Malware Analysis Report

2025-01-17 22:47

Sample ID 240603-pyxstaeh3t
Target 91d439b9f4ec8b1700ba3f6a43ecb5b8_JaffaCakes118
SHA256 8996ec3f2c7b3cc63f744aee8f3f26fb49730585558de2bbd609e1d0e81b0c8e
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

8996ec3f2c7b3cc63f744aee8f3f26fb49730585558de2bbd609e1d0e81b0c8e

Threat Level: No (potentially) malicious behavior was detected

The file 91d439b9f4ec8b1700ba3f6a43ecb5b8_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 12:44

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 12:44

Reported

2024-06-03 12:47

Platform

win7-20240221-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91d439b9f4ec8b1700ba3f6a43ecb5b8_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c7c0d73b63e9d49ab248d40badff9eb0000000002000000000010660000000100002000000070500d472d4f4a300a0c27a9118c59cbbf8fba92ae364db381208ade7e0673ec000000000e8000000002000020000000b2e93e6d863708c2f25c0248bd12416af1495cb5b02426ed23f5d7e514e9b2062000000007def95d9f3abd3f71e4542725334ac87b8a3d34b3154b6ffec75db5f4611258400000001636e3f8e0782dedf6cd9496740cc3fa5c8c64955f9e0ae05468a48318fd1f7d664343e5f9fe94ec830c4ca5006f614c4a99a510469bb64584713b465db6ee09 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ca5bffb3b5da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c7c0d73b63e9d49ab248d40badff9eb0000000002000000000010660000000100002000000016e23393c8266d4b44ce19acb0e946e54003237fd2d3ef61819b18ebd1369ae3000000000e80000000020000200000007910e4952aba59fdb6c4f9e15e17b1a62e2ff1cc316ff922be96d176bd56b72e90000000a46bfce795d76501bb509f67210d98e4116e1bb61d05520750d89f2586606d956bf5f3ee6624029f878ab182e4bfc722bc1dba9c875b4f8e2b346e0adea55eb3df509506342159eff606f545d7c75238f4388967e95ce04c5fbbd31af974e67e615bd25bc8381e4a0357667eb907e7976f90f7da5ef40d2012db6eeae792159d224f797b5f2178726d0559715242b49340000000b1cdad7c602bc54e45772657fdbfcf88cd2e8ea1fff689fc6e001b0bbaac4d75546b6f6dc515765e39d717eb901d5317018bca390363f7eb9bfac8cac3fc971f C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423580559" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11C57901-21A7-11EF-805C-EAAAC4CFEF2E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91d439b9f4ec8b1700ba3f6a43ecb5b8_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.multiplayernetwork.net udp
US 8.8.8.8:53 www.virtualtuning.it udp
US 8.8.8.8:53 www.barchetta.cc udp
US 8.8.8.8:53 pics.livejournal.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 farm4.static.flickr.com udp
US 8.8.8.8:53 www.californiaclassix.com udp
US 8.8.8.8:53 ls1tech.com udp
US 8.8.8.8:53 www.seriouswheels.com udp
US 8.8.8.8:53 www.autobelle.it udp
US 8.8.8.8:53 pictures.topspeed.com udp
US 8.8.8.8:53 www.007museum.com udp
US 8.8.8.8:53 www.americanmusclecarparts.com udp
US 8.8.8.8:53 www.bmsc.com.au udp
US 8.8.8.8:53 www.velocityjournal.com udp
US 8.8.8.8:53 www.coolmontreal.com udp
US 8.8.8.8:53 clubs.hemmings.com udp
US 8.8.8.8:53 images.caradisiac.com udp
US 8.8.8.8:53 www.mustangdreams.com udp
US 8.8.8.8:53 lars.gfxdesigners.com udp
US 8.8.8.8:53 img143.imageshack.us udp
US 8.8.8.8:53 farm2.static.flickr.com udp
US 8.8.8.8:53 www.autopremium.fr udp
US 8.8.8.8:53 carplace.virgula.uol.com.br udp
US 8.8.8.8:53 resources.blogblog.com udp
US 104.21.36.240:80 ls1tech.com tcp
GB 18.172.95.84:80 farm2.static.flickr.com tcp
US 13.248.169.48:80 www.seriouswheels.com tcp
GB 18.172.95.84:80 farm2.static.flickr.com tcp
US 13.248.169.48:80 www.seriouswheels.com tcp
US 75.2.71.233:80 pictures.topspeed.com tcp
US 75.2.71.233:80 pictures.topspeed.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.200.14:443 apis.google.com tcp
US 104.21.36.240:80 ls1tech.com tcp
DE 20.52.158.121:80 www.barchetta.cc tcp
DE 20.52.158.121:80 www.barchetta.cc tcp
US 38.99.77.16:80 img143.imageshack.us tcp
US 38.99.77.16:80 img143.imageshack.us tcp
US 23.21.227.230:80 clubs.hemmings.com tcp
US 23.21.227.230:80 clubs.hemmings.com tcp
AU 139.99.144.16:80 www.bmsc.com.au tcp
AU 139.99.144.16:80 www.bmsc.com.au tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 18.172.95.84:80 farm2.static.flickr.com tcp
GB 18.172.95.84:80 farm2.static.flickr.com tcp
FR 109.234.166.54:80 www.multiplayernetwork.net tcp
FR 109.234.166.54:80 www.multiplayernetwork.net tcp
DE 217.160.0.229:80 www.autopremium.fr tcp
DE 217.160.0.229:80 www.autopremium.fr tcp
US 104.21.73.10:80 www.mustangdreams.com tcp
US 104.21.73.10:80 www.mustangdreams.com tcp
IT 94.177.223.60:80 www.autobelle.it tcp
IT 94.177.223.60:80 www.autobelle.it tcp
GB 18.165.160.13:80 images.caradisiac.com tcp
GB 18.165.160.13:80 images.caradisiac.com tcp
US 198.187.31.9:80 www.virtualtuning.it tcp
US 198.187.31.9:80 www.virtualtuning.it tcp
SE 93.188.2.53:80 www.007museum.com tcp
SE 93.188.2.53:80 www.007museum.com tcp
US 8.8.8.8:53 lostwebtracker.com udp
US 8.8.8.8:53 green-tracker.com udp
US 142.11.213.180:80 www.velocityjournal.com tcp
US 142.11.213.180:80 www.velocityjournal.com tcp
AM 5.101.37.37:80 pics.livejournal.com tcp
AM 5.101.37.37:80 pics.livejournal.com tcp
US 207.148.248.143:80 www.americanmusclecarparts.com tcp
US 207.148.248.143:80 www.americanmusclecarparts.com tcp
GB 18.172.95.84:443 farm2.static.flickr.com tcp
GB 18.172.95.84:443 farm2.static.flickr.com tcp
FR 13.37.38.102:80 green-tracker.com tcp
FR 13.37.38.102:80 green-tracker.com tcp
GB 18.165.160.13:443 images.caradisiac.com tcp
US 104.21.36.240:443 ls1tech.com tcp
US 209.182.198.108:80 www.californiaclassix.com tcp
US 209.182.198.108:80 www.californiaclassix.com tcp
US 104.21.73.10:443 www.mustangdreams.com tcp
NL 95.211.75.16:80 lostwebtracker.com tcp
NL 95.211.75.16:80 lostwebtracker.com tcp
IT 94.177.223.60:443 www.autobelle.it tcp
US 8.8.8.8:53 static0.topspeedimages.com udp
GB 18.165.160.13:443 images.caradisiac.com tcp
GB 143.244.38.136:443 static0.topspeedimages.com tcp
GB 143.244.38.136:443 static0.topspeedimages.com tcp
US 8.8.8.8:53 ic.pics.livejournal.com udp
US 8.8.8.8:53 apps.identrust.com udp
GB 18.165.160.13:443 images.caradisiac.com tcp
NL 23.63.101.152:80 apps.identrust.com tcp
US 142.11.213.180:443 www.velocityjournal.com tcp
AM 5.101.37.37:443 ic.pics.livejournal.com tcp
AM 5.101.37.37:443 ic.pics.livejournal.com tcp
GB 18.165.160.13:443 images.caradisiac.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 x2.c.lencr.org udp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 bmsc.com.au udp
AU 139.99.144.16:80 bmsc.com.au tcp
AU 139.99.144.16:80 bmsc.com.au tcp
GB 216.58.201.110:443 developers.google.com tcp
FR 35.181.129.203:80 green-tracker.com tcp
FR 35.181.129.203:80 green-tracker.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 216.58.201.110:443 developers.google.com tcp
AM 5.101.37.37:443 ic.pics.livejournal.com tcp
FR 13.37.38.102:80 green-tracker.com tcp
FR 35.181.129.203:80 green-tracker.com tcp
US 23.21.227.230:80 clubs.hemmings.com tcp
SE 93.188.2.53:80 www.007museum.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 e08bad06655fd4cc20864d0b49d9211e
SHA1 8802fbd3b83575a58d5da4fed93475d69ec8b7e4
SHA256 ea1c1046e7bff52fb95ad22abef888ce8db861223fdf69fea8564c9e035793ac
SHA512 88a65ad2eb9086dddd222d2915d548c49db99a58d2d70b1598f2f4108db056106c8563b4f692c45799a880c359324f50120e75ce5598364b67fb51fa76650a29

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 82b4b36b988ff2e292e7b9163abb4dfe
SHA1 905d7d88169628748202660be9ecaed0ac2e1071
SHA256 c3f40f42c659b90b1d8368733817e65ebfdec6fcad2fbdbc24b70b3b2df9c20b
SHA512 f20548215bc88ff4d28a2a2eb944b07a243b13967e42dffa52a45145ee9eb8059eb098e374f142a0570d0c7ee490948df222b44e9ee3d3af45107f6e9855cb8a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 13ed5e0369cedc64c8437eb9a493a981
SHA1 880053c91809fef7b2a3d688143f554d5a05c0bd
SHA256 3560614f2f62c19498d2ad6c3b9fa8f232883167479de05e924a5a3ab19a8454
SHA512 18b3c940a3b722b58c476af4141ab987ed9f7557c1e52f3f20548b2c209abd67c943761d22e20ed59c36d69f8cd911285aff7efdf2d20f51c35cad62932aefa0

C:\Users\Admin\AppData\Local\Temp\Cab7B0.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar7C3.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ab90dcb876cd24c7479a6e0af5f847fe
SHA1 de1eccc068df33b32d1c59591314d5be781b731d
SHA256 d0a7af4c18a2fad7183718cc27d40f1c394a3303ce924f53b438ec66cfb1cfd5
SHA512 7253ff321dc61a0a7944d8662c13157fe71c3054792f32d99472f8d4dfd9c1372559af6ba98315118147bd50d8846f567b9f8f08b592bce73300e1fc7adee848

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d77d374b819ab74810c846dcc9340bc8
SHA1 176a67f2511e170f485429f9316fee314c3e5976
SHA256 9060bf0519d4ba3307f9770d29db487f030d08ac16fb2ede15b01662c146bf6a
SHA512 c21dc9f6d7535fbf697b2247a58e9e26d816ea51bfa149778e8f79977da2fc18e0e47a1c04217261acd4831a33536350493661bf937c7bdc5b812d4f51bbe2db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1

MD5 6d340ca0c455f311b7b04ff0fbb63daf
SHA1 2a760a2932e47d7f4efbf3d4f7e8d6d5f9ca4d78
SHA256 117afc5801d2c73197e8190f9ff1143965d00e696bd99ebb9a83453272b96fc0
SHA512 f0d2cdc71966b7ec7b3fddc225ff7282c32a786fd40e38126eb61d41b7e59fbf3c3c764df05ca0ce3d0a3b40d93071f7524ac6b9aa0529bf83c67b0483fc77b2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1

MD5 3cbd995f8bc61a3669d6dccec2391d8a
SHA1 39e5903bb99f1d045f6b0c2429b43ea8e2d551da
SHA256 d302d7266945490d5d06e91e1c2557830688004c572f39343357dfd57ada50e5
SHA512 6335e0e9db04d46564a47818a02c3ed714ee705dbc70ecadf252f2813ef62ed14bf739ea545d69e3214d21600a2d9257013545ab3bd7eeba17fe1fb07b2a22ba

C:\Users\Admin\AppData\Local\Temp\Tar89A.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a60c989bd4a447118b2f231d4811c1e5
SHA1 dc77ed9f0d09ce94f05ae4c4b4279b6a3bf04ac9
SHA256 b8bcb6e0eb968a1a6aa4fb7e069d2ec8c4f8054a953e060a9ccf8e4dc828fb40
SHA512 2d29010978b3f203ff87b01af42011434dddcd452203a1584ef90588bb8eeaeadd06c1d27d4e5b2e198d9e8ba95f1aa654c7f3ca0b6d18cdae89b8ea456eb5dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 12d92d8c39dab3cafa60093b2d98bfc0
SHA1 b03fe23247c7fff0e3688c03e10b1b301c089df4
SHA256 f4e29455b7d6df3bea5ca53c92df5f727fd2d51573e5cf5b6235fc75bc3ab94e
SHA512 8ff282eaf780f6732c3c8714d454c10c819fcbbc9a6857e0dadf1a4df551318ca775b096abe935415c59dfb226c274b35dfa10f200ece1e792c6e63e266c00ed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3849cd19972e6147bff20e83046edba8
SHA1 d5eaaed6955f6e21c90affbb11d39dfdc1206ffb
SHA256 150fbb0ef280011c91eff3ec27d70afa8449a3bcda3210c29beedfa5aa54b8af
SHA512 71c7d53a77123f103fbe74938965b1045520abaa7e8f9bfaf41a7f44c57e5febfea934dda3ca49fe852367df15e50f4d86b80af07694fc3385bc23468809ba11

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 2689015c65904d1a223d5897c02361e9
SHA1 6a5a1da88a93b5a53bb55168692a214ea649e12c
SHA256 39e3ae3403f2fdbc0f89b61054cc6b21d94b6e7a7f40f5d0185107d448e6b776
SHA512 a75afe69f323457f4cb4bbdb2419d8f8052837f5830508b263f5c5604fdd044c4fd62518a7e34532efc8888d741e0569e68f42385d1b835653ad7ea6b8b32d87

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8eb921855af4023e40925e6f6ab34d3d
SHA1 ec95c2af26414dcc1f079c7b326edeccead630a8
SHA256 6723a27197b7e171687269795353288e0d27e5e52abebefcb9ef8a168d3daf6d
SHA512 ba59b7759b8a5c8830d05315c41cdf9d923c8c17795fa42ae9371fe306b0b2cae12ac8635ac090d5d2f33d551492e9fbd776eee49ae910f957419a1720c4ccad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d88349f294a47951c6fd9e0b326abee
SHA1 4fb2fbef2c6c02bd4ff3597f69fd406750e13af9
SHA256 5c1ea1faebf60be1ddbfca2d2c2028d8f183c1c5840e33f72fcd3a4cb3dee5de
SHA512 1c22e5bfe825d281772e63cfce5594c82c3f413b8378280eb478c0cf89043b68a340d8ed3ab0637a17d5e39727ce6c0256bd1d74b0e04144269b81bb6e64f8a2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JB8Q1DZR\platform_gapi.iframes.style.common[1].js

MD5 682c26af19b240f98d2cb951721fa54d
SHA1 18e58b652c7f82a55ab4b1910693686049e25d62
SHA256 96428f0f585a874c185d560538ad83ebfad0365d760fcf9fcefe80add9e3c980
SHA512 078aeef086271b7f9cf0f6e3a1e7908d7e38465a1a7a4de6f2a785147e9130551a2995e80600824da9341d58e5425d4505518e90eea9ffe1c64f4f41825a9660

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\cb=gapi[3].js

MD5 f9255a0dec7524a9a3e867a9f878a68b
SHA1 813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b
SHA256 d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d
SHA512 d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc21d67c058c4c0baecefe593b296bab
SHA1 8eccb497df4a3bb7977bb8d799f7676042a25ad2
SHA256 930ffc426e8c18f7aa1e66fc25139cbc6dad3130d775591e87d25be016dfa479
SHA512 5e1c7a615d5d21886f40d1c8d5a7d7c3731f129bcc63144803366a073f65657df7e243ca442cb7c1b3527574c55ac88eca5eeca5c7b7799f3291aadb8e8eeee4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b7af5a81cf8f2e9c8bd8985b8427b8a3
SHA1 f04584bd7db2d3e8dba7e654c982b28660f60192
SHA256 9114c7c9d4e8fbbe071f06cb828145f9a65a3d5295c483a4344e0dd18dcffbfc
SHA512 b4d5f420c9e06b9110fd45c73bab7dd21f0e3bd523a45243fc51b926d4de57225e6631975788461249c723d46e93e78c23c4c0f068052dd74dba81c1c609f68b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4080e269ca511dfa091217b0529cccd8
SHA1 cadfe5389d3c9318e5de4fa98558738a019de277
SHA256 a8085706f89c6e402301ffa3521f5c16dbb4a6fc4dba0c8dd2057c047af235ff
SHA512 5aabb2947e39f3f71930548c005cec733ca5ca01cbefa1cc81487973214293c400f062b48d1b86a030939d79739818a508ee914918aa0b72b0acf6e688e94b57

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7459fa20325270b3f8fb13098d7cb4d7
SHA1 04f554ce2b2b5bc52ffc44771cf3b3895108ad5c
SHA256 1b33a6bec3935721f93eaa448d44d211dcddb2e495d4df4d2c10e3839b6bb749
SHA512 dbb35890814e1f989fee71eb301bb21e330d64187a43684981af7575b1b59aeddb5db5d69891de59e0916d431ba87ddc65f01546a9b1625db26ffe9a0d553f96

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 30c9867cf31952f9f905cc19f9909aac
SHA1 78197829c7aee48f3fd513befdb012f7ba788112
SHA256 7772093444d0718cb904018c8b2670bdffd976bdc9c2f290f6f64c493072d2d6
SHA512 fbfd9da53af713ed63b61f11c393fd22f76c375281d9caf41c8a339aa010d8ae4db718782a4dc9ca28429e8434f6c8d08982e889ab979b3de0179de7d17aec7b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f1569cadc683116921e6eea1f0fbcdee
SHA1 ab34e653dba112da15bc846873b3d7a18caa3bd1
SHA256 d6aaf03b2912c73a2a980ef7f556ee5c48bb3eb9d551535f25eaf0bd4b57e094
SHA512 9b89f98d61d4e66c0f7c501802cb71ada530bf55a24703d4bbdafac790bba37dda50973e10c7c361a1b28a63af4f361b721357d77fb8519d940f9a75128d957e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ee6edfe57ed495ee5151dc7b39574b42
SHA1 4bc89c402a2c00d263bf9964ad169ab912f6048f
SHA256 15cc0b486b858dddf33531f224a87b19ae54246c236e09113c0ed3567d437823
SHA512 1e32a2a8e4ecb014a5c445ea2a50b6fcc4a5893d21440c960d0a5de40414e5f7caa08a6c519a633a39b79c40895347a0deeb97f7240b818741018a82d7854b8b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 54f4487e9f740760b827c4d841e63e6d
SHA1 46e489ec90a3c6ec55249cc6d646c90d5f570dae
SHA256 1cdf9c86eaec1388a5eb086700f48e2df0fb9ed04abb96e719e194addd87086e
SHA512 4a2c414208152e8a4657bea7067b632d97038f94793c4816fbb2574dc98a5c188565ba394dbf8d6b39f1c0de55b2e7f5b71df61fba2458afa86aa98ce8ad37de

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 adc69ddbb760857efd00f64a9989d584
SHA1 73f5320b3f19795e906af27863ce75d5a0df7c3d
SHA256 74cf9a9c9263dd8dbb22b7a9cb751f6e6f65d99f334518047b9892472589b6bd
SHA512 0f1a8b6674bf5dd1aa04be3210745737a23011369c1627ad86647bf43950a919a8beec5ec6933288a20da64840079402751d7429fd60ea9b7e9f8db9b1b9dd99

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4bf8c98829232e26082773d81c9fdbdf
SHA1 8de553eed5a644b604a24fbfeffd521bd99da4fa
SHA256 5d2fbb7412d633ff81ae4f8e6093cbe88b3122a951eef54accdb23701a8da7d8
SHA512 61e9613e63981479881fff36985ee238254a846a75273597a60964e0e35cee62a9bf43209902bed3c098e27ea2b30918a284c808113753c181ba870c93723c8a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7161ea4623fc832a660c8413b1200d8
SHA1 ecaeca0fa73a48c880d6c014781d5b09867546a7
SHA256 48f85577197d015ad6519a75be4ae40bd1af548c84beadb48647bf4fff598255
SHA512 48512ee03c2c2a7b4ebf96e6e504f7894dcff1defbb28964db86110e5163a2567b1e364d40747beb93682330a6d62a1df7b5a1e3e3f9b2c8a712e8685c9819c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fa20b0b02e940c15f799a9e9216046a1
SHA1 593653282ee44bfa71ab5381302d4eaaee64912a
SHA256 50e3019abac4848fcebfe81b3b1f7e405ed3fa3a2f63a397be31bb6fe207c3f7
SHA512 7f302f140a047739d4c2732cad2f78ddfde1e33ab17d30ea7ba1d3b5476a798014225bc4a1b149aaeb6d71295e31f2c8ab20d42d753abae611b427134deacaf1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d2c9450dbb7e4bbd7affe8e85309ab4
SHA1 b47b3f5f7d7a9dc8a314400c80d825344ef17658
SHA256 ce332b3403475c968546fda418a36bcdfb9e2271be65a2a16ac1c138cecf1272
SHA512 fc7a9d47fd7083f1750125ba07e3aeda467d12c7f79dcf5a926823667efb95e18a37dd1a4ae1c6553abd88e66fa6fec9e0635a4e46173ac6edf004537f03ecb2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 288dc0f4fa3cc99deda301c3b80bd11a
SHA1 4e11413eebba95404d66659be597ac3e9f740f40
SHA256 1e4196d6eda88acf037861aad8699f93f71688aba0fe494a767bb323731fd0a8
SHA512 7e8c5431ac6c0d08e294f6931531c73a7e3b2636a4733c7870a5b1b92c621aa10faa07e79f9d4ee1094eebf76a60b2e2bc798769fdf5291ada321dfa84825c65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91192853ba837bf7a3fbb028d96d8bc9
SHA1 d26e1750ea26b852a52d944d6f118366fc3a3e9a
SHA256 a232a789b74e4994b01c07fb13ff30258d7f40d63d3e1c9855f82e1b42258248
SHA512 2dbfb54b87135bbdfafc528a88820d1cf0b65c60cc147907dd43a764c1330db1fe28dccfbaa7ca23624696b385595ec17b464d2f3e10300f3d03778fa454dbfb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ed05282c4fdb0f85a3fd33e91289e3b4
SHA1 05d5271e3e98341c7d885169cd33712a314bbe8b
SHA256 91b29ad46cdfb461945264138263bbc548021115888c312e135a8bfa626e0d35
SHA512 bb00acd830ec83e8d84b4134b889caaa3ed49f7239ad6196f58a83cc38d61e7e2c6ab32a533f85b3c544aa16601a03b84b4f399010010d24c5b4520c689ad66e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 aa859c6bbdf324983e24e595bcc23c3e
SHA1 3281f6826a17ba1ec1d2e6161bba9a6f3ef296b7
SHA256 0093d478627558ed6005209b97481b112739997ed855766a453dc0a62645f6ef
SHA512 38fd34cbfcf61819bded1ff5b5d5921432e3020f2056c4f493108fafc083456ff8a76292f728c8c0b4272b4c0547e50abd647407416069276cff5936ae5e4b8b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 14456d82b880e88b6c6e580466ccab06
SHA1 b035c1a5da9ac317c4983638738ba10c37d30707
SHA256 29bd1c9cc0d1daeb3eaeab2faab511d38a1a4e52ecf9d21dc4c9227839456f91
SHA512 990eda160dcc725611ebba8fc1797fb20df0516a43542ebe2a312437a46955697f30d15b45538871f5da5ee1667320de9aa67514be177ff624417a655870de2a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8435e4e806ccd124e09ebf8aa6c2ed9a
SHA1 b88191c7297d050e4a6cce79edd82c7688e1a165
SHA256 040a209e9abf08431311db42e7006db76d4cf9236df30d9b90d3a9038c99cff5
SHA512 52f717dac2aceb142c308e069aef25168aa8ec0fcfc4ed1bd84c5e9c748b7c05b9516ab501c7f8ef0ad251bdc3618576c25473bfbdc47c4881837f12b115cb22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 882e258223b02510272b8aecadd181d6
SHA1 61fd6dcd9250b374ef863dd2661eff49f8e2648e
SHA256 6f6940af4495a192e7f694343daa4ff5078f932490b8e36d8ba3df52582c70b6
SHA512 4865f479e86258ea7b175c23b831cf4c2059cdd2ba5b6453595464634c60b549f58bceda6d786846d1a04fa1a6403b5ddadc6d93160dc1af5511782e1f76db6d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 add370fa641ffbc942fecddc7021cf1f
SHA1 51f5caf520f71f688d4ccf5612a6447b662cce4b
SHA256 3ab85d746d46a0cfbe66636722f2a8c50fa44387b79916484fef1afdd84eddbb
SHA512 754574a10dcbf089fee90f48ef54105df3297d6a0e4e9a80a0883038b0719509fa4133bf2c85aee54c86e349aea89e97822332108ac71dae9eb3ded27fe1ba70

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4442e198bf268c420b80c650db813e4c
SHA1 12aad8ec6453e40ea6fb2fadc34b58cfb441ddae
SHA256 fe3a037583bb220ddfdebaaa3e06c09d28073c56441c16f680a98cde0c36636d
SHA512 32c375a485e11bfd47796afd1896edf22d58bf1b4c3b8762934cea1a83ad8ee8009ca98354f527a039fd307ca48399200bcf043ba113a622334947afb18b4f8d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 0bec7703d8d78cfc6dc760b9c7918ee8
SHA1 49297a87b8785f8ff66df7a018ac0a4f7a684271
SHA256 dd67351264e470b2e49f6770583e63b42b1a2c80e5e34793115d75dd335ee9f5
SHA512 0a7509fab1163f73be6632761f01b6dbdefb6d8a09dc25a80dcf180764845ee7191996b50d9e324422af845f198098e3bc4d23dc46efa4eba81fa2a9332e0340

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8e594f47091895b84d04de0ec2e43b62
SHA1 13cf3bc85005657280f6a229fbebcf79dad9fe00
SHA256 a4a683ca42d7b8d1b88a759e24c79d1a14b22ad324b4e481806d29146d63bc95
SHA512 d485c4e1bacb5a08ee989e0e06b2ce57e0e6f24978c12e30bc37487abf3582e7d9bb7366211d388b671e6491c32869f42ccca65f59b1d0665e44669d55893321

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5bc95417219ec69e2767d5d0a6652f5e
SHA1 6f644d729368653668ae0905f644d7fae6962f9b
SHA256 8d905f83ec20ea9a453f298e9f632e4fc89a86975af41cff0f56b38454da2685
SHA512 214e610ba34a3171b73c8117f2fac397a8ecc827bb33baf13fe89b41de1a2d850f13ab62ae5297b553484db9ac46183b11fa15e0ea08b2b41e19c2769cf685ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6483e0ff973d1860f5a0880bd350714c
SHA1 08b01070e2c4bc030ca8f9b68c76b17f909ea628
SHA256 29ebf7a2794edfc91246141d23a8cac76a1ebd89a0b85a08cb7b9962f804540c
SHA512 8ea2f8eaf8ecf1b6fede3834c9bd1af5011e19a4fbd78ed32f101581bd8099bf5bfe3a8418221deb9dbb680aac3d1605561ab5dd7f5a4cfdfe05d4ce5a297e71

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JB8Q1DZR\rpc_shindig_random[1].js

MD5 6a90a8e611705b6e5953757cc549ce8c
SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d4921d1c29141deaf4cfd116b482a646
SHA1 bd5a985e216a6bc8426259b6fe820944679f6a0b
SHA256 cde4e79b326e3e4d1be3409a176046090ff8f00bbfe4909b6ed3f3cafec43b8b
SHA512 c29e6020c36cdb29ce95c32e2f1c9af64080846dd740f395deb1ea3761c712b3ffd95c858227ab94706886ca01e82a31d6a2d7f4b624bbd597fbff472b604e94

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 13712102630c64270a66bc2f32d4443e
SHA1 adfbb4b108c4373c83fa88c0d482204b11db15d8
SHA256 8ffa5075792903366f13c34b85dcfcbbdea215232f2a1c6db5b830732eec5c50
SHA512 66c32888f8d572fffe95d7abffa1625f0bd575936ff14415b5de24b5568ddc07e5b592249a86b5362280daead70757adce8e2036a5579ed03d269c8a0c8da0f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b803cb3c63c594fa4da2375ad90a05d5
SHA1 436737494d9e463ce7407ccf5e6cb60a646712f9
SHA256 5cd2a50e43bc2816ff0f822b2d5fb97f2a1b2ef8e153494e0fd0a8247655d78c
SHA512 06e92a2a062a5bc419529a25660b290a1f21886a545fa3349af80a16f1088cb4d83bf9380bc392d617c9c97c4aa08f357b854fce6ae96a3db481a9ac6ea6cc92

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b318ecdce877e09d0ff8f6a9140cd4b
SHA1 1bacdc9b778a1e28ffd7df8c38c8adf20d09587f
SHA256 6f278b87a4196ecd6b0112520ea311df065fc731d43ee66bc3cd84c0a3b0d762
SHA512 7312ee253f05779bc83efcb8e1d057ab080228b6d435302d70f23a754fd3c22a2ac586d76bbfe715c94b2475d6eadee29322386f169ec4ae37df2648690e3d8a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 998f392a91e597c961098eec14243753
SHA1 55fa00986297da9ee8007e5980dfe162ace8a311
SHA256 11b866242e052b61b52c4fb6fc0ceca8391eb5f85924cf842bd9d485aedac991
SHA512 1fa1b276ed5b3769187c4b9d4017ce98eef41c1fb0567046a5d761e5ac9ba26f14a31d31bfaf4c0ae55643b32a9cfc3a7f580d0bb5500edafb5f085148094c66

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8cc660afd0880e68ec17f4eaebb5733a
SHA1 d69236dfa3ddd35a1ee8e6335a5c605c977ac1d8
SHA256 19ec4a12c57722ce0141f6477ab2e41c3701b6313c97c1a54387f7eeee0370b4
SHA512 6f825b5162c71e9934df98b38c8c911ba887d70c20c4c3138bde5cc1f862500f8c8ab545f4bf7bb32c90e882a28840b36bfb88bbf21a412464373e78515ef158

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11086053e38df72dfcef32175c3f0e96
SHA1 0a7e73458e32efec5de8b74220520704c0a8eaae
SHA256 d1c0b12982c86150e86e92f55c4b5eefc596bc4bb345dba3f7fc11d1c5754f45
SHA512 e5467e974349e9f338268d8bf1cc6d97e43c7ee36367ce09ee1e5c94d077500b32dd040cac8134e994b032a04a5dbf2116b145c76e3e1a08d300b94c71dbc3e6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6c6c1e2656add3895ce6e0e03d808d40
SHA1 75f97e27e4619a117b636323a3d5ae09fc215f6e
SHA256 40e64c1c0df858c8a61c1b276778dd00485217f90b58a48f53b92da80c4e109a
SHA512 4adfca4159a469984f7e60e31ee94ab4e0298ee2281ded0f52d07f938ac28db11a67dc6ed8607af15d4d34b3eca0824921e88d51b566cd28781b3e7850354f2c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6aaf796b1ee09ed5d4f78fa7e513f407
SHA1 cbd65599dd3af676e570acdb03deb9da8a79a736
SHA256 dd024697692ed02c4b11366dab8ade2b22a8a39e8fb51b1b2ca29cc10f5eed08
SHA512 07d7ba35145e0af254720aa2eef762b968d2619d7888966b2858ac3fe8389b52d2ff594cc89d750e72cafd32de41fc9c03b5194d21c1bf3382f862e0b3c8462f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fdf6453133c08ace42756afd5e5b2ba2
SHA1 e0abe74c901c047bc8671933d83a0ee38ac99d64
SHA256 b4944140d6bd732818ae0c1b11e97500f7f8031c226d5d0aee796a8c6de51366
SHA512 9d96ad1f66c6469c6e33d179658287aaa294aeb7616c63ca6f2da6e70a0d1abfe9724f283c40d7f57b1fd90ef5830b7c6ce94e3ced031485376cb5a57782bbbd

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 12:44

Reported

2024-06-03 12:47

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d439b9f4ec8b1700ba3f6a43ecb5b8_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4732 wrote to memory of 660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 660 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3380 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3380 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4732 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d439b9f4ec8b1700ba3f6a43ecb5b8_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa80746f8,0x7fffa8074708,0x7fffa8074718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,3082164849203170035,6134284821237463588,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6444 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 lostwebtracker.com udp
US 8.8.8.8:53 green-tracker.com udp
FR 52.47.62.192:80 green-tracker.com tcp
NL 95.211.75.16:80 lostwebtracker.com tcp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.virtualtuning.it udp
US 8.8.8.8:53 www.multiplayernetwork.net udp
US 8.8.8.8:53 www.californiaclassix.com udp
US 8.8.8.8:53 www.barchetta.cc udp
US 8.8.8.8:53 farm4.static.flickr.com udp
US 8.8.8.8:53 pics.livejournal.com udp
US 8.8.8.8:53 www.seriouswheels.com udp
US 8.8.8.8:53 ls1tech.com udp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
DE 20.52.158.121:80 www.barchetta.cc tcp
US 13.248.169.48:80 www.seriouswheels.com tcp
FR 52.222.193.84:80 farm4.static.flickr.com tcp
FR 109.234.166.54:80 www.multiplayernetwork.net tcp
US 104.21.36.240:80 ls1tech.com tcp
US 198.187.31.9:80 www.virtualtuning.it tcp
FR 52.47.62.192:80 green-tracker.com tcp
AM 5.101.37.37:80 pics.livejournal.com tcp
US 209.182.198.108:80 www.californiaclassix.com tcp
US 8.8.8.8:53 www.autobelle.it udp
FR 52.222.193.84:443 farm4.static.flickr.com tcp
US 104.21.36.240:443 ls1tech.com tcp
US 8.8.8.8:53 pictures.topspeed.com udp
US 8.8.8.8:53 www.007museum.com udp
IT 94.177.223.60:80 www.autobelle.it tcp
US 75.2.71.233:80 pictures.topspeed.com tcp
US 8.8.8.8:53 www.americanmusclecarparts.com udp
SE 93.188.2.53:80 www.007museum.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 www.bmsc.com.au udp
US 8.8.8.8:53 ic.pics.livejournal.com udp
NL 23.63.101.152:80 apps.identrust.com tcp
IT 94.177.223.60:443 www.autobelle.it tcp
AU 139.99.144.16:80 www.bmsc.com.au tcp
US 207.148.248.143:80 www.americanmusclecarparts.com tcp
AM 5.101.37.37:443 ic.pics.livejournal.com tcp
US 8.8.8.8:53 static0.topspeedimages.com udp
GB 143.244.38.136:443 static0.topspeedimages.com tcp
SE 93.188.2.53:80 www.007museum.com tcp
US 8.8.8.8:53 www.velocityjournal.com udp
US 142.11.213.180:80 www.velocityjournal.com tcp
US 8.8.8.8:53 www.coolmontreal.com udp
AU 139.99.144.16:80 www.bmsc.com.au tcp
US 8.8.8.8:53 clubs.hemmings.com udp
US 8.8.8.8:53 images.caradisiac.com udp
US 23.21.227.230:80 clubs.hemmings.com tcp
GB 18.165.160.67:80 images.caradisiac.com tcp
US 8.8.8.8:53 16.75.211.95.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 121.158.52.20.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.193.222.52.in-addr.arpa udp
US 8.8.8.8:53 240.36.21.104.in-addr.arpa udp
US 8.8.8.8:53 54.166.234.109.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 37.37.101.5.in-addr.arpa udp
US 8.8.8.8:53 233.71.2.75.in-addr.arpa udp
US 8.8.8.8:53 9.31.187.198.in-addr.arpa udp
US 8.8.8.8:53 108.198.182.209.in-addr.arpa udp
US 8.8.8.8:53 60.223.177.94.in-addr.arpa udp
US 8.8.8.8:53 81.81.224.13.in-addr.arpa udp
US 8.8.8.8:53 152.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 143.248.148.207.in-addr.arpa udp
US 8.8.8.8:53 136.38.244.143.in-addr.arpa udp
US 8.8.8.8:53 180.213.11.142.in-addr.arpa udp
US 8.8.8.8:53 67.160.165.18.in-addr.arpa udp
GB 18.165.160.67:443 images.caradisiac.com tcp
US 8.8.8.8:53 www.mustangdreams.com udp
GB 142.250.200.14:443 apis.google.com udp
GB 142.250.178.9:443 www.blogger.com udp
US 104.21.73.10:80 www.mustangdreams.com tcp
GB 172.217.169.66:445 pagead2.googlesyndication.com tcp
US 23.21.227.230:80 clubs.hemmings.com tcp
US 142.11.213.180:443 www.velocityjournal.com tcp
US 104.21.73.10:443 www.mustangdreams.com tcp
US 8.8.8.8:53 lars.gfxdesigners.com udp
US 8.8.8.8:53 img143.imageshack.us udp
US 38.99.77.16:80 img143.imageshack.us tcp
US 8.8.8.8:53 farm2.static.flickr.com udp
US 8.8.8.8:53 www.autopremium.fr udp
US 8.8.8.8:53 carplace.virgula.uol.com.br udp
DE 217.160.0.229:80 www.autopremium.fr tcp
FR 3.162.42.74:80 farm2.static.flickr.com tcp
FR 3.162.42.74:443 farm2.static.flickr.com tcp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 8.8.8.8:53 bmsc.com.au udp
AU 139.99.144.16:80 bmsc.com.au tcp
GB 142.250.178.9:443 resources.blogblog.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
AU 139.99.144.16:80 bmsc.com.au tcp
US 8.8.8.8:53 16.144.99.139.in-addr.arpa udp
US 8.8.8.8:53 10.73.21.104.in-addr.arpa udp
US 8.8.8.8:53 74.42.162.3.in-addr.arpa udp
US 8.8.8.8:53 229.0.160.217.in-addr.arpa udp
US 8.8.8.8:53 16.77.99.38.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
GB 142.250.187.194:139 pagead2.googlesyndication.com tcp
FR 51.44.30.4:80 green-tracker.com tcp
FR 51.44.30.4:80 green-tracker.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:445 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.178.9:445 www.blogger.com tcp
GB 142.250.200.14:443 apis.google.com udp
US 8.8.8.8:53 developers.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
NL 142.250.27.84:443 accounts.google.com udp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 154.141.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_4732_RLPJRWVFOYEXLGWR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d9ef0042cdf4e4ac8a8e8dc284393c7d
SHA1 f8f41aacf5aef22691136274cdc6446cc439d910
SHA256 1aa66c25869576fd780ae543b41294bf4759d0c10dd49a936521988172f208af
SHA512 f6c3b2bb212f8986fd140766e40ef42c69c102a600cce8a3112ad3c9ba3b0cbbc71eb51c9810db5239f6f9c39f0f2f8f48a08a5509940152cb172bd90adee799

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 45ca1a318bb649eef30a8f316a13637c
SHA1 bcdaf94bd269bb632a374bc1eb6b45e6f7bf1b2e
SHA256 14d51828c565c21e17fe5cfe867c94f437c7b3b84aa7e2703bd2320594e62544
SHA512 5eac27fb61c8b91cc15d5db876b5611b8f4137c50e3c5e40eee6e6f3a094e30f185ea51f9dd2d5cd0fb8beaa51e472f1f3f02d80dd64cbb4fef7491650aa507b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4df335c685199e3b19949954995767ee
SHA1 725e90695d23ecc9c8019b6bcb91dd277f3aa64c
SHA256 941f6d576087e913455e03379c9505fdf3e43256ece8f8a3f871414079fdb477
SHA512 87975454892bd012269e49c84bbe4e2dcbb31d18b8a2c7f88dc51c5902c54d93a9144d822ad3aec2701521a82167240f767af5ead8024c80d973e063583e156d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 60c3bcb2f2892f94e456549b0c37de64
SHA1 3add7de41d1f191fab9780a865d6b2fcea4fa850
SHA256 69227007fc64b99e4b24385e72e9ecef19c0784bf5ccac7949b80a8cabc01dc7
SHA512 19002dd4790567159e8c3d1c63150bddd7cb300234a92a8c3fd4ec086f52ff61a65c6c07b7cea52014b40a0fbedd122258dfd84d91732860ad02f6f31139536e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5336e5a6874c64bda301a800374cc406
SHA1 843046a2e7753bc089526093a1128a5924fb5203
SHA256 563db63dbf3b5c4b5ba4948f8315277a828c0f0622143a8eb29d912ffb587e89
SHA512 fa0f045bf6e15dc5ced3b73b008d16954a225b741cbf78a33d53fb5ea3a459bb35c57ca32fcc0de1edd1f2a02450d051d005db3edb5f9f73f34e54788ea5cee7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584234.TMP

MD5 ea26bf4b7986083e1e3ed06487335ccc
SHA1 8684f06fb6b3e1a8c2adffa668f12f58b2b0aefb
SHA256 3820138c15e0e77913d7564925c043ed21bf7914a43e4bdab84137539ade96b0
SHA512 911c1a63b289a3967b364a783f3da038a4006de51a2d49bbe9d68ca5804925c7add8281caf68c999a1e5a7993ba5ba428ce80f2dacb2073c2d6ba9c3a17c26c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9473c6477d9caf7afedbbde5449f0f63
SHA1 db7a2cbc82b0f4c1d4ca1b3c365659781e44173c
SHA256 85e3ec7769eeca205c40ac05ef03ef66381f668bc38b561be161c8397028fd49
SHA512 e5686eaae34cf61321a0ee1bc0bfd09e4e3c0b149568118d7e0e831f621a3dbc40da555a700a9344ed87ad4c390a1227d5598a9a122fbdac65482161f5f9d96b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 0163aade1b33e2373c776cadd07c07c5
SHA1 78be29b8ff2fec42904e93c1cd66f7a79dc6c1b4
SHA256 92e5fa9c22a1e3cf6c96b0febe679e01b9b3a578fd111f5127cb757e5c69d80e
SHA512 13a3aa5a23ee8365fa5464d7f44a2b33cc69880bcda208a4731ddbc5e8eb3c76fcce9010f44e9487fdf6222f2c1ef10280ea8499cd53a262c2c774906c293ff3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 fb51fbfed67ae851cd7cb053776d607a
SHA1 069b1809fa87019771c2450631d8b7f9f5d64372
SHA256 754dd74b4b90668f934de90c018406d79001d6da6869b4c03e9a8837d124a298
SHA512 37d53012f67d5bdc79fb906e38bb652aef382d7dfe00deaec80d624b1b6de58f704940760108ec9a7048561bfba73447a53ea0dd6e5ae53acf2ac3b11a875fce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fa412041810fd9d92000146e824e74bb
SHA1 1f4b4601d2debcf9fdc33b6b9d463cc364f2602d
SHA256 f92699fa93d05cf7b767ec5badd4c4adc7b99704f37897d54777f4569cea83b5
SHA512 51c8ed4f27009f48d028ba036cf93790661183e9ce41b2aecbb72d25b6619e3f7e13c53919f9c1293c05a3c96aa5c3ec92f89b793073b1f32d0d75207581250c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 164b2b853cc8912220a6c7b31de46cce
SHA1 ff6f455581775b5c1cedbcbd2c4c1f9173f9995b
SHA256 49c43fe1ef68e00045066b42532847d082923a357296c9a789120a857d8a31bd
SHA512 1878d9356054d3fa301ef2e5503993de1b96cfdf6da5c1f0eb7394880c967812007a8a63086dc1c145da6b05a6d2c6eb8bbde2ba62234f8f6dfeaf94b05fbbdd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 267328ef1dbfd28b4f9399dc64e05e5a
SHA1 fde1cb5ac93a18e941fbedb49863b50b7d552a32
SHA256 9fc457689505b77a572e574662fd652b568c4cb10cb0fb5309974edf52979f98
SHA512 974851f69732f964635f9d8dcad43b8c019337e25ae7e828adac5ea6f3c1bdeef575014a533dafea08e668902c33efe72f5bb10f66b03dc5e27b49ecdc1d39ea