Malware Analysis Report

2025-01-18 00:08

Sample ID 240603-tamp6acf68
Target 925584811bf43cbc53be174e3cc597fd_JaffaCakes118
SHA256 97a05c8df4f1f3305e34e39a42e39a0db42f59d80204d8097a858d4805ae8449
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

97a05c8df4f1f3305e34e39a42e39a0db42f59d80204d8097a858d4805ae8449

Threat Level: No (potentially) malicious behavior was detected

The file 925584811bf43cbc53be174e3cc597fd_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 15:51

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 15:51

Reported

2024-06-03 15:53

Platform

win7-20240221-en

Max time kernel

125s

Max time network

149s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\925584811bf43cbc53be174e3cc597fd_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20232691-21C1-11EF-A4EE-CEEE273A2359} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423591750" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505fce0dceb5da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9c24740ee590b49986b9a21f299f5fa000000000200000000001066000000010000200000004cd6876c26a150a32d3166971702f35ba52b4bc737b914f07bd89e8623463e9d000000000e80000000020000200000004de91820d9a8274d6014fcd9b6acb395231464f116de739b7a733d2045e2afd9900000006f3cd027a748096b759d349008888fd3b5922095a024a206d6a1f8d6d29f5b8971b2cc44495e0bd8a650f1044d281a7415439a6fe1b6e382288385a4505f9ebf6761986f2b83371824c386a7ed3c60bae6d638b5dd2fdb3c18e23a017505d631a727716b0fe8187e28f60ea75d68f42cdddaafa9c9f33526966a72a4cae52fda9065000f07affe15b5d9d62059b663e340000000369ec257058403089dfe96d5728c0a7485df30c88b0bf6a9c17dc091cad0fa55aaf59bb507827700a37f7c81446e701de4322e95e586f0dcf11b8c69f28a7fb0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9c24740ee590b49986b9a21f299f5fa00000000020000000000106600000001000020000000aa23da048f827d08a90994153dd5847acd99938db3d492f346f270631f9d6df6000000000e8000000002000020000000721f1a043a7c04ce2718441d828ab9ba7e880c9c9a582257d0d7ed612e7dcd80200000000341a2fba31fdb4f4723b4f66fa69f84eea7eab1ea8ee84c6648ab8fea066aa740000000d0f8ad7d221847a87ddff83a57b319721305628b932ecb580d361dc7411e3259cba9ced6543af69c5c07d1a3a29a23be6c487ee4c294a2e6f2422d1aa7a7ffe9 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\925584811bf43cbc53be174e3cc597fd_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.ekmpowershop2.com udp
US 8.8.8.8:53 s40.radikal.ru udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 www.coolestcarpictures.com udp
US 8.8.8.8:53 image.motortrend.com udp
US 8.8.8.8:53 www.picturearchive.co.za udp
US 8.8.8.8:53 www.alfaholics.com udp
US 8.8.8.8:53 apartire.chez.com udp
US 8.8.8.8:53 www.sjmautotechnik.com udp
US 8.8.8.8:53 i47.tinypic.com udp
US 8.8.8.8:53 www.carontrack.com udp
US 8.8.8.8:53 www.caradvice.com.au udp
US 8.8.8.8:53 farm3.static.flickr.com udp
US 8.8.8.8:53 ridesandstyling.com udp
US 8.8.8.8:53 i293.photobucket.com udp
US 65.36.134.172:80 tcp
US 65.36.134.172:80 tcp
US 8.8.8.8:53 www.bbsrs.com udp
US 8.8.8.8:53 assets.fish4.co.uk udp
US 8.8.8.8:53 media1.onsugar.com udp
US 8.8.8.8:53 www.alfabb.com udp
US 8.8.8.8:53 files.conceptcarz.com udp
US 8.8.8.8:53 ny-image2.etsy.com udp
US 8.8.8.8:53 farm5.static.flickr.com udp
US 8.8.8.8:53 www.ebspares.co.uk udp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.200.14:443 apis.google.com tcp
NL 23.62.61.170:80 image.motortrend.com tcp
NL 23.62.61.170:80 image.motortrend.com tcp
US 172.67.73.73:80 www.alfaholics.com tcp
US 172.67.73.73:80 www.alfaholics.com tcp
JP 202.226.37.40:80 www.carontrack.com tcp
JP 202.226.37.40:80 www.carontrack.com tcp
US 199.59.243.225:80 ridesandstyling.com tcp
US 199.59.243.225:80 ridesandstyling.com tcp
FR 212.27.63.127:80 apartire.chez.com tcp
FR 212.27.63.127:80 apartire.chez.com tcp
GB 85.159.56.212:80 www.ekmpowershop2.com tcp
GB 85.159.56.212:80 www.ekmpowershop2.com tcp
GB 3.162.20.24:80 i293.photobucket.com tcp
GB 3.162.20.24:80 i293.photobucket.com tcp
US 151.101.1.91:80 www.alfabb.com tcp
US 151.101.1.91:80 www.alfabb.com tcp
GB 18.172.95.84:80 farm5.static.flickr.com tcp
GB 18.172.95.84:80 farm5.static.flickr.com tcp
US 151.101.1.91:80 www.alfabb.com tcp
US 151.101.1.91:80 www.alfabb.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 18.172.95.84:80 farm5.static.flickr.com tcp
GB 18.172.95.84:80 farm5.static.flickr.com tcp
US 104.18.160.38:80 www.caradvice.com.au tcp
US 172.67.134.167:80 www.ebspares.co.uk tcp
US 172.67.134.167:80 www.ebspares.co.uk tcp
US 104.18.160.38:80 www.caradvice.com.au tcp
US 35.190.25.237:80 ny-image2.etsy.com tcp
US 35.190.25.237:80 ny-image2.etsy.com tcp
US 8.8.8.8:53 www.coolestcarpictures.com udp
US 151.101.1.91:443 www.alfabb.com tcp
NL 23.62.61.170:443 image.motortrend.com tcp
GB 3.162.20.24:443 i293.photobucket.com tcp
US 34.205.242.146:80 www.bbsrs.com tcp
US 34.205.242.146:80 www.bbsrs.com tcp
GB 18.172.95.84:443 farm5.static.flickr.com tcp
GB 18.172.95.84:443 farm5.static.flickr.com tcp
US 172.67.73.73:443 www.alfaholics.com tcp
US 174.36.2.242:80 files.conceptcarz.com tcp
US 174.36.2.242:80 files.conceptcarz.com tcp
US 207.150.215.87:80 www.sjmautotechnik.com tcp
US 207.150.215.87:80 www.sjmautotechnik.com tcp
US 172.67.134.167:443 www.ebspares.co.uk tcp
US 151.101.1.91:443 www.alfabb.com tcp
US 8.8.8.8:53 img0.etsystatic.com udp
US 8.8.8.8:53 www.drive.com.au udp
US 151.101.1.91:443 www.alfabb.com tcp
US 104.19.150.51:80 www.drive.com.au tcp
US 104.19.150.51:80 www.drive.com.au tcp
US 151.101.1.224:80 img0.etsystatic.com tcp
US 151.101.1.224:80 img0.etsystatic.com tcp
US 151.101.1.91:443 www.alfabb.com tcp
US 151.101.1.224:443 img0.etsystatic.com tcp
US 104.19.150.51:443 www.drive.com.au tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.152:80 apps.identrust.com tcp
US 8.8.8.8:53 lostwebtracker.com udp
US 8.8.8.8:53 green-tracker.com udp
FR 13.36.144.223:80 green-tracker.com tcp
FR 13.36.144.223:80 green-tracker.com tcp
NL 95.211.75.26:80 lostwebtracker.com tcp
NL 95.211.75.26:80 lostwebtracker.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 x2.c.lencr.org udp
US 8.8.8.8:53 accounts.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
BE 23.55.97.11:80 x2.c.lencr.org tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
FR 35.180.217.25:80 green-tracker.com tcp
FR 35.180.217.25:80 green-tracker.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 151.101.1.224:443 img0.etsystatic.com tcp
FR 13.36.144.223:80 green-tracker.com tcp
FR 35.180.217.25:80 green-tracker.com tcp
US 65.36.134.172:80 tcp
US 65.36.134.172:80 tcp
US 174.36.2.242:80 files.conceptcarz.com tcp
US 174.36.2.242:80 files.conceptcarz.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 13ed5e0369cedc64c8437eb9a493a981
SHA1 880053c91809fef7b2a3d688143f554d5a05c0bd
SHA256 3560614f2f62c19498d2ad6c3b9fa8f232883167479de05e924a5a3ab19a8454
SHA512 18b3c940a3b722b58c476af4141ab987ed9f7557c1e52f3f20548b2c209abd67c943761d22e20ed59c36d69f8cd911285aff7efdf2d20f51c35cad62932aefa0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 058e3335b3d40e9bf201ab692f05caf7
SHA1 3b6a88051167fcf0c8958592e0c6f3abe183bcac
SHA256 5f3c90d7fcd0b2ce8435b260ef4f9c61c0c1f99a57a3c9805ea67e2fe67c5ec9
SHA512 c08f2181a008a6a5baa9692cbe41f00b432d4f2eb21be8d5764ff953b86886361ae5cb321e67d0ccaf3bb1e1c3b60b38febdd57374ac3842cbee79f45529df25

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 a882b0a09cdcc92f502d5cd0648ca37b
SHA1 80151d2b7b8f4f697e9e8e369d1db46907486df1
SHA256 ef777a5055f13abd80f993161915d8e0871819fe8c307166f77472f3fa99e3bf
SHA512 7cd9b70da8c32e3ae89c61ee37862e241c8ea24e7f2e60578570a9601a99dd8ed3e0b06897788b8b9b80df13eb9ef29c4bfdea3e839e0675b593e6b66e233c7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\Local\Temp\Tar12F9.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\Cab12E7.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ab5068b31fb4e7c93ed5078e2f69459
SHA1 10a35770a2523962d28d8a7ed2453c2d6f92f7c3
SHA256 e23e0a2cb273a0168b8f78978225479ce4992ad2997ec440ea915014a6dfd9ac
SHA512 d21e5632135343d655e891f495d665718b84329eddaeaa7a2ed669b082ed30c6a598bb35bfbf09058c21cb20018430cb3d68bdd3f21b0ab3a14ab9fb734989c3

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\02d90ff68f150bbf0caa520815f663bd[1].htm

MD5 378cd52996973e3f240d9e79a76fbd97
SHA1 2f8a8c128726174ec1609c00e18e772384e295d4
SHA256 1938f5f057a9012bf6045a6bfba2fdbdac44ea54118abc0ce581061d6e3c282f
SHA512 efdbaee70080f66856010153b2949abe5cd5ac05deeb51b5ad44b0213cc051908902da3c3a503f42e6185eb11b46c14a52b08650bb8bc71e0b6fbe9ad6bc258c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1

MD5 3cbd995f8bc61a3669d6dccec2391d8a
SHA1 39e5903bb99f1d045f6b0c2429b43ea8e2d551da
SHA256 d302d7266945490d5d06e91e1c2557830688004c572f39343357dfd57ada50e5
SHA512 6335e0e9db04d46564a47818a02c3ed714ee705dbc70ecadf252f2813ef62ed14bf739ea545d69e3214d21600a2d9257013545ab3bd7eeba17fe1fb07b2a22ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8f4dd815f353b46286700f3b518d3ab6
SHA1 cf8a7bd58b5c696e1d997592d99a7180d9544bf9
SHA256 b25c60bc2b3957e57a7eb5fcb649c84366313d235cda568d2fd5495cbec9bee3
SHA512 8afb828bf78dc09f787245c981e1f7c07b47d077cd76601be7e249abdcf53de5f59be63143594602d497f977544d9e0ca220a30c557d6e2bc3bcc4e4079e01ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 3a4c5a5548f3806d9e9bff0fad3cd3b0
SHA1 81c828257204e1595a8d34a1264c4998128af605
SHA256 2cacdef06f2939d82f1bca0f74771068967937ce7cf78d7d92a615b31d131556
SHA512 788c2bec2b78625853d60d6884de837ef02d2f24b2801240d67d7279cae591e8770805932542a537deb176ed1ce360a4a7782eac94f1695e47c9c1b7ac32f524

C:\Users\Admin\AppData\Local\Temp\Cab13F8.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1420.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f85f8732f25145e97a524e9d561c1408
SHA1 dcf7296a5303a31f8ca9d3f1ca304327b1d5fb58
SHA256 926f22d2356839a3f79d6f3010311298060a1e4cf235ed7b19f1ecd064631a48
SHA512 3255a38d260ec6f66bfb32ca70ffeb205a42a8d36e277ad9d5431731b68dfd2dec4129ad2c787ea7feafe57920cdbcc4f2cacd6447a9a5a4d3cf21e168f4f079

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

MD5 d2c2a17ce4e82d338cdc3a0368fdb7d3
SHA1 06258ee86072a8d01f613a366a857ecb64b99446
SHA256 f02c840c8254cb918e636d0f47c1231760d0dec210a574feb1864865601da353
SHA512 8549526cadab7c7db7c4573cc1b43798a15259ee536f0d163eebe2488d5d223fe61dc3f3fdbd8e4bae24bc894a038d1430e321c5c76793db5930416c082e08fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

MD5 c5dfb849ca051355ee2dba1ac33eb028
SHA1 d69b561148f01c77c54578c10926df5b856976ad
SHA256 cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA512 88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cad97f7df2527406d8f81234ae264e27
SHA1 9a9386e3ab2791b3fed8d373a4a7b91d5bf94c73
SHA256 e359528c20a2e34203f664bdc9391d093616e8dda7fec08581f2fa1378e77c6d
SHA512 b2f01dce610aa2507d5cbadb2cc66023b1eb486ef05aeaa7bca012e8d9aa06c572a40c804584719fc3d971dabc6f25bff3806c8d0044e1072cd5703ee755e03a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4786d5253c9409f96d50c716efecefa4
SHA1 6930a3ef98ec0d804f19c5bf8eb3cc6e4408c003
SHA256 4394cea6c6e1bbf5540b71b13d9e5505d4beebbc87145b30a06f8c841db46dfd
SHA512 a48b2b996a3e9e2bdc84b2bd91c57fa3a22faf0df790eb4786f8aa1cc803c4d329d9e96c2792e843dcba5f00f6393b23689b2139891e1f819ae90911bc1b189d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d625d77c8f5cc3c462daef016277cf9f
SHA1 cd24334a07a0b8c193df2a13f6c7ccf4fe2db200
SHA256 628e6fbdf30941972a42a090be935b5d6b0cd18091eac98b1f02b22b7384357d
SHA512 ffd9b5756683c9fb45c1ac4c65f2eeaf5c0f4d8791e8c4878b7dcac4abd16712e01f135da6cb306edf82b6ed5d5effc8962caf8235776c1654daa88dd887ad00

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\plusone[1].js

MD5 53e032294d7b74dc7c3e47b03a045d1a
SHA1 f462da8a8f40b78d570a665668ba8d1a834960c2
SHA256 8076b082eadf0cab4a8823dbd7628a0b44f174c17b3221221c0e31e7c60307a2
SHA512 fe263fe86aea2ba1b86d86305650cdeee45cd1f7b4339f9d4fb81db776b78abedccd0ae77262f45d579751daa26f81385354b3d126fdb5577036e9dd1db33276

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f43c6295974a79cd8b23efbf59074d8e
SHA1 a2b5b4c9fcdb687f0b257602d57bb5ddc61062a1
SHA256 de1b031142ef903e206085670cadb66a79764a035c107a6dcbd5b505294293b9
SHA512 8b374b72797041d0801390449f02740044c5391512d2c5287f6b8fd2dfa0a65de9c400dc14d83b8d4fe65060f8ea792dce2a4cd5c8c3b5379e57779f7337d01d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f55dd35d57733366bc212787418b6c5
SHA1 247d87cfb6a500b8cce81121416755a64d7c4fda
SHA256 da3cb51f65594f0d87b1f63ddf2117e53cf03d0c35b5708933ccb7f492aba885
SHA512 64746cde303f89cd6e28d7b4ede660bbff083f5785c2442c60bac1190268d1d32f940641a91846eed29e461fb1887dcbca9d032882afbe26096199401f477a5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b9f73a42318468da5f6659b5aca9e306
SHA1 8b81cf14784ca009aad10e7f61a8a1f272720e32
SHA256 897a6785190bbe888baa5d21f5320de1606543ee20e9071b314d84d77115b9cf
SHA512 6e3d9e4d93073da7ea7d259564029f48e8b52aa85db6a2a6f89197b4a57a8255a9749169767e4acf5f1ce238fba773ecc8cd70006053e324b22a545935f24b36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 182d39f8cfc75d1f80f155233fd20446
SHA1 9fd417a3d71a11f8e729244faf4fc7f4bb457852
SHA256 df02533f32917a803d1e934b03cf9fbc4a42689fa008a2b9c1324689a5058baa
SHA512 0263a1694f7b85bcf343b584cc8b42a0a1e86298c27afaf30257351058921cc6c34434e849201f441bff0ed8f7964c315777859e4a75de1418b3559b4f8deb56

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UA1HZF3D\cb=gapi[2].js

MD5 f9255a0dec7524a9a3e867a9f878a68b
SHA1 813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b
SHA256 d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d
SHA512 d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 12a2a077d739d2ac3a1eaa4b3c557300
SHA1 ae17c27e30b7fe1eb13e0d9b5e48c07cb4064bef
SHA256 e491eaa78ae31c522f594a8d083061fdb8a1fa5bb4bdc86cb5ce4bc4941bc47a
SHA512 12943b88921425db6ab5898955c6d723e293c4e071ddc61d679fd292c9b644ef229e3ec029257ea88bb4ef7fc4ff61bae85a96316b084bc183e8be02cba8b449

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf3698d404ea03f54431619904a99b7b
SHA1 3a8794674426ea76a96bc939f6e9e6bdc6aa0884
SHA256 3b84e4c1e7bbf0529424946ef27d587d4609cf703e5bec2f13cd70ac3c7bf301
SHA512 0a09f9db6828c513ab3de2137ecda2746b685089f541f7de292fec376b45c3b7e411b48ffd3cd2b37d81bc1e71120458ca0be514782afa62920fbbbdd34d254d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 ad76f7bc236202c7a9c2b3eec8b494bf
SHA1 50cd43ad869bc464c34214c56b2d63c47fc7e1ed
SHA256 534f76e3b8a53bb4df82e876b4cd47357c13800f4f41352bacffc9e0af332294
SHA512 2934facdef8036321756b6ced0b2d38018afb36f17b59b649a2f60ac8b4feccb87c52a55520b151cfadd3e1cd08388f01bf13a7149e533133556304e78448a04

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1134e1cef6afef34ac88d786677aaf80
SHA1 61042a8ce189207fb4dc390995e160dd6beb399b
SHA256 15151b07fb21be9516927f68e0f80773bfec5f984f28fab3f6e98bf81bd024c5
SHA512 b469d589c2a563f7205ed3984d19434d6f35e011cf2fc12b98e798d46f7e3563055f744755ff9ce0d220e5dfb0ac56958bd1ff6a8996be95d48c91b076f689e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ac30e3eafba1c3f6384ebe65736c85ad
SHA1 24444cfa177a714dc773376e7e500fdd19e1046d
SHA256 f6e0ade271baf52168766ef181361d14ebb2f5e23a98c9f33fff4af6e07bd78e
SHA512 688ed66e462ac1581ff87a3ea791d9de42bbc853f70fcbe93e6e66ba086cb0ac3053e27bbeb14f01a39226be43b08453bbc831efc1bc8c25141b8302c0a0f062

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46ba47f694baa7f58daafad325aa8286
SHA1 9437fb0c7ebdea7e976ca81bbf2a7109a7df1d88
SHA256 4dc8d7154a6a83283507e258d5d8256b4c247844fdd8215b0c565e457b7e1de8
SHA512 621605e0ee21e599eccd1c8690b77bab2270993ef6a825e82195fc5c2ce983aa2ef54d5a55450445cdad6ba8553e9bb1360cc1ea01392dc1291c0119cba245fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 26f7e33980b66294baf6d50df457f739
SHA1 fcb1e9b03c35e4b36ba9c6c29bedc4e4dd8a6a92
SHA256 e4cfcfdd4e4496225477a2d0b9fdb77e93e250a6fad207397d895d4093a7fe04
SHA512 00cf113b912a61a6da9f6698b33a7359a74ea08f8c4da92715b2e1680df81364f1aed6e2fb5775a6f3513746cca3a92ffef926298e1816bdab083958dab8447d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4469cf2dc45864ae2371fa412dae8fff
SHA1 10ad9988785eb3d1dc20899fa6409f0dba639c68
SHA256 75ebf541f1f977a477f422f04a10032a09f5ece94d35d37f3181e7b932d6b3ee
SHA512 d6dbc663cee048fd5192a009566afdf735a60abe8bca2b6d9ffe2ebb74268d0ca927085e8f09dd0ab5c9a2bb471ba3c4e5b5b533b86f75da6885d5219a6fe6e6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 1094028b34e7572d6357c249024c736d
SHA1 e44b3eb56b06d54ffca5d9a1b8791db591d88f41
SHA256 9800f4fe05d27bb2827f7668402226300bf20d5349f1c77b617026b44236715b
SHA512 0c86255f6c458b1157cf175d6de1e77d1f4e4c7a904a55c7ac98d6c3f13ee4c3ee9bd0fd07e7ab296aee1fdc021ba7f084c0026e782d0932ce841809c2d17981

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a86ded9510aeb5204230567a3ada0043
SHA1 26d0f2119262f7d248ad057032cb5a66dd199a0a
SHA256 64454699b40c3389bf252548cfd4ec0b56e12c4e27b7edd82a979246406e2059
SHA512 7400a75d08f7e1a6774c601d869926b2a66b48369504a358977a534cb2c1eb8671834077a2643c63c97d14bba578e3916d57a53ac18fb43bf3a553fd8da50bcd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f733a593c9a7f35b45564ad264277f74
SHA1 eff02c73e9447cead54a483e2e179f6d2c397f05
SHA256 4c0865534ff89701f773c2846e722bd5fda97d56a60385cdf6cf5e397ce202a0
SHA512 cbc811bb7e6fa0272c9c7c3c98198159d11c9846f40149c1c15439868ba3e3a70f989d0a76ee04d3297d9fd3b299ef7e1049ed76b10d827238fcc3c726a80448

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 26c966a70b4b5c19dcb84c0691bed30a
SHA1 754777635fb0c4f02c026550f86b1eebac505c15
SHA256 c0610c90ff736967dc7e2fa6287159a4c90e0f21eb7293bae3a3c40c3b90147c
SHA512 5322eff9b2a38ff45d91b62525aabf0844c76cebb12bb8095de17d5f418bbf5d7687f7ebee54b7f3f42fed79bf32b552fa713660953f5ce7bf4a877ff7b912c6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\rpc_shindig_random[1].js

MD5 6a90a8e611705b6e5953757cc549ce8c
SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 570aa5903396198ac9e56530e157ad37
SHA1 3840c1e22df8e3796f8ccb038a1dafbc7c3e4e7b
SHA256 6199f2f1119c247a2569fb62ff7d18bbc9af40da4e31698c7982c95b4a50238e
SHA512 703d51e16dcf99a85ca1d1ad5ea47f7c036370920b004bcb62a688a030a830e820c3efc71dbb4c3052951a294f490ee8be7cd924d1907649a18b504a2210c841

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3fa8d1acba650c4d992af2bd8669e95e
SHA1 a4d38818d60db35ef403ea82d422dbe36d20550c
SHA256 a36709fc41942e495088463fabc85bc748217dab65f0ac6b8b5c3218b8751e0c
SHA512 54670ad5ffb71c498500f357814fca6545f9a27d79de2e97a3a4c60bc09a6e671ff8f9ae7ffbaea2ac24472d7f36e7eaa711f46750dde10b30fc9f10e01fe7f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d54d808d98b34a9c2fcede05e3e85409
SHA1 f46cbe5ff5f8446fdb0f7afa1f98f5d3bf45492d
SHA256 ed8061e155a94065402ddd1d7e33b4bc8d75fad59b9a9dc0b44b2bb1b3dc4718
SHA512 06aa06b2a16a27734bbdef7518f14fd462015a0c094c9ee8a48827723dc8ff6b4c89eea26d1edd7a7d440e016fd3694e0cef057111c490d1dca49ec27cf93fe9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f5051da7a8ee34c7ab081c356abe2be
SHA1 a2ac64308318156afa3a46307353ee438f0949c2
SHA256 15735bb72509e811a00a4ee5d66733c553788c331c6bda9f90fe26311658c2de
SHA512 416987a392f4fa1c9d931ce4828dd6fce4ed17bc10ead77a508d9ad83ce014042966fc004ed994cce7126992c34a682a0530867b5bc79aa637382bf95ca2afbd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf248e622ab2bd8f00c7b8e69bb6b65b
SHA1 c959f6937c4036c586378e728e301d4c5b9dbd0c
SHA256 8248aa19fba233dead2ca35eb602defac4eaacf8bb796018ffab03f91ebc833e
SHA512 a113e67c56ad35d25b6ded41ce80eeb898737cd9489d4a43b26ef9cfd5bb8d72483ce5336936a6bddcfd02f071473bfe82de23dc866d7284c4739a6277a91e6d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 072240e1701a044433f9d4defa7c7036
SHA1 7266680d4eface626ac1fa2a878d95df41c5eb6c
SHA256 4e771ef77f8adeeacc54acea9257fcf18393f586524da8419f1a847a70b2174c
SHA512 47f62be4b90169b59532acb4ebd134676b1fb2473f48d6ce6c6270c16dd083fe0e82c46ab7a7c508efc09b55a17d2599b3ab76c13e1d0dce4a31db8a445e921e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab54b95aeb6c48986ce47b01edf9ad13
SHA1 30f1d9bc3c25e843732dc9ea25eaed935c32db62
SHA256 73811b6e3d0cb4784852e6a7487dd5682a544a8d0f1837580d71b8b84959812d
SHA512 418ab05b702338d4950f14d0b3c316980e2c6e5c3b9aa50b5905d7d67752b88d17d999af5b5efe8dcd6b9a9f9b75884543203093ea36420fddd74938f7cf1f49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f01c2cc743bc3b53a77c549b5b6dab6b
SHA1 aaf23adbf5367eb96383e3f7d8df6ea4d67e4309
SHA256 b628f313c5160a74594290e117d03536653fe88febeafbd4eec4885b239339d3
SHA512 908a17296038ee23b4457aaba342bc11fbc084be412a1e8602d2d1c8b0865dc4e00b022dd4e4470defb020bd998bfee2e5f817f93237f682cfe432173e9cf198

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 332735c900b8df44ef8c6796450431ff
SHA1 dc724dae78215ccde0d286292f141d93f378d7b0
SHA256 3c3022a3e8b960aa495452f9e591fbcf34eefebb1c9fceaa893098a53e2b0b82
SHA512 ee93719e756a93c94af558645e84fde4eeafd9656e580872e58f549d37edd42296c02a12d1ba659fa8141af8a691514bbc580be554d49f05ebcb86e6b98dd394

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c8a97c0ceaedc2752635cfe2b0994f0
SHA1 a372011f7fb653b51f41cd1d6589c51878d86294
SHA256 60c9ab37acd14c34f916ec0eade644f96791da1f0dd2525555b573452767d7e6
SHA512 dc68543ca7c1862309c800d2c3b1c150cef26aa6109d140e18266bfcc2edf8e8ae6c19d8343459582fb509b65f2b8f0e25932f5415475a940ba1b4bbba1013ae

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 15:51

Reported

2024-06-03 15:53

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\925584811bf43cbc53be174e3cc597fd_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4832 wrote to memory of 4472 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4472 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 116 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 116 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4832 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\925584811bf43cbc53be174e3cc597fd_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc030346f8,0x7ffc03034708,0x7ffc03034718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,654485618412849515,9649425641881628592,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5684 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 lostwebtracker.com udp
US 8.8.8.8:53 green-tracker.com udp
US 8.8.8.8:53 www.ekmpowershop2.com udp
US 65.36.134.172:80 tcp
US 8.8.8.8:53 image.motortrend.com udp
NL 95.211.75.26:80 lostwebtracker.com tcp
GB 142.250.200.14:443 apis.google.com udp
US 8.8.8.8:53 www.coolestcarpictures.com udp
GB 85.159.56.212:80 www.ekmpowershop2.com tcp
US 8.8.8.8:53 s40.radikal.ru udp
US 8.8.8.8:53 www.picturearchive.co.za udp
FR 13.36.144.223:80 green-tracker.com tcp
US 8.8.8.8:53 apartire.chez.com udp
US 8.8.8.8:53 www.alfaholics.com udp
US 8.8.8.8:53 i47.tinypic.com udp
US 8.8.8.8:53 www.sjmautotechnik.com udp
FR 212.27.63.127:80 apartire.chez.com tcp
US 172.67.73.73:80 www.alfaholics.com tcp
NL 23.62.61.170:80 image.motortrend.com tcp
FR 13.36.144.223:80 green-tracker.com tcp
US 207.150.215.87:80 www.sjmautotechnik.com tcp
US 8.8.8.8:53 www.carontrack.com udp
US 65.36.134.172:80 tcp
US 207.150.215.87:80 www.sjmautotechnik.com tcp
US 8.8.8.8:53 www.caradvice.com.au udp
US 8.8.8.8:53 farm3.static.flickr.com udp
US 8.8.8.8:53 ridesandstyling.com udp
US 8.8.8.8:53 i293.photobucket.com udp
NL 23.62.61.170:443 image.motortrend.com tcp
US 172.67.73.73:443 www.alfaholics.com tcp
US 8.8.8.8:53 www.bbsrs.com udp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 26.75.211.95.in-addr.arpa udp
US 8.8.8.8:53 73.73.67.172.in-addr.arpa udp
US 8.8.8.8:53 212.56.159.85.in-addr.arpa udp
US 8.8.8.8:53 170.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 127.63.27.212.in-addr.arpa udp
GB 216.58.213.2:445 pagead2.googlesyndication.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
US 199.59.243.225:80 ridesandstyling.com tcp
US 104.18.160.38:80 www.caradvice.com.au tcp
GB 18.172.95.84:80 farm3.static.flickr.com tcp
GB 3.162.20.115:80 i293.photobucket.com tcp
GB 216.58.201.110:80 developers.google.com tcp
JP 202.226.37.40:80 www.carontrack.com tcp
US 8.8.8.8:53 www.alfabb.com udp
GB 3.162.20.115:443 i293.photobucket.com tcp
GB 18.172.95.84:443 farm3.static.flickr.com tcp
US 8.8.8.8:53 assets.fish4.co.uk udp
US 54.209.32.212:80 www.bbsrs.com tcp
US 8.8.8.8:53 files.conceptcarz.com udp
US 151.101.1.91:80 www.alfabb.com tcp
JP 202.226.37.40:80 www.carontrack.com tcp
US 8.8.8.8:53 www.drive.com.au udp
US 54.209.32.212:80 www.bbsrs.com tcp
US 8.8.8.8:53 media1.onsugar.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 216.58.201.110:443 developers.google.com tcp
US 174.36.2.242:80 files.conceptcarz.com tcp
US 8.8.8.8:53 ny-image2.etsy.com udp
US 104.19.150.51:80 www.drive.com.au tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
US 151.101.1.91:443 media1.onsugar.com tcp
NL 142.250.27.84:443 accounts.google.com udp
US 151.101.1.91:80 media1.onsugar.com tcp
US 35.190.25.237:80 ny-image2.etsy.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 www.ebspares.co.uk udp
US 104.19.150.51:443 www.drive.com.au tcp
US 8.8.8.8:53 farm5.static.flickr.com udp
NL 23.63.101.152:80 apps.identrust.com tcp
US 174.36.2.242:80 files.conceptcarz.com tcp
US 172.67.134.167:80 www.ebspares.co.uk tcp
GB 18.172.95.84:80 farm5.static.flickr.com tcp
NL 23.63.101.152:80 apps.identrust.com tcp
US 8.8.8.8:53 img0.etsystatic.com udp
GB 18.172.95.84:443 farm5.static.flickr.com tcp
US 8.8.8.8:53 resources.blogblog.com udp
BE 88.221.83.177:80 img0.etsystatic.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 172.67.134.167:443 www.ebspares.co.uk tcp
BE 88.221.83.177:443 img0.etsystatic.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.9:443 resources.blogblog.com udp
US 8.8.8.8:53 87.215.150.207.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 225.243.59.199.in-addr.arpa udp
US 8.8.8.8:53 38.160.18.104.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.95.172.18.in-addr.arpa udp
US 8.8.8.8:53 115.20.162.3.in-addr.arpa udp
US 8.8.8.8:53 91.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 212.32.209.54.in-addr.arpa udp
US 8.8.8.8:53 51.150.19.104.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 237.25.190.35.in-addr.arpa udp
US 8.8.8.8:53 40.37.226.202.in-addr.arpa udp
US 8.8.8.8:53 91.81.224.13.in-addr.arpa udp
US 8.8.8.8:53 152.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 167.134.67.172.in-addr.arpa udp
US 8.8.8.8:53 177.83.221.88.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com tcp
US 151.101.1.91:443 media1.onsugar.com udp
GB 142.250.187.194:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
FR 35.180.217.25:80 green-tracker.com tcp
FR 35.180.217.25:80 green-tracker.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.178.9:445 www.blogger.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 91.16.208.104.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

\??\pipe\LOCAL\crashpad_4832_JJOWFGQKPMHCBYAK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cb6c53b801f9e2f60647380f7862220a
SHA1 38a98b2e383414caf096be43de5fb3979bddeb50
SHA256 99c8e8977b99e935a06f5886bcc5dca6920815b96c2d1baee5f8fa306b80a0db
SHA512 3943f4a65ac2207ba0c3e0d4da67cc167dedfe913b92b01774aa7fd9e8cd4dd63a947a81dfbe258740a4b280c12b313702296a71964bd5766d4d967d178aaf90

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 9b97d58b73173500d4c86b8594f55f8b
SHA1 2e8aa912c625b36c54437ced766bb048e190afa9
SHA256 017ff631fe1e280ee9c819b06a79af3c1b5871a21d022bb2336a8362cc9900d9
SHA512 d523036a966e5570f75de599051926f9500e68f1030251a21a7f46df333aa3bcd50d44167d6920fb06d78610bb11f9f5bbcf93789034d7e177e1061edff8bddc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

MD5 a7eeee7d20a55e21f13ad84547a63ec1
SHA1 1aba12d4d418a944b80099f182ca109d27a697f5
SHA256 eb3b3c753867ede5fdb6fca280935633550bedd783c79eb9f95ffa47f4d1f5b9
SHA512 a31d5810056e3b17c77f9eb706804c22736821e4ee55e23fd12dd9c8accac23eb781cebf84b7686800c0259c364c84c62325b6eca2a1f14a9ff65ee36c50d0c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

MD5 23536ccfe05b737ae639fe63ee4cc435
SHA1 6d2e9822835dc3e6117a4d2addfc8f241fbdbc82
SHA256 6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce
SHA512 f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 01a5f7cefc43608f44ff270be43a96d1
SHA1 41ae063ba16859cc2f1110984364ada861ee11a8
SHA256 187c928983557cc7bcea1e5e0dfcb54c2ebc3bfc9bf6a8f5a722172996ee54a1
SHA512 9bcce67fe653eff77a9d7849518c9d177352c5b3c5a691949445e88558a045512f98aaf1833a0ffb241477176a380b78659ea7dd90e34165af4cd02016312615

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4a0ac5525db9e0c7d6a3ec9713aa3029
SHA1 bf10f59ea1b082d43b415f1b5bf5c7322225484c
SHA256 99017fa0071bd35a9308ef191376e022a3037907ff3eb8b4ac67541fc5b00be6
SHA512 6cddd7407c96193281decbc641fd83584338b50e0b15c6032ac696a9d022073ae9b7096e2ed781a004fcbd3761a409760fa65581ac9eec59fd431787dd7fa3f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 751070c6e4ab501c6fdc08b837fe2a19
SHA1 daddcb03a604a62a507612e37cf8dfa31467e168
SHA256 4abf03f844f8bb1f866e69985298cf5abd191e95b2e32474ce73cddf9613e682
SHA512 f6f68cb925fc17073dd4734604ca2bad452ae785b425fab258de15bfba338da67462407539b6d25c785f4c4a1bee181529aeccd3e2bc944831f518eeee4a7436

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c75a55baade7e237ec49bc3bfcf0beb2
SHA1 f9bf84a05de1878dc07126593e2d7ad71b0ae9f8
SHA256 d0755051b193cdb6a11c3fd7f742c4ce1791e92af38c738c73268158fe9920bd
SHA512 b10e74e2759747fac610df40f9443ad9ad4b7fdb27437b0264d49b956fc4272bb742eb9c2b150805fdedc8b741a0e42fd4f08ea6a26c26d186559ecddf66f773

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 d20f438159983d35eed82357ec454a3e
SHA1 4649326d3c358cc8dd53e5616771d45359d09cbe
SHA256 ee16b7847df615c505237a038c752d7346dce2baa1bfe991a49c01371aa3411f
SHA512 b30f0adf722b9cd08ce4ab76e45242a7d9cfe4ad00d5a06b7f905be1dc877d210f58474266b3d856a24b2874a9982d6590f9b98a86bd89f412604e696cd34991

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3b7c6420af4f7c726aaf4f929f628402
SHA1 6e432fd75a810bcb47eedaca5cfae3075bf757a4
SHA256 00ce78eb3e5fbd415648a5bf82972c326d48c374a5739ce1ba52c2021ad6b575
SHA512 6eaa6be86e02cdcf3f2ebffc1d6bdc1cbd29d24d54e0201578521aff9d0c150469de29b12d6c9d8d0282944b6d0297e8cf98a0d24afe841aba3915595dbe6ef2