd27d6e7cf95176dce70c0cd8c0561c6d
SHA512 5dffdc48b77a35ee3faa055cf98cdd918b2eff1416a5b9bc947dd0c321b378b4c2866cf46f26a825b3946fb140e939ddeeac5605c399736db379742a259a58a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 82ac7bc72a06c54f201e81959580fd1d
SHA1 f16a1be5c1a908a733a14e61300933dba5ffb749
SHA256 449776f635d4a627bfbace75b6c5d6d2b2aec242841880482768d5d131260276
SHA512 7b03696df3733d05bdaf026fa3c4b2b8cd66b07c992f93dae2b983dd24918505e75411cff6b8155c76668e62b67fb184b0f5bc5aed3ca0b95e34497590d07e31

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a40053c1c61441729ef8428af59092cc
SHA1 5f720e6ea7af946432c793268e5e54d6645ccc26
SHA256 5743edeb44f7da3ece5bfdff8ea215d04377243fc61766990ba0d9285dcd40a4
SHA512 6b320e88c70d9feb65c3fa61c14c50f666fd6eedbcfd9f5844d9654a2fc058b87486d7e2190e8930fb60995d7cc69f93b23c8839a25a319d0cd9522edff74bd9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 0063612340d660bccec716319f094a9f
SHA1 71cf4f3dc4c823df894a8a1961412a0a37833085
SHA256 f60ba00d81f675b3ae186a221b0bd408dea8c418f37303aa5e33217cacb6e011
SHA512 d1a7e4602640e3dd555ea89c9e524915d2c39858a4d8aa1d1fa5a30d6ed4721dea4b6bd3fe708e92c4076af07f6b6efdc1fdb25a5e6d1984b8acb055ccc149dc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 033fac504687c0fafca72c6421b1bc44
SHA1 0ed3097b9f603a50e0a8f17f779bbd7e4717d8f1
SHA256 aefa79a4dee5842fcde86cf8baa0c43ff57f6580e906bac790312deee9effde5
SHA512 38524f777afe99110c25eadbbc2411e1bf74227abf84c0b2b167bb5b9a437efec42db1d166e09cc46d76e724113082e574cebbc32081018418feaee1ce2f40b4