Malware Analysis Report

2024-12-06 03:26

Sample ID 241028-rkfngs1fmj
Target 7a02097cabeabf8f59a721c4e1616bd7_JaffaCakes118
SHA256 a852b38b93aa06b1fcc1fb1f54c5f9aa51ff9df976a866f58a0f1de3d3ae8a5a
Tags
discovery socgholish downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a852b38b93aa06b1fcc1fb1f54c5f9aa51ff9df976a866f58a0f1de3d3ae8a5a

Threat Level: Known bad

The file 7a02097cabeabf8f59a721c4e1616bd7_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery socgholish downloader

Socgholish family

SocGholish

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-28 14:14

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-28 14:14

Reported

2024-10-28 14:17

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7a02097cabeabf8f59a721c4e1616bd7_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4044 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 2528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 1384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4044 wrote to memory of 3484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7a02097cabeabf8f59a721c4e1616bd7_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc825846f8,0x7ffc82584708,0x7ffc82584718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,517992966175788018,3168528084488920833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3920 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.178.9:80 www.blogger.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
US 8.8.8.8:53 synad2.nuffnang.com.my udp
US 8.8.8.8:53 referer.org udp
GB 142.250.178.9:443 www.blogger.com tcp
DE 64.190.63.222:80 referer.org tcp
US 8.8.8.8:53 twitter.com udp
US 104.244.42.1:80 twitter.com tcp
US 104.244.42.1:80 twitter.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
DE 64.190.63.222:80 referer.org tcp
GB 142.250.178.9:80 www.blogger.com tcp
US 8.8.8.8:53 pipes.yahoo.com udp
US 8.8.8.8:53 www.kuizikel.com udp
US 8.8.8.8:53 kunoichi.info udp
US 8.8.8.8:53 s10.histats.com udp
GB 142.250.178.2:80 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 feedjit.com udp
NL 190.2.139.23:80 kunoichi.info tcp
US 8.8.8.8:53 www.google.com udp
US 172.66.132.118:80 s10.histats.com tcp
US 8.8.8.8:53 img1.blogblog.com udp
GB 172.217.169.36:80 www.google.com tcp
GB 172.217.169.36:80 www.google.com tcp
US 8.8.8.8:53 blog.kuizikel.com udp
US 8.8.8.8:53 farm3.static.flickr.com udp
GB 172.217.169.36:80 www.google.com tcp
GB 142.250.178.9:80 img1.blogblog.com tcp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
GB 142.250.178.9:443 img1.blogblog.com udp
US 8.8.8.8:53 farm5.static.flickr.com udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 222.63.190.64.in-addr.arpa udp
US 8.8.8.8:53 1.42.244.104.in-addr.arpa udp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 i844.photobucket.com udp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
US 104.244.42.1:443 twitter.com tcp
US 104.244.42.1:443 twitter.com tcp
GB 216.137.44.17:80 i844.photobucket.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:80 farm5.static.flickr.com tcp
GB 216.137.44.17:443 i844.photobucket.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.238.247.73:443 farm5.static.flickr.com tcp
NL 18.239.36.29:80 crt.rootg2.amazontrust.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
NL 18.239.36.29:80 crt.rootg2.amazontrust.com tcp
US 8.8.8.8:53 x.com udp
US 8.8.8.8:53 pr.prchecker.info udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 104.244.42.129:443 x.com tcp
US 104.244.42.129:443 x.com tcp
US 67.227.215.171:80 pr.prchecker.info tcp
GB 172.217.169.36:443 www.google.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 67.227.215.171:443 pr.prchecker.info tcp
US 8.8.8.8:53 www4.shoutmix.com udp
US 8.8.8.8:53 s4.histats.com udp
US 8.8.8.8:53 statinside.com udp
CA 54.39.156.32:443 s4.histats.com tcp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 23.139.2.190.in-addr.arpa udp
US 8.8.8.8:53 118.132.66.172.in-addr.arpa udp
US 8.8.8.8:53 36.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 17.44.137.216.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 29.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 113.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 129.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 171.215.227.67.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 172.67.146.166:443 statinside.com tcp
US 8.8.8.8:53 73.247.238.18.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 172.67.146.166:443 statinside.com tcp
US 172.66.132.118:443 s10.histats.com tcp
US 8.8.8.8:53 32.156.39.54.in-addr.arpa udp
US 8.8.8.8:53 166.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.204.74:443 ogads-pa.googleapis.com tcp
GB 142.250.200.46:443 apis.google.com tcp
GB 216.58.204.74:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 openofficeorg.kuizikel.com udp
US 8.8.8.8:53 belajarpicasa.blogspot.com udp
US 8.8.8.8:53 shop4quran.blogspot.com udp
US 8.8.8.8:53 shop4blog.blogspot.com udp
US 8.8.8.8:53 kawandiet.dietmate5.my udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
US 8.8.8.8:53 sh0p4book.blogspot.com udp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.187.226:443 ep1.adtrafficquality.google tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
GB 172.217.169.1:443 ep2.adtrafficquality.google tcp
GB 172.217.169.1:443 ep2.adtrafficquality.google udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 1.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 226.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 1.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 play.google.com udp
US 150.171.28.10:443 g.bing.com tcp
GB 142.250.187.206:443 play.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
GB 142.250.187.226:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

\??\pipe\LOCAL\crashpad_4044_PPGICDOQHCOAJWQY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c7b16837b2457b16dd9e78005669b798
SHA1 2d4c6f8f3c34fdfd836a4a648d3901043f60c3ef
SHA256 a3747b18a698f52341324ca980981fe9f50ec88a3e99c53b9b4c30fe174815c1
SHA512 8959d966d93edd16c6d135ef0e685e64d42ebb9a7c28daec5a6413baccb674006a8c4f076c3334f9b61ea20373e703fdc41ed98df4d45b52ad02b7215df781cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 73e1a3769a74dc4b603f67e039c641f6
SHA1 b1e2864a34f4f1748592afbebcb93f4b5da34771
SHA256 d67c34ed289df0c2fb0521ab05c255fee95cb4cde9d2b23dff9a3797225d4a51
SHA512 4d064c5138b115055e87cd8cf69853fcf1572e89504ef26d1e17aba87290ec32cde356bafecccc8223e21079ec07c98cd6e64926ad7a98edea81bb0a95255560

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

MD5 9be1d4b367562e0e2fff1241c4cd88fa
SHA1 b31a7507750fa4143dfdcd44fff745693a1c9977
SHA256 970b86da2de9b2f0089bc0df1f97a058db56675d61af4e1b382b78cd6506fd5b
SHA512 75a1c93b2337ce7e9a2fdcf8b359e191cf65e2451c455c8a87857f6ab2f9cf4d9c73ea5ff8ab02ddca7b212395807933e870072313c4e12a955200d46debb85b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

MD5 c6150925cfea5941ddc7ff2a0a506692
SHA1 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
SHA256 28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996
SHA512 b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

MD5 b42fb2a7c6c0579029b34c25e78bb534
SHA1 136994ec5dbc83cd0b4a5fd486564f64d277952d
SHA256 2aeec218e5b54407771d82f164a364283baaa18c78a7f10a3f87f264150ed18c
SHA512 4dbd4fa1cf189e10d92849139c925cb6e0851aac34879ca46c007844e995d7bf7c81a044a74f2292213bf1c1e619933510afb75251c01de605ad1d4f3f991931

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

MD5 b3baae752f3e41a1906d06cdd65f470b
SHA1 7b462e6c7143fe2dbc217607970b0c532f633a4b
SHA256 2df0437f82f45c4c4ab6e6e3157f3fe143df38690ece2b6932675f1873fbfec1
SHA512 767cf0035a3b78d5664eece3dfc157306ca3c0994b26b8b40a7eba00adc02e8cbb900261535e6c13437b0c883fc7d851e8c77d7c8e0c3f1cac9adbee3c4bb8a6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 12cbc208ab49ae27b58a9094fd29f880
SHA1 868d63b4348b3458cb9366efd78a287a27e295ac
SHA256 c988d69889dd40ce4b99297f20b9a50aaf16c5c6bfbabee19c034de4572e3c15
SHA512 0084f9b3ced379e37b2cdfb7a3d5df50479da1beebe47bb6e6f8466e81b2cea83da6a9b9e67f4c0fc745775f36feaca9dcd992c9fff65a3b1b9a81fe4eef6e9a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 39cf137b65c856395d9fd723bf221d18
SHA1 7f60d3364c0a8d74ca0355a21f062a8e486b4a13
SHA256 b3b8371dd5ca08691ca793478c8aa3d914d3e810a3a220ff160c8d1d69ea31d0
SHA512 9a491361186cadfc520e143802a5d5b0fa4259b693303eb958d32dff4aa39a41f4229d4f511d65dcb8fc569712ecee71fa3da263675dfe3d87d499cf8a2bfe0c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9717ae65760a5a8ad303b3b5a7c8cdaf
SHA1 cc23a01cd617bf94e2505913c53e3f4ba2fad521
SHA256 cce595b7cf12064cfccfa572d2ec6c60a2623c8616aa736d24d83394a861af50
SHA512 2b7f7c486eef3a1e8c127ab16c6f6c34f0583e951af2c56e9fe4c4c711fa8b24aee345a3cf6364ff1173adebbdb4a8935f96356e8237093a31bad53652a68013

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 26c4a147f1dc519991b4896ae66c64ac
SHA1 34523bc42e0d048a5689eaf6f0bcdce61119db82
SHA256 89aade85d1b8af9c4b5556c3ba467e762dca1dd873b875050c44080ebd73de7c
SHA512 07c9095f069736b723017c0d08d9fc8f3f33eae7a37dfb8a8418d6290f31431bcb43eda6acfdb9bccb223451d01bc63424e7fd12e1e8756dbf135aa78ba89237

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-28 14:14

Reported

2024-10-28 14:17

Platform

win7-20240903-en

Max time kernel

144s

Max time network

149s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a02097cabeabf8f59a721c4e1616bd7_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{018D2D41-9537-11EF-A528-527E38F5B48B} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80624ad94329db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000024de2b5695d5a8be15f7ee3d939793cf1959fea0e3a801eb90ad8e2b2ae03a20000000000e8000000002000020000000e8a6163b9569b50d497a9b47b5f67dbbb505d588c5de8dcfaaf7014b7379e2d7200000000405a7053c8b5db6d4f30765521861500c9a147fa04bc7575c14d1d200cf80cb400000005cbde85603ff035bff8ff45fc91e00f92d3622ed82cc3e0c1cf0b5694c5ac6d08f009d77729b21d7227eac8737864b0ac46f8ea00226c0047fa2bc900b91f35a C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436286763" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000b87b1d5f7f308e448a3dc903a43e7a8431f3f9f44f2d35b0ce1325c4d8697b5e000000000e80000000020000200000004beb8f024723d6331ffc7c7eb8fceeb722691f545600e47447e2063afe8afb9090000000cf2831a7ce1a7709ff8fa4511a96c5f4bd764ace3e1e79c5ad91051fa4b0b917b75fcfe26cca784c8a27b311e8c55aea2ad3f0973b6768d9fd6f70077543fb82839d7ba10feae3beaa5f7a1731edda7bf47d4613b49b2782169573c605198746000714197b5fd6a6471afc2aa0022196985ea52010140b73e77fc6e33861a59e88a576597c99643edc724500ba2d35aa400000000ac51cfe0fdf9ff9517dce8abad4a39b56b244e52d768a325cca5fe6734b826f32a728b37c6861a3d7f98a014f129056b732e7a864ad4f7389d06211376930bc C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a02097cabeabf8f59a721c4e1616bd7_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 synad2.nuffnang.com.my udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 farm5.static.flickr.com udp
US 8.8.8.8:53 farm3.static.flickr.com udp
US 8.8.8.8:53 i844.photobucket.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 referer.org udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 pipes.yahoo.com udp
US 8.8.8.8:53 kunoichi.info udp
US 8.8.8.8:53 www.kuizikel.com udp
US 8.8.8.8:53 pr.prchecker.info udp
US 8.8.8.8:53 s10.histats.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 www.google.com udp
US 67.227.215.171:80 pr.prchecker.info tcp
US 67.227.215.171:80 pr.prchecker.info tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
US 172.66.132.118:80 s10.histats.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
US 172.66.132.118:80 s10.histats.com tcp
NL 190.2.139.23:80 kunoichi.info tcp
NL 190.2.139.23:80 kunoichi.info tcp
NL 18.238.247.73:80 farm3.static.flickr.com tcp
NL 18.238.247.73:80 farm3.static.flickr.com tcp
NL 18.238.247.73:80 farm3.static.flickr.com tcp
NL 18.238.247.73:80 farm3.static.flickr.com tcp
NL 18.238.247.73:80 farm3.static.flickr.com tcp
NL 18.238.247.73:80 farm3.static.flickr.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
NL 18.238.247.73:80 farm3.static.flickr.com tcp
US 104.244.42.1:80 twitter.com tcp
US 104.244.42.1:80 twitter.com tcp
BE 18.239.208.33:80 i844.photobucket.com tcp
BE 18.239.208.33:80 i844.photobucket.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
GB 216.58.212.194:80 pagead2.googlesyndication.com tcp
GB 216.58.212.194:80 pagead2.googlesyndication.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
GB 142.250.178.9:80 www.blogger.com tcp
GB 216.58.212.196:80 www.google.com tcp
GB 216.58.212.196:80 www.google.com tcp
DE 64.190.63.222:80 referer.org tcp
DE 64.190.63.222:80 referer.org tcp
NL 18.238.247.73:443 farm3.static.flickr.com tcp
NL 18.238.247.73:443 farm3.static.flickr.com tcp
NL 18.238.247.73:443 farm3.static.flickr.com tcp
NL 18.238.247.73:443 farm3.static.flickr.com tcp
NL 18.238.247.73:443 farm3.static.flickr.com tcp
NL 18.238.247.73:443 farm3.static.flickr.com tcp
NL 18.238.247.73:443 farm3.static.flickr.com tcp
BE 18.239.208.33:443 i844.photobucket.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
US 104.244.42.1:443 twitter.com tcp
US 104.244.42.1:443 twitter.com tcp
US 67.227.215.171:443 pr.prchecker.info tcp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
NL 18.239.36.28:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.28:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.103:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.28:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.28:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.29:80 crt.rootg2.amazontrust.com tcp
NL 18.239.36.28:80 crt.rootg2.amazontrust.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
GB 142.250.180.3:80 c.pki.goog tcp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.18.190.73:80 r11.o.lencr.org tcp
US 8.8.8.8:53 blog.kuizikel.com udp
GB 216.58.212.196:443 www.google.com tcp
GB 216.58.212.196:443 www.google.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 142.250.187.195:443 ssl.gstatic.com tcp
GB 142.250.187.195:443 ssl.gstatic.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
NL 18.238.246.206:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
US 104.244.42.1:443 twitter.com tcp
US 104.244.42.1:443 twitter.com tcp
GB 142.250.200.46:443 apis.google.com tcp
GB 142.250.200.46:443 apis.google.com tcp
US 8.8.8.8:53 www4.shoutmix.com udp
US 8.8.8.8:53 s4.histats.com udp
US 8.8.8.8:53 statinside.com udp
CA 54.39.128.117:443 s4.histats.com tcp
CA 54.39.128.117:443 s4.histats.com tcp
US 104.21.57.149:443 statinside.com tcp
US 104.21.57.149:443 statinside.com tcp
GB 2.18.190.73:80 r11.o.lencr.org tcp
US 172.66.132.118:443 s10.histats.com tcp
US 8.8.8.8:53 openofficeorg.kuizikel.com udp
US 8.8.8.8:53 belajarpicasa.blogspot.com udp
US 8.8.8.8:53 shop4quran.blogspot.com udp
US 8.8.8.8:53 shop4blog.blogspot.com udp
US 8.8.8.8:53 sh0p4book.blogspot.com udp
US 8.8.8.8:53 kawandiet.dietmate5.my udp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
GB 142.250.178.1:80 sh0p4book.blogspot.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
CA 54.39.128.117:443 s4.histats.com tcp
CA 54.39.128.117:443 s4.histats.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\4156915437_8e66b10f89[1].htm

MD5 f5d40b7259645010f9a248858ad14178
SHA1 b3051d17a6ec8c9e166bf09a62b48261ab86957b
SHA256 7f5007068d2b56ea9735e2490d60cff2e72cae312024ac1f6c91158eba47d05d
SHA512 1e82bc2d067f726670b3e6054d73e57868f6e7c50eb979696bf927daeef699f2d8f8de201e8252b86b0e9f86dc69e5037fc9fa08ef6c271b033f29d4f0f4c1aa

C:\Users\Admin\AppData\Local\Temp\Cab78BA.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f70b31c0f4c796166ab30e5071662c2d
SHA1 9d3f47626696cd7c62ad045044f6d94c226de8a7
SHA256 730b5961579c5ee9be459516f346fb266eb1923b65ced0cc30926e56474e33db
SHA512 78912d2664428dc87fbc58aebf6f779c826d57a989766749793b6632ccacf502205054fba9780bd35c66ae6e5ca4461d7d99858918b5d8308c82d5b9b51a754d

C:\Users\Admin\AppData\Local\Temp\Tar7988.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

MD5 c6150925cfea5941ddc7ff2a0a506692
SHA1 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
SHA256 28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996
SHA512 b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 37378a44d1a1a64db17c21e6dd7cd1e5
SHA1 2e9a66b2664b8492128f48e29ff6d3cd0ba07895
SHA256 6a8c257592658ef3ea78173c5d7e3d6a364e14cd42d2bf41d4ee1ddbe70cf70d
SHA512 da8f0d2cc495c858070df183d5fb36fcac29b838e2417bc664c52784df9e57c288ae5e89e2304da54370b9547bc258f92730485e68bdd8a8c77d20339c5edfcd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5ebf0b753fc61d15ae45af778a32a050
SHA1 cd727ed64cfa95052f83e7db54b099b05f67c77c
SHA256 f899798826b0614346a085342610b6853e44818700e577e9633b560090369075
SHA512 a0e5762025b6e6879cd93e072f92b779847b948b32fa616d7243cc36adb47ff53dbc7f122cd048300a55f3ba2be505519a2fbf1dc4a93f1e565219ba86c02092

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7

MD5 b823230661929681d225c4b193afbc34
SHA1 222935631a6a91ff396d2cbaed877f6c08f6aefe
SHA256 c929c84ebc34f7eb489ab58304dc60ddd59c4f9e114dfc3b82da8c575b5ef6c6
SHA512 e6303ce74e8c9230f03a5277f76f98e90a4573098b8f27a0750c21f4f0621af8ff75f6d0e79db80962f850a00e3226ff532e9f27b86ae3a3cdfd30aa16e2d400

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 902b886f4a2c3e15e8b6e29eec60fd26
SHA1 ad7f5373a39ac5b0c174788e3f832b592cd9fb94
SHA256 4e77fad6741f379a6f701b10c65073a0e866abeedbef2229bd1c0357c8123353
SHA512 d84439774d83781c2cced4a3209ad9885e970a3bcaaacdbbe5b1f0e16f57eb80e2d934b61cf183d6b647b211831f4230e5a3b316e2dc6d76551c4663eecddb77

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7ad93cecc06931588d1622c4966890b
SHA1 65a5923df138fdf8ce7b4385b9af188181c6af5f
SHA256 9e9a42e0f87346b05a672248bbd9963df52cd7ab18bdf87463406d8193235b7d
SHA512 579b1dd7535614b493930cdea2c8c7543c27ad3394c623dd0f665b1b5e458585f2fcf36dd444d22dbc0c6755f208b43c3efc43c49d39ae501ae0461ec920f5bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6950c9dc75be1c5a33730f75908a8c3d
SHA1 c95b84c1a6e849141a219f5c8c407ca308df0283
SHA256 9fdb0cf363d5ba7b55dfbe75edd7b610339c01e471c270140b439421d89de583
SHA512 e72eda60b4a82819cbe503df45ac7afa69489b59df0294676e699aa8ebc9d0b374e7903da6529d8281cd0e343c48e67ba8eb84bfc86b65f98983f61d3668af37

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 578a9af7caf9f26cb0618061d0fbf676
SHA1 59bb0333a3acf779dfda1557b4c34eb446e1a045
SHA256 48f799776999d6cd828639b568a7a750b1041b559ed208420713b2d07583fa44
SHA512 f76674fb5503158c22675ca9367da5fafda724d951d76ad51c9f3e8c745c9741d95d089d0303f5fc3f00bf3ef95c2c298ea287f4fb8b6de34decb851912c1c8c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2842c3159e39301eeb791ca0846069e9
SHA1 9d511fc9e35d1c43ebd710254d7c74b4f2e221b6
SHA256 0ec70f04bfda7c6536f84a42c54c2fb13431f4011523d2702728fb0ec91a9d47
SHA512 07d3f822a232730e8b39e4810b3777cc25886241a46d400798be06927194dcd8e65396378f0812106e2433463a2c14a95399cebce9dee705915980a20de2320d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81578b6ee57e9dda8e28934d01ea3461
SHA1 5fe8ea1f8ea9031fd52696844eec9dbeec551f4f
SHA256 ac91ecf8861fe5c598fbb2cbe29f88dec27ae42ae20eb623313ffd176b9cf4dd
SHA512 cf265f528255c2d604e86e45c5acc680354ca03181a329961010f9000db5be2b82511cc418f077c30c6f897893290badfb05febea5a7dbf75b3317fa4e6ce0ff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8744e6587fa24aa35309bd58c692f4d
SHA1 4f50456a1264c3fdb55b08052c55cfb29b859274
SHA256 a0d6a27502809b88a9c11b69df3b49d4276ce6d3eeca6db3d9eccf8955b156ab
SHA512 38605fb53ee30cc1e074edd2cb68baf28e658f87c0b291942ad4f33caef3c0fc2b11be2fc42ca6d06803ad0025ea0b5296b70a99f30e50b1c6bffbf8ff828270

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b510ae86f67f3846430e700cbb8843f
SHA1 1f09a7afe68e3ead87248167c51f84dde45f5bb4
SHA256 bc511f5cbcf99dd0bf00aeb680d132aab16a316dbd949b1668034e14e89579ff
SHA512 18e7c87ee3fe14466afe62c3fe096d1c3f085392997739e9ef4acbfd45e1a2538371bbb13fa30a55f2d619e4bf055e95aa54dc7cf33a5d290eeebe55de930ef2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 722d268716ffb07f8e02958cc6a8865b
SHA1 323457351aa8c26fc57cf6927b394e35fcb3b313
SHA256 021917880db4fd906cd056e6dcd898dea457acb70fa035361d82720abe7c3e14
SHA512 deb460509ebf123f07f54c4b7f15b5c4b99acd785b0fe50e54c5cd8e8a38fe40053b5ecf62ae8d766d2baee02960276883ad094207b3315fc303ceee91d733a9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f9e0833501717d6b63c5e20a8ea1574
SHA1 775fa2937c3a6ec4145844fab6b329c5810952d3
SHA256 7f27433eb68a8cecae2b1e7464d93e245254ca23a237d25f753b6f267c79dc9a
SHA512 3d23146cffbf776b62042b280174a2eda3733c2c1a4e22b5f382cd6f41cff7c58034cc5b496934b50755d3b838e606990ac2c4db4adeaef060e892f9fa13698d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ad5e1874591cc427fc05ff0174652e9
SHA1 9bb297c77268584f799e059f937173a1e3bdce2a
SHA256 c2e2cad8f582e6103d46d8bc8eda9e79c3ec1e9c6f44cbb705b2e64dc67404c1
SHA512 2c0d311bd679103ee5bce4780e1e85fe61bbf5e1329726e344948e7c1a6f36afd166f89ef8364ecfd4a4324fb904f57253f63ad50c8faf00244636343461e35d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

MD5 b43405ae656876f990b5c383f67d03c2
SHA1 4f77e6fd355cce5ab45cea0c1f864864d330e3a4
SHA256 27af3652a17654ae1a75db2bcc89fdbaa1fe6b1e7c8ed6d78aa4b9c5247b7dd0
SHA512 6bfd9b4d407c92c3a7d6332ecbe43a97043e14677de278b3574958ddf0224273f89113f5cdb7f14aba63e392c013fa300bb2971a102c829f92325ee4d2338157

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

MD5 da9313f57db0606bfe246a4870a55bd0
SHA1 080ecc0717a32d51803bf10364c6329d7882fa64
SHA256 7eedcfe1b60554621154b8a7eb65b1a29ee25ef29442e1c19e18f48336da3dad
SHA512 59f9b7dea4703c400e405090fc510c0bb92015ea8d56ce4fe13aa80927e952f6935ae65a9035344eb2b3f0d06697d9cda95bb55c535b17fddf71e40697e8a2a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 22d6f46879ed703b9c642dceaf78ebe5
SHA1 cd963a0b8ec1aac9cabe9e8885d4a90ae5910c92
SHA256 eed7a40399aa76157536819d113f417b0bd1c6e9ec4ddcf541d04129c51dbe45
SHA512 cbadf29fe37d1343b02bea56cfca3197131ea0aa031a3539a4c2a3eeaa612535d16609ee2a8d8eceef27d5a36d6aa2ace0ae1ff3c8560ec47da16dd1179acca4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53d90313825aacb681a40eb1cdd3d6ea
SHA1 9143e9543f13ea33258c3f8b7fc42a554edf7e09
SHA256 48a9a69eb0a9d7ed21268aff9605260e04552b8dc1164da0127918dd1d3e8137
SHA512 f51c698edee9fe505324786c8519fefe67457504aad63ca563966d4ab7e935e2876fcc05d1dce1d5dad3c64742109c3bcc9c68b3b0f242aae9afd40fc9fbfb10

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

MD5 28be8fb66e15666e30e7e6308bdcb28a
SHA1 6a6e4b919f80bcc0f4222707eee1e082eaf29e3f
SHA256 00e2d0002994edf303173e6b7e6be5618e5b2aff7e4ad670b7a39431b8a5d76c
SHA512 eb538cc15a3be832214ed272fd61c7f9282c46eda5c8e1a2ea05b682f9b855046f4e549362165c63c63288676e9f803a0c2969beb9cea3a0312732d880d423a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

MD5 ed080741068defeb02fa6c3319890eec
SHA1 c4d90207b762c6877ab44771f41f9eb99e13eab5
SHA256 d84cd327337cdd4c30fc11922524bb1924fa99ffa66e468b652df946b1421926
SHA512 5c9d580e3cf65c9b5a44821340ae55a9820e137422ee97b33ee0636201657a35d673268bed7e7afe5832496b86f72da2217f9b7272c26a1535c4f304f84cbb7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ee435307ab181da0352a59ca071cc68
SHA1 5a72195da4ad0b422291f3831e5116dd3dfc5520
SHA256 b5a1a1ed4c2fb5fe3edcc20fab3f1d8dc0cb1154aa4faaf980d588083d1c422e
SHA512 147477651114fc7070d1400aaac92c3dd35c87278e35c510899b5784cd75a2528c3fd4212e764eafb48e7443a6b2ab4fb7d33dfa29682174713001c563ffdde3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8fa13364d78eefbdce294cfc7ef8f1dd
SHA1 f7b362782a7ff43561eeeedce37262f04a83f285
SHA256 fcf8a9b5eda00d12c44a7014bb5c16d2088c25d46cb6695667316f9195afea7c
SHA512 b3a55146edf6220af3a8356d60d7c894857a69062df2af2e691b02ea74aa1b10f1ecd7329427dedc2e226262f4e71716ad43a2aa8fd0c3f36e47a5da77fe5b8f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

MD5 11dd78d42ea3b671bdc366198f26e3eb
SHA1 fc54a3dddbbddc93ec4f47e1176ef0d17a125c6d
SHA256 fe7dac6a6fdbe00f6ffd83512c44f89631b731c8fd8c0c4317bd17a85b2674dc
SHA512 a600369e6e0b04dcff5f7252db6a1b62e30acd286192fd8ceb4b463a2a01821fcfcd9355e62b880f5dc226ba75b95b2047377fb22b524cd3128de6a17274c622

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e59d0781837feb358448a021d22ac859
SHA1 3a999bf77505738405433dc999b544a0869ba4f6
SHA256 bb4f1e295d277815e50d0f38faf098de706cb85c4e218e95ce0842b301ff3127
SHA512 bd8dfe654464cd6256bea575b650289db7c15ed58f7dc2ab6ee30fdfebb5a669b241b35ca36bf715dd2dfb871e687662e8bc2119fea54ab126a23d4a7f8d674a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bddf12111e8589ddb915075a63c49d21
SHA1 9bdcc734813217ad0654522a030d7644b73152fc
SHA256 cfa5db0c8cdb998e73aa73889c6f36f9bf41358004de22507f3173fa7b467385
SHA512 1ce95eb5b086fe7c9ca594e8f8d5b6289dc091f39e492c21cc9718dd3f1710f31cf2b2cbb741b19eabb1bf85a9f2d9b1d9ac04ccdef029f517968a9fc0fb6f7a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ca3ef1da6a18efed4e33db96930d030
SHA1 591e1d48812f75f9615ebbbe451b5963b8ecb15f
SHA256 317e3977e5da2eb09e96ac18cabbe013fbad6025c15792322a94312aff8c1270
SHA512 8f8d651bf66fe91244dc166575e7a29d78a2fc4f451a6a3257f446e4f14f945d5dda41d6a65de26868ae8c1e7baf14693bfa63aead952121af4ee18dfb21de26

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a530ec2205d97168fbbc3e8ce5bef8e
SHA1 ab7af4d5452f393124ff75146b1381532ca4fc6a
SHA256 ea4ab627b18f549cbf10b0f9263a7ffd4a5c58ddfb1659c1b58cd3a5c8958309
SHA512 aa4e69a538062d7fa33d32d963c400f59bedbd68d2fa1626487f27d868db4efda9ffdde082986e3a81f056c9138a8aeed130351d120d5f11a4f899b181511119

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e30178343b8f2125e39444390af03f6
SHA1 4bd26b2300154cb4d10495a32317a78675d0a4d0
SHA256 414e98d8229389cccc5450c6fa9b59836cfbd51ce531414fad0b4beb4a048e8e
SHA512 5b5688f8d6d646c90a5b9c1eb55634d27e54299cde930d08657da6b5ef3c6b594859576bb6648c9ec89f914af2062617b9ad6618e5f253b6839810ed9c6fea1e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4813ef8f3d8b6bc1074c6b02678d1b23
SHA1 26c129844b928f09baba129ce54fd75e3659efb4
SHA256 30735b1effdda6c5254bd756eff5e2e26ba4d8599b6447e8eafd3f8b4417308f
SHA512 cb365e8081da78c665b56a015891f9436f0cb6c492b2ccbc5c0754521774966b706414e7542ffbe2eb5c5661aaf7e87a59b7db5823170e2e78bdd4dc6a4650dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20a6459afb0722522f8b5fb123b07ea2
SHA1 9e2981f78f74b4bef84e60d7689506097c2d8f08
SHA256 742d6a64ebccbd2cd383c975f1060dd2278785f4678a1afb12691c992bfecb2a
SHA512 35f22f94159fc189c990699eb7f54537229889390544063417aa45639e6cfa7eba9203c47be39717e58d72bf0a58c41adb3bc2bd35038d7af0534b3fcbc9fe05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4fe53d95afa2bec911532beaa40b5bd3
SHA1 957561691230ad053430184827ea6146dbcbb4ee
SHA256 e77fe3be801d1c082289e4a0efffb63bbfaa1f6cff0c226577cff21795b58770
SHA512 240faa5f6ac6ae2ae2c7ecd4eb9bc546356573eb02bb2db6b558404932510cde54c10d0ab1dc1f033aacf86772de12a6b08b0042e79fe0f21f1ea6a6e2f37679

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6389ad29d6515266c04b8c233e98475d
SHA1 cfc173dfacaadb758c06810bdd0fc68b4b0e8060
SHA256 bd4df0a631498f3f34967464498d07b445aca3f811431421a3b75a20714c50bd
SHA512 6cfbb7b03a30e8633b421db8eebc6bc169201171308839646d8c94ae27ca81c57724ed3c1a57033165d644fda6d591c99a1c20a5d38e9948f1e61451247c98c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e47a3f921e5b601e287339c8506cf71
SHA1 b24488fe2978e7087ed08cb249b5772c185b2534
SHA256 ee9c44ff4a80a7473dba58b1cddac35c39c02ec8fd0eab70f170553326754e2e
SHA512 e3508f5fe00f187132523de8a6b6b811254ea95537413cf654453836b2cd3d540aa05c0425613b71b7f951b93a6bd18b608ab7a82cef04c80f54f75b18226d88

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4772b2dc573c383942ab7d0d1dd96f47
SHA1 2c320055670dd64543fd3cf691252b8d20ded97c
SHA256 508307bb734e2b3e06e91a7faefffb08d371b1f7f1cfca57465f9f82714b3c93
SHA512 7eba26ef70d4bc2ff131f84d82ecf5b376d5c8c5c7379316e0f4e32d8c2a312cf9dd9eff743d051f0e87a1b30b18f6452b668c2781fcf9cc8b1ef4d68238e930

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca711942d780200fc4dbc40ac6cecd05
SHA1 5cbf06a4052cd6dd53c1bacf17cabd70b4c1b461
SHA256 c35edb52b482b6b22d91eff35d9d73cbb8942f7499d7e0ad38d63c4205bbd619
SHA512 4b1a2c128d52cecc642c863037010e10fe9fc2eb2f391f7201b56eab1d3d352e4ae274cce36f60dddde8d5901b55a8f6562af489b77b8de8923fb978d5f76168

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b3bbf00eb0fdb380e0998a257cf02251
SHA1 b328af9a89fd6a8dedb5035ab2db938a89da0aef
SHA256 a7ddef0a91a8e0e691fc32aec4c26d9744b1f247922791336bea5b33799c9c75
SHA512 3033deb3ebbf79d6abc205786c9ad98420c6901c22573fa999c0fbae9c55111b5c5d1a03b04b88857fb5080baea1060387533c9dfc1cd736870d885eeb65c4c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 32743765177a8ebd8236e33b61e64ed6
SHA1 cba905e427f86c75ad29064ae7fa375d3821ad5d
SHA256 432c34991d46439a6385c872ee671af7112ba3e668d4aa621fb7c075b582e62e
SHA512 2b9b466af1f0ec956a5e6348729cb87fa4ae6f122a7d80ee4ebc9839d5044a4c7461fab619952520bf5ed41bc0fd5358e61933c3a19881529ba3632ad89140fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b82425d4ec51c7b739e1b897e2db6b5
SHA1 3d3d576643a04b8188c055d52c15748266a87fd2
SHA256 4c22b0632992155b56239a45ce07a2a62a8bebe16979d913b4482c4ba26eeb7f
SHA512 89fa7aa4a54a003b904061045c5626b2f6048bd2a1d3cb9499146a0582f9249f46b425d340aefae06c2af0b6ed049290c958b815e0a8eea529e1eec3fe2e1b5d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6598eb1d5b47aad0501b8c7b0df52910
SHA1 c01feb9bcf802fc6c8b102d3cad5950a5b628371
SHA256 edbf8d50705e292e5bfdbb79b59b90a2771006f76c17f3a5b31f27f68a15610a
SHA512 8ca0f046195fd12e6857c01ea9fc922ac069430178c6af322c2d88c14857b7c4dbc25154bf2c1b66aaf97363ed864e81ab073b9dd2297b3e6bf04f770b4bcca7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4a92d4633bdd1370611b17fe821c4c0e
SHA1 e1bbeebfd4b838c9d1f5613be3f60db46582517b
SHA256 64736ab43a7a1ebe42c55bbcbb45a6643869d757b0d0de51d1daf8370c63ae71
SHA512 78d54dde2e55dafc820a2d360008235f91922dab6d9c1f60d44b055b7287ad3791c1aa71de4bf6813978773dc23cb11fad1cecf0d77613c7878ffc382ae6716a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e2baeb6f1e13c214c2a39118984f3c16
SHA1 f20fac6a9b849866b3d3c99ba2364f7ad275fa18
SHA256 940d92e21e196803209bdbb60b4d6fecd6d3a5610262e48ae4f6d9a3a2f8fc62
SHA512 58c52fb4043b566ebbd57ca542cc14f7559f7c35e1d3af391053d9e5ff236b3fed4ad644d4bee302256d64784d390c250f1871b56311b6865ad6044f5e91754f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 76323a26cf5401cd3b94305d3229aca5
SHA1 de7f34582af19da4feafd1c32984d7abf5c71a5f
SHA256 555297f8b0e32989af1522c96ea2fac6033acdae0275cc3259133904a1b467d1
SHA512 391a97fef74a54a380c3c80935b0b9b6f66b3f03219b159dc60f13e2e45c0025b2ab628840f89003a08dbdfb263bd1cfab06aa04997d5a8dd34d121b305441e4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4686684c49d4f89487083d57416614b6
SHA1 e2ff5e456ac07e3c91948a7981c176e32b611f3d
SHA256 5388cc293c53959ef93a72074a2e0952d945024360a46338200ef8440e68c625
SHA512 90b361ab193c8651e93b6501f9f81df594a531dcf35925da5e80b2200edf8eddf063df52877ab855ac4f4c3a279994cd1418865a9c65b9a9a16d024043620422

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0492109314388b652a3d4769f9728462
SHA1 3cf2f7da79163148da147fa4cefeb660c1739e7a
SHA256 0c136e4cfdff7095281cf6fbf806bca9ef2febc83b408b5b5ee05642647ae53e
SHA512 9a7523e091851b1e5652ac45d688ab2f5a20defa33dcc48b360b8ade8081846215c18dbdc192203bcc4025741d5f67a1ac592aa8ba9360a9d63cb838b0319594

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e002c2689ec43568ed35b0df8f0c75f3
SHA1 2460871f3fd3ca89d8bffd40550f03d1ce70a3c7
SHA256 31d2d412edc8a0a0ebd00e63a3dc7c5a64a50e9ae3346aad897d89d41ea42e00
SHA512 f418f9f5350bbf8ee31e24e99d85c6ddf964ed10149a25cab3d986a59a3870c2d2758505244ddccd288df6cf96f6414b3ff6a43aa4639ca60c497c82c8d03cf9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 8a1598c781a92ed831b3d125438df63c
SHA1 0e4c36a2b1366c23601d5a570acf7268f90e687f
SHA256 dbe5380d6c78658b44a6b0ac4a55492f1cf0688d389c507f1b69bf39b0f1ab8b
SHA512 980bbe835d5554e72e9f2ed6b817bb7ef5313f9aab629f4ef45c4cb08aa5a176b5c938ed8193f6c32b750581cb0f851bf2230d56326792122d80137ed30c8b98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7e9ecc8c76199e933dee054ac9ecebba
SHA1 6edc5d8df5661fb0b936a53df21aa4a25f6bc7fd
SHA256 0c5b3109c049063726803c1cc0126eb991f4cc41f1451c8e2a154e669d64b804
SHA512 f7857a86df4ff16285ba0b57813da9772a047a53da1c3c63790ec9273f856b892053b587a67b2b2994d6c02276fef5d721814d73ba3726e28a538647f7dc8212

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eee09f7119594fff2c09392fdf0fdfe6
SHA1 9369ff798822afc1a46d36d1ea459e92e269617c
SHA256 a880412616f88e31106da1b245c02e87040691e6269abac33c70dff0dc820df0
SHA512 96c264e40d29cbc20e7d28842e95095a6fe145690ee02a38b098ed8a37aa2750252878bda991064d68103bef32b86a7b6106161e728477fdc2dba7ff3886301e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4346d62dd031c307fff056648caaf8f5
SHA1 a3edd80a26ee92665f933ea3e2073783e187f8c0
SHA256 833874c6fd087f61a23460972650371ff515ad623fe81d5a1d93ac7f3aba3bf9
SHA512 9466c7d129b0c256937a6d3e009da45db648cb2e69357ee64b3677bb5e5fae2ec75422ec9ddb9e42325f3876f22e0657a5d202b253ccd72c420710f89b2615a0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a52a814cf961c7507213af5e114a96b5
SHA1 780de061ce77863609f3e7d79e7bced7c4bf7e3e
SHA256 68f1122a6eeeda20197fc787c2c4bc54b5fd37a0464a2a34c5ef7484729f785f
SHA512 27cac1337bc6febd9be90c1f8be5c1fe094d4b42ebe8be8bb067908f39cf4dee8027788cd8a059a415845fdfb1f5356fb187893e2fe4ff14cc2a0acb005bb40f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e8da15d9566ce5d1218713a94c5c5352
SHA1 57b2657fef26c1a057fc5d80dad700b9cbc2faae
SHA256 5e8c63248298a73ee05b23e24ac1b40adf7698e27c0872cfb54979fd6d149c10
SHA512 d715c7af30b7145a17ec7b589c41be58c50b7405821c12fa30963adbd144cdbf11ad69b08dd84fe7c8c6cb9d01947843e0ab20fb20c812d9abb52fe6575838cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6312689fb517aa37f3fd87c6c1f8f354
SHA1 aa5974de586e9713000274f57b9a6cd8780c9607
SHA256 550ce6e189796e1150aaeb9c1571e4834fc73bf2b7260a7f7d6ba570760c3320
SHA512 fa677c81672d8a35079bb8ab8369bff1d8257ea1d753babab18e027fd21073bba20aa9fe156e2befee07aa126ac084fbc3278a1ef41eddd118c0ab1234494c27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b0c9739a5a4144dfafa51f45439c9680
SHA1 67ba8394d176e861f0b5f0c8cb1348376c7ac77c
SHA256 924cb6c7e23fa08023e08f8f5da2fe5f32d8b09f5031394753c9fba86dff0c40
SHA512 198fcc8c8ac55bde42a6d9ee3032dadabdb085e9f4d01abf02eec81616288e3e77d77e65b10294e29b6dfdeecd75a28a11b6a01a119bb393eb99031d2fa6181d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9aeec9d2433726c9e674b6e5ed29ae0a
SHA1 67a6db3bc8bc5d251930bc947ba015b049dfcee3
SHA256 f0ea2f001707137c508f7c82b1587160afdbfc86177b349a03907c7dff051907
SHA512 38f5192afc6f31bd407498157e7b2e5b804369ac3c0f7db4489796166bcd5f6b9cfd64e63544f9dad78a791a7d5635352707a6e9bb29efbad3df4ee1a9b774c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fb8cd0a841e6242fd4f40486752342e4
SHA1 ce743d46ba05ba4053ae894c75ef6e5b557bb849
SHA256 8f29654e701200743f0c4d8da7dd8d0cf4a87c0d903acbfb9bf6b81347cc1b5b
SHA512 4a12d1ae59cac8f15ddcd3bbb54052beb610aa8e8066cf5b1d57e273b9075fe39d0d2e2d01f4ddc75164a242ed50dbb863873ef66db3539cb005cf10216ebc7d