Malware Analysis Report

2025-01-02 06:08

Sample ID 241202-28gksstndn
Target baa553f1e49ce769cdece59801cf1922_JaffaCakes118
SHA256 02a5466eb5df2aef6f904ef7fa8ef36c2b98ace1ae5998cc516ad69884246550
Tags
socelars discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

02a5466eb5df2aef6f904ef7fa8ef36c2b98ace1ae5998cc516ad69884246550

Threat Level: Known bad

The file baa553f1e49ce769cdece59801cf1922_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socelars discovery spyware stealer

Socelars family

Socelars payload

Socelars

Reads user/profile data of web browsers

Drops Chrome extension

Looks up geolocation information via web service

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Kills process with taskkill

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-02 23:14

Signatures

Socelars family

socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-02 23:14

Reported

2024-12-02 23:17

Platform

win7-20240903-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe"

Signatures

Socelars

stealer socelars

Socelars family

socelars

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Looks up geolocation information via web service

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c taskkill /f /im chrome.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im chrome.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.listincode.com udp
US 8.8.8.8:53 iplogger.org udp
US 172.67.74.161:443 iplogger.org tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.3:80 c.pki.goog tcp
US 8.8.8.8:53 www.iyiqian.com udp
SG 13.251.16.150:80 www.iyiqian.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
NL 2.19.194.200:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
DE 184.30.21.171:80 www.microsoft.com tcp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-02 23:14

Reported

2024-12-02 23:17

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe"

Signatures

Socelars

stealer socelars

Socelars family

socelars

Reads user/profile data of web browsers

spyware stealer

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\manifest.json C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Looks up geolocation information via web service

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\xcopy.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\xcopy.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3860 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3860 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3860 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1936 wrote to memory of 448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1936 wrote to memory of 448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1936 wrote to memory of 448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3860 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe C:\Windows\SysWOW64\xcopy.exe
PID 3860 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe C:\Windows\SysWOW64\xcopy.exe
PID 3860 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe C:\Windows\SysWOW64\xcopy.exe
PID 3860 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3860 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 2244 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 948 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 948 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4536 wrote to memory of 4028 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\baa553f1e49ce769cdece59801cf1922_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c taskkill /f /im chrome.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\SysWOW64\xcopy.exe

xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb7541cc40,0x7ffb7541cc4c,0x7ffb7541cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1896 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --field-trial-handle=2152,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --field-trial-handle=2220,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2264 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3328 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3544,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3320 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3672,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3692 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4780,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4824,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4928 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5088,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3952 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5516,i,6369775229885184163,11732406655831582223,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=960 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.listincode.com udp
US 8.8.8.8:53 iplogger.org udp
US 104.26.2.46:443 iplogger.org tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.3:80 c.pki.goog tcp
US 8.8.8.8:53 46.2.26.104.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.iyiqian.com udp
SG 13.251.16.150:80 www.iyiqian.com tcp
US 8.8.8.8:53 secure.facebook.com udp
US 8.8.8.8:53 www.facebook.com udp
CZ 157.240.30.35:443 www.facebook.com tcp
CZ 157.240.30.14:443 secure.facebook.com tcp
CZ 157.240.30.35:443 www.facebook.com tcp
CZ 157.240.30.35:443 www.facebook.com udp
US 8.8.8.8:53 150.16.251.13.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net udp
CZ 157.240.30.27:443 static.xx.fbcdn.net udp
US 8.8.8.8:53 27.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 216.58.213.10:443 content-autofill.googleapis.com tcp
GB 216.58.213.10:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Login Data For Account

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 a6afc4daca1966dce8e72cdabf707250
SHA1 08a76c7d4ec1d5488e1e171096b2f28d7e0664f3
SHA256 4993eeb17d2ff3fa98605b03a39e51ef5ecf6ca9a164b3694fe154f35e3ce1b0
SHA512 ba5c8b3fa493fe8db0143a3a51d27b1b4635069a3d08666797dd2fbff15c6da793601d0e64035d3d191126dbc2ae7656cac53b5af5e2c2fb72e94b768c7fb957

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\wasm\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extension Scripts\000003.log

MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extension Scripts\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extension Scripts\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\background.html

MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\icon.png

MD5 c8d8c174df68910527edabe6b5278f06
SHA1 8ac53b3605fea693b59027b9b471202d150f266f
SHA256 9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5
SHA512 d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\manifest.json

MD5 f0b8f439874eade31b42dad090126c3e
SHA1 9011bca518eeeba3ef292c257ff4b65cba20f8ce
SHA256 20d39e65b119ed47afd5942d2a67e5057e34e2aef144569796a19825fea4348e
SHA512 833e3e30f091b4e50364b10fc75258e8c647ddd3f32d473d1991beda0095827d02f010bf783c22d8f8a3fa1433b6b22400ad93dc34b0eb59a78e1e18e7d9b05f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\aes.js

MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\background.js

MD5 5f1c0e6f4ed2c906fffd33946aa37a15
SHA1 6a2bdc2df5909f2d1d03f82001bd45bf8faeb18f
SHA256 71548eea1ebedde591dce66fe7c83e5523e04a720d214b015b3a036867c551f9
SHA512 00c49456cdb82acbc9b9df8e1f9f589728147d0256362499461c0631a28c2425a43fe789ee051e37a41840db4afe7c22205c64fa4f458f1f52ccc98ae0af9304

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\content.js

MD5 dd274022b4205b0da19d427b9ac176bf
SHA1 91ee7c40b55a1525438c2b1abe166d3cb862e5cb
SHA256 41e129bb90c2ac61da7dac92a908559448c6448ba698a450b6e7add9493739c6
SHA512 8ee074da689a7d90eca3c8242f7d16b0390b8c9b133d7bbdef77f8bf7f9a912e2d60b4a16f1c934f1bd38b380d6536c23b3a2f9939e31a8ef9f9c539573387b4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\jquery-3.3.1.min.js

MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\mode-ecb.js

MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\pad-nopadding.js

MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json

MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\index

MD5 58293ec1f5a55e3ef1f996f4780412aa
SHA1 4c64909091d34a3f85aa9906900934d3f4f4ad9e
SHA256 b076a4b7e88bb8fd63d6d43eee2f3cf781d9b7b26a491c762d3c114a7eb58648
SHA512 e5230b9fc545438075b7a9c04f6a06e5804f49411a9f03e1f9f20cd72ddd7db8e0d1bd194064843b9ba46476891a9bbd89b103e2a3fdd80d00fc8fe279fa782c

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\index

MD5 56a21a5573dfd245164ee107273605bc
SHA1 aca667676e6b417684390195ac8adda844ccb65e
SHA256 39942aa4c5cf2070bb2517a22d22799744302bd6b88526e7ae04a159d3d47623
SHA512 69ec73cb4e9d083f586da2d82d9dce68fade648793569745897d20162ebfeaf00b497c9c01e13827d9c83623aa013a8f4d4e389e3234eb916e200e179412534f

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\db

MD5 491de38f19d0ae501eca7d3d7d69b826
SHA1 2ecf6fcf189ce6d35139daf427a781ca66a1eba9
SHA256 e58156bca5288238d341f5249d3b6c91ab37cef515358953b435339100d0596a
SHA512 232f5df71e8ec35e500ac81aa54a87b3523fe8a32168096a2a76f08e5c7868100b3cdc5155786ead489aac440beee3f84ffa43d226a5b709c66012923b20c696

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir\the-real-index

MD5 3c1b873c8b70d4fb8863a9666f5556a0
SHA1 730c711a906bd0d740cb83dc2b2a99ed7355c807
SHA256 b72bab5475a6d4e2e553e680ede82abd1de4304a783180f0170256878d3a00dd
SHA512 f73760eb7fb84a8cbd627f9b25a9b8c8dbcce169f80dff2cc971b2d9390983759ab79b58ae3472f71dde6e081a2558687484cf72d0f60d83bfc6c6d4e48cf306

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\CrashpadMetrics-active.pma

MD5 9a31b075da019ddc9903f13f81390688
SHA1 d5ed5d518c8aad84762b03f240d90a2d5d9d99d3
SHA256 95cf4025babcd46069b425449c98ed15d97d364b2461417caa9aa0c13cb372e1
SHA512 a04726a429ae727d685f0836327c625d2f18d6327253216a9a31265a324b68b06bec4e7f1b744d261a0e67fa0a90c43719aeda9d2998f42525b0ff5640c7bf1e

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad\settings.dat

MD5 9e930267525529064c3cccf82f7f630d
SHA1 9cdf349a8e5e2759aeeb73063a414730c40a5341
SHA256 1cf7df0f74ee0baaaaa32e44c197edec1ae04c2191e86bf52373f2a5a559f1ac
SHA512 dbc7db60f6d140f08058ba07249cc1d55127896b14663f6a4593f88829867063952d1f0e0dd47533e7e8532aa45e3acc90c117b8dd9497e11212ac1daa703055

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Local State

MD5 f424ccdb46784c085c96de6552f8fda0
SHA1 b9d8315b3b400667a7860dffe2c644e6bd6145d9
SHA256 0cfa0a1470211707cc8e28f5137d064cfd6e3a2926d3f1a54476f5c90211b0c5
SHA512 4634250b29eb644f9f45e0c1c17a84a4115cc240a2fae3265d16e7b90fedfeae52ccdcad7d4efb026ada04c8c2b00bbeff9baed84f0f7d37b355b41718273ec3

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Variations

MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Trust Tokens

MD5 767a7db34589653629c0d4299aa9eb7a
SHA1 57375ca0b80b3c856b76b3b080270686c90ccb8e
SHA256 78a4734f08b47286a3736c88c6fc481f76bd2b1a46e29d0920939f088ce899fd
SHA512 a01b63edaceab16394320bd2d9152faac7f0c3971001049e8e931b6403f97d8e5e6f4e9020a446cfb573241321cfd26c3d982f30139799fa7fc32617cd1ec859

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity

MD5 0e8652f0efe372031101466e10c6e3c2
SHA1 d6a2012a5d569dd9c749bb27c1c7bf779c39987e
SHA256 a05bbb4d1fd97b203a09cfb865e9c5427752ce3719afb96a6e287766c63c98bd
SHA512 610941494002bf0b8104400aa409c1b751cb6170b557a20aa6d6537ff1f73d498545e05d1dcdbde31fa0cad05c41f6d87f77dc9bfdd60036e4e6f0da0cc03f94

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\Database\000003.log

MD5 f3119ceaeab7e7f7282b51a6a57df067
SHA1 c01cd6206cf9c2279da6efbfd5ea8d37307beee6
SHA256 4d10110e21bf1392ce38b71b597c74a39f1d059e06d590e78092d830a5254422
SHA512 2c9293e5c2aba704d26c8cc60a6a3b20afc456bcc906bc517151c7f5b37cf2a3279a1606c8c6548e56bfeb1d9b71d9505623812af547341a67b9119a401eff9f

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Reporting and NEL

MD5 18349de8b0d70c0c5ee16b83aa18effb
SHA1 593c7ebea4164fae6697988dab8eb393e43dca77
SHA256 eb9c6172a218386846e70d7ac042212f3643eb7c1c1cfe0ddde50abcfca405b5
SHA512 908765080578da7cd41def5aab5a7dbca7ec1e4eb119c2bb856644b434016ec52c9818cca82ea4d08a79ef74190420ee47a13cb3912c1f30f7e7ede4e1146fd0

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Network Persistent State

MD5 4a214eb053305d773ab840d4246a8524
SHA1 c64570096e33d686889c43154c6ff09bc71dca92
SHA256 663a6c0501889ae3f3ac8a79f64b97713ddd5fd10bb5af20e29bab58ca364ca3
SHA512 6e01ada46e92019343b52236385787c1933441d884715143772ffe7bcf63daf01f8f5016e61666fb981a57130b3e94e0b879fd5c85db1978d08731619d81548e

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\wasm\index-dir\the-real-index

MD5 0e33b6d6d3664488306add92f14a15e6
SHA1 a00965a916e625b64e121eea025edddb909d842c
SHA256 62e37c6231ecb58b89362c5494202ff6a88d873edba9af8d11e39f5417e1cbb3
SHA512 e5cb85b9024454faf45c2a656649c7870f2a9ec4d6d7237a921f7999fefc06a8497b5d3f007398b06f147f7c1d73d5627470a474c691c895b01026f6ffc236f4

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Favicons

MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Local Storage\leveldb\LOG

MD5 37790bc5270c6fc89c6bd992aafefd75
SHA1 037bf9cd0d625d286f1d5993b0cb8440aa1654f8
SHA256 64b874d9cea1683e4de93239708380162998f7faf8a249fe7f72938a88da5f29
SHA512 cc2cf1937c2931e44cf6ab7bc8133c5a18e903b71c8c27a8bef0a38cfb25523712d12db2e52d1778e1863f750ed9198ba7236bac00842195a8517bdc1b9eebc3

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Local Storage\leveldb\LOG.old

MD5 97ac56eb93cf597b70d8999306bfb42c
SHA1 37feabb943a7814eebd09719db3df534d0766f62
SHA256 a6949044aa730943a0c9dffbe549ecedb01eb463ae66df2f4ad014fd9830426e
SHA512 18d638ea9cc8f42d56c49656feda3ad5eccebdf028745b5ea2bdf6aded7fd983567ff735542f346e74b67d988a90949ed64a7f0dc11efed0263997b0d112db01

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\index-dir\the-real-index

MD5 84f4d66f06cef61593915282a58d3601
SHA1 e7279e1972f41e97f1b366728fd33de98844afa6
SHA256 65f6e9aa70f5012d6ef7b1b0f58caef26f3b349b8fac36092777c16b6b29d748
SHA512 87cdc7381f094f658a80cf38ded6726a37be886ec9caa917610b4888bdb25f9b9aa21c2afc8149b9d1ad04a6388586a008063f184d59001fa796ead859276daf

\??\pipe\crashpad_4536_GMPMTETXDBSSIVFN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Cookies

MD5 1ff7b37068cb23a3b91adf01458de257
SHA1 70fc8a99c8bd123cb98e7bc08b3b6b77e6f12d72
SHA256 0a5c4fd95d63ba3d5a9ddb3836a4e879229237d5865509d000bec385243400b0
SHA512 da3d1289e52b08892664f29852b799adb1ff8116a2f9a4c2d399025f1f332b8d03153cfc40d88dfa94e163bd9179f9459d18ccbd8dc7392574f2baeafee245ea

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Visited Links

MD5 0867043aaec2de23cb615f7c9d417de0
SHA1 977dc15dc42257dc2990e6c84e867817f13a4486
SHA256 218e5af44c2758d6a3b1b32e70cc1bdbab2f417a433b62ae317314821d7843c7
SHA512 d073d08cf5819c4462928897962eb0f5e4f8d8e663c7982609d435bc06de8824cf7b5b35f5b6cca94fe55096f21334887aecab51d3e243a07a3640fd8074db86

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Shared Dictionary\cache\index-dir\the-real-index

MD5 be93e696e5126b610af9e3bb6dad38a7
SHA1 32a668adba8dc47014d620cb209318a2785299a4
SHA256 076179ba63b10b54a0b1e8a4f6f666fa3153d39a25d88f35c4e075ad77664a65
SHA512 097af0b5b52a87dac8031f98dc53657fefd255e085197dd8180ed521d69595dc5d87a8c69b57db802003165fb05e3e3609e6bc153b250872c6cf14b1a49a8143

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\index

MD5 aa1527a8755841cae2e96bbffcebdb56
SHA1 cca5d6363c37b62e0ea15e3e03fed8bc3600fd02
SHA256 05fa40e2077781a8a55f8dfdf4045852b87efe2ce788a37c4ef8425f62bb775c
SHA512 4e44b833405e31a6dfa931166e4d11babab99d4e314a47f62670bfaab2d83d3b640b5981ccaea420e24f870cca27f1aeb4e932ede6a61fede32babb97edb46a3

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000004

MD5 fdf77c32ada9577456ac4fdb70056ada
SHA1 e197b4eae997110b5b345240c64263e861f15662
SHA256 1f643da7cf7754ba189b9d6487c136ffba755ee477d79f7e524625a4d78ba752
SHA512 741f05102e05731e339e79897de3cc06f9d29c9bc2afaa81af17b17c061380ba44337c9f83cbe8d51f2035e9342da8c836dcaacecbda3d70689119a09c39b8fa

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000003

MD5 abda4d3a17526328b95aad4cfbf82980
SHA1 f0e1d7c57c6504d2712cec813bc6fd92446ec9e8
SHA256 ee22a58fa0825364628a7618894bcacb1df5a6a775cafcfb6dea146e56a7a476
SHA512 91769a876df0aea973129c758d9a36b319a9285374c95ea1b16e9712f9aa65a1be5acf996c8f53d8cae5faf68e4e5829cd379f523055f8bcfaa0deae0d729170

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Web Data

MD5 a1eeb9d95adbb08fa316226b55e4f278
SHA1 b36e8529ac3f2907750b4fea7037b147fe1061a6
SHA256 2281f98b872ab5ad2d83a055f3802cbac4839f96584d27ea1fc3060428760ba7
SHA512 f26de5333cf4eaa19deb836db18a4303a8897bf88bf98bb78c6a6800badbaa7ab6aeb6444bbbe0e972a5332670bdbb474565da351f3b912449917be21af0afb8

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000002

MD5 9666d74b18f57389ee2d3dee5073f71a
SHA1 1830bc2670e616a1da1af27157159e6677a5ad63
SHA256 6fcb1e788f9a12b8ad937172802c41475f2180906db38d6507a3af6a2b721cae
SHA512 69ea6d6080b3ac00f4c4fcf9e00c9e16bd2c3373073f7dde3b1735fabeaaed1e7f8b76113e5ed2b9df08d089ca33ec367c595312f0c2f6e0fbad364464bc989b

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\data_3

MD5 6c105696ea11b2ae1b3ff705c085ad35
SHA1 563732e82fa2c393b35347673bda14a5e81c96e1
SHA256 88734c0f72f3147e041eebe3a6cc70a649745f7649ad8aa16c26ed0d9b981ac9
SHA512 8cc14f81e7f3ca59e1e08beabbebcff0cfe0e2b5073bd27a05ec451e6d95b0396ff8a996e40ba8091471bc7eebddd8556c2981c14c42e823bb07479ae2bed848

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\data_2

MD5 727ddba6c69d2e855820b57ad8a5cda7
SHA1 2d53b1c7e3ab91a0c3a33cfcf75b7d9d3bf1e202
SHA256 20b34e761ac58e4c1d3be056e0ca65e1372143e4dd4fad25c19f1f45f2e2fc19
SHA512 e3137d4f4b872046c2c0edf72b4a8f14751a2f265ae0703409a78ff2bd54f877924ec445b550e69d09171503cf47e6ddbbd341cfa7e935fb985add2545d3bc98

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\data_1

MD5 7423b5edec0a7191b395f0c3ac2e171c
SHA1 c8107ccb7a20a899a658173605c3fa62ec146e93
SHA256 a177e697d5751380d34ff684a692f766c69f0764d4a8d079382ac6f43f6c220a
SHA512 8a84be7b13a51a3b4ef1b366de86e26fd6ba82f8bac066dca82e4f301d14ddb218360a241c5f22363c72f62b1a2802a048406066ae4f0107b6507839deb1f300

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\data_0

MD5 bf03e37b2b35cf9288079d8d846adf8a
SHA1 17773527162929096ac97e36d9fd57c3ed6a8441
SHA256 3e38ff8e30ff084364519eabcb44b7b60c0bb38df571991dfc4f3de1709be16d
SHA512 e04ef6bc2b42dd01ffae9986750a2cb60f0c7a5e573a5b6f9a3980e2c4f69b6dc6d68f77cdff3fdd364c5f17e48d63fa744411d33aa6ba99995a6111e0a0dc23

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\Database\LOG

MD5 f924cc4a84bb51670d4be725f9b1ccbf
SHA1 6eb3ba5f7ef2c7c42f3b67ce24fbbd1a3a1120eb
SHA256 025944d952d85b7954acdcbeb7ca1b556d21b4cc7546abfc2745b8cb309f0c42
SHA512 02b59a126b8abcd334b3eb9a5b7ca14edd371069a23dc9f4979b262314c5d60139f2885f1682e2560bf02dbefc257e36485dd8cb067a6537c315896a006256ab

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Service Worker\Database\LOG.old

MD5 2872400c2272c2e7b07b912176a3c9eb
SHA1 f39ec7736e31d94243d9b6cfc01bf918e58e4193
SHA256 0cb290d849c91810e333b6f46d6f9697cef94c637247f5a65961232c14db657f
SHA512 43cba371ee5bbb55dacb01b2ca481a685164a9708ceee2a3206a072e2f39f8d6e9b7f2bd511f947c7903e2d5f8875abfac1938e5a8ad81bbb6688002c01915a2

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\History

MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\000003.log

MD5 8c38784f4a1a17866a7ad3408fde94f1
SHA1 1b25f4f863b0f792e676ce5998bd28b85acb5c55
SHA256 d1cc4febf71adf076e9324e21273c60f695c7a893065eae067bdb871a19b0def
SHA512 5944e77f79e0fb10192db49cb3918262ad34ac17e969eb624e1a9faf585fc49228c57e74dff90fa667df60582d8b448db0c2eb0b369126be639734734d0ea0e7

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\LOG

MD5 2d0dea9e2c178180fe64ac75b1f73277
SHA1 2f5b9319019e09f275333992ff16cce832a4e1b1
SHA256 bfe4d4151fbc17641bc729c84cdd158eb7f78d9ea673e7ea2702c139cdc68c69
SHA512 91384df70fa8743d5209d49af83cd8726a30279c08de5e9f9f89c02dd6f0756b07b535efec1e5459bb8e403f0cf3a48e177dbebb9c47f9ed21562ee99c66249d

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\LOG.old

MD5 63b7440a7e536b84b71f2fc72473055f
SHA1 9925628dcd19d6962421703a3956a2389799c917
SHA256 1c6d6233d957a7273700453a2fe352dba78f1d288db06580fef1dbf44b121b75
SHA512 65e46fc23aaa3bac05929f3674210640155993c1d2a2220ff3464defeac9eb1cc714cce5a4ddf607a327ad9091fc166d249fd2b607b38c21c999f1027537e17c

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences

MD5 e1e6b3e218b94a33dbc2f408fbf6b692
SHA1 2cf1a9ff79ce2ece995c5770f4bdfaf9d39db98e
SHA256 d3a01b06ec871d5948dabea32fb610f82b6e81314c7a336cc4d80027fedc5f8b
SHA512 7a56cab4390294bb0e0afe9c3a898516bf88c43b7a4d78a6313775a3f7afe09c9942e0ad704ba94a6dfe605ae62694fb75f945dea6e6ac96ceb0f9d4d0d2b3ab

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\segmentation_platform\ukm_db

MD5 3979944f99b92e44fa4b7dbcb6ee91c2
SHA1 df2161c70a820fe43801320f1c25182f891261a4
SHA256 001d755b2b560945440023bf4ebfbda797cf5106419ac7dd270924b322f3ecf3
SHA512 358e6dee698a63c2490c2fb5206516766fd8ace8f3d523509c29ff76aa6a984cb6381468f15bb4b9c084d9a470298b4cc11b0970e671ce0316243069ac4c8590

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Last Version

MD5 ef48733031b712ca7027624fff3ab208
SHA1 da4f3812e6afc4b90d2185f4709dfbb6b47714fa
SHA256 c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99
SHA512 ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\ShaderCache\index

MD5 f4bf9648a984cf60f4a8cb9054eb1635
SHA1 a19f939b5dc791bf823920e372254040caefc9e4
SHA256 993ee6e7e7ab209faa04c0d833f2558c181bfa79dedc4271e96d59d948808347
SHA512 e5ebd415b604687b3a50945e6fd7b651eaa4090bd65eb6ac0c5bd082e53979466e1bd1fec3ef03c0718ead9b11a1a9182c5f982c08ac99694ef93147d0f135a7

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000014

MD5 3669e98b2ae9734d101d572190d0c90d
SHA1 5e36898bebc6b11d8e985173fd8b401dc1820852
SHA256 7061caa61b21e5e5c1419ae0dc8299142ba89c8169a2bd968b6de34a564f888a
SHA512 0c5f0190b0df4939c2555ec7053a24f5dae388a0936140d68ed720a70542b40aaf65c882f43eb1878704bea3bd18934de4b1aac57a92f89bbb4c67a51b983ae3

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000015

MD5 c1164ab65ff7e42adb16975e59216b06
SHA1 ac7204effb50d0b350b1e362778460515f113ecc
SHA256 d7928d8f5536d503eb37c541b5ce813941694b71b0eb550250c7e4cbcb1babbb
SHA512 1f84a9d9d51ac92e8fb66b54d103986e5c8a1ca03f52a7d8cdf21b77eb9f466568b33821530e80366ce95900b20816e14a767b73043a0019de4a2f1a4ffd1509

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Local State

MD5 d4894316e6396cf473c7c4bfa56ad9f4
SHA1 c97d87a0ed5cc5a5b27949677f206475f06ebaec
SHA256 dadfef4682ffe4eb7cd7b6f5eb4024d0600d92d9c916f88d6d9880706bce6aff
SHA512 b8ea6f742fd68731217e0fdbb29c7e67ae51ab579934f462ff4609feb7abe930bdb88564350f3fe7fda86e68b66c1a2546d5defad1234241dea4a4afdac46ee5

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\883a901c-333b-45f0-84fa-111e063ecd60.tmp

MD5 f10c786621bdaed4168725526a094ddd
SHA1 fea9dc3c863b1a2f8aeeeafd0583d3c7ae9c6cf0
SHA256 acce88a67ee82d6474182a6f57d3c278e6345f7d72d2ccf1e7cd8201f40385bc
SHA512 972b2f4b7c6d6601a42cf46e1e7081b62a52c312e97006842225d5b5b294e155e11839bc45612693463297855022ee40e3807e2c5b9d35633adb21335cccc0e2

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences

MD5 7cf4eff59c2c5857b121663474495563
SHA1 061ce073b6b098034c541459adb3c4d2ded5bf10
SHA256 334c893f1057080a7b680d0aef9cbac2cf5aa7d9547517617f7d043dca6af976
SHA512 7c6cf448ec1ad8f6dfb1e8d9861a9ce896fe53f0180db810e699afaf480f4ea2dd8761c158a1017cc1bb7d6bfb059de7ad332c0e7926933ea481ae9623784e3a

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity

MD5 600452d4b5fba16a8082f42b5b9eb729
SHA1 e2da0b0ba3b49609a7c5aecfd000467d0e0f9294
SHA256 ac143327291b5af2471a83192821e1237e88cb93642aa10e86c019e67cc0165b
SHA512 92409d4cb09ed3b59d6bb463d14721f7e6f4aee3541eb6f9cf680e823c8aadda586f45703d925d8bcae6bc949b962a58f0e82265720b94e83c055026d1cc9330

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\index-dir\the-real-index~RFe580bb3.TMP

MD5 0b502d2e5c12784c738c698e95b13bf3
SHA1 dd0fab7abf5134759869332c3e7b55388f9e2d79
SHA256 eb3aa1e79e932ce91312f2a749127e62ab7c8f77d5e1a519e22f5cdc6c33fea1
SHA512 853a513cd5c53bb9b5b15510ecbbe0c6e355e0db0945111817e9c20a70426a652e0bc474ccdba05e49026ec0721ca5f923d277e838650792a586c9931ce0513f

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\index-dir\the-real-index

MD5 43aeec5ff06f00c8bdb2f95ca606b7c7
SHA1 fedff9522c07438509fdd04455cd7d3d703621e0
SHA256 077476057004016a0e5fa684553225d104efe496ff28c81b188b8b159472b026
SHA512 e89dc8302d3883744c3c9b6ea55c75d9fcf1b411d2cfddcfe538bb8cefc915aba8a8de8e2358bb781b30c3021814d6b54e06b8731d6fd37700d38c1f5187de24

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences

MD5 949855b34ebb1aa799dd77ed2469964d
SHA1 ae9d2bfed8167d8e3a7e1a01fd5b4bd577233bef
SHA256 f1aa8d54ced928b7b336f482e4dcd29858bda1a1a291c438157bd16f7e68c364
SHA512 f8a979fddc5e7212e5e6ca477880ccc1c3ba1cbbcbfa113439126d8a18ca8ab95232a3e38921119d8f6c20d2a076aa0cb3c9356d6718fe150a95d480d39fcfe5

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Local State

MD5 fdaa1e2fbb9ffba4456ee1e3b373db09
SHA1 38392a68ce048199cff4adb497bd0c48bce436ba
SHA256 a55fa4f954d779e5c3cd1a429ec98c94df6bc4ffee47ba7f505f762fafb8ffdc
SHA512 cdfdb75e993b607440fb1fa48a953f48898bfa66d4a3bafa048c0e81b4010913c2e59c87bbbe29ac1d56f9d218abb0ec3d734a9d61c85b74b5d8ac9817efde44

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity

MD5 eff840789a0390d00ca40cf72619095b
SHA1 9ec8df0eafaee9ee0a59e768df548604013134e7
SHA256 272ecfb384085114aaff5ab198df857a478437632986664acce3088b487d273f
SHA512 e5838b53081694e3ff460a203fe39ed238417bb040dc807c63d8f3d78574bd1595cef7510f050fa66b74771eba0dc8be1ccfc1383749cc1889919c7926171c51

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Network Persistent State

MD5 4cdb4bb29bbdd19c7b788fcbd47f6a53
SHA1 cec85b41d236cbcd9478ba53965b4fe2cad84b53
SHA256 505bab204518b9c4de1904cb2c985a9fa1f1b2b9810af65cf0fa7ff1d82d1a8d
SHA512 9257e22dc29c3cae239c3dbebca92cf0f193de830455810cd323e913ae9cc056f80c0b082095f7631e955e45c04b995ecaf98df0cfcfb4a2d5df4c33f665e1ca

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity

MD5 abfb7d266866bf6b5e5fc2f58c5a939b
SHA1 91a4e8013025fad7e371decc02befba9e2fc4e55
SHA256 151c1e14eb767ec100b17f191cf0f8931a1013cfa35fc1e03a01f48445e938fd
SHA512 7e53c0debfa979d4920e0dd3bbd3b6cf417b7ea3d88f8538dae5eb7f2ae1c75c1eb9c14d8e59024176cce39c7351c41a6e21dfca8e2595c03d1cc00062748a53

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences

MD5 b10fb7c8ee8b346e0f3b969624cd50da
SHA1 16fc770cae50b31c326dce63b423cec8667aa2c7
SHA256 c5552c4f8a5b866d5c74a61a8f37714b7b42524c4ec86561e643588e2da8933e
SHA512 bc22c6b542032b80ea5581a51edb8cb5d69eae1a3b51148cced9de010c69aadb116f9191b106eb655b9b001ee54821e93f442c975f31a3715386fda50e157c60

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences

MD5 3ef8d9c18b2a239892b22b265ec32976
SHA1 57927865d3a9c1e7d1815908171f35fa494e139c
SHA256 27274883d7b18f9f2f7b495a0adad77297f60af1a6ef825f694ab7a0a660f4bf
SHA512 9ddbb9324cafb50c4d547388162a3e6ff1f7a668f51f3ba7bfe3bf2f9193cdc067b5e8d36870d873a59fa6a7decdf03bc26e61d14d1067a924284cfa28c170ad

C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences

MD5 7c82c937bdc74dde9dcd980c74fc9422
SHA1 675ba9f49528f784a51d951e7901639e9b987878
SHA256 e5a6383d25e9fee7dcf189c907d8c016b9a1e81ad4d7897795145d3727fcdb67
SHA512 e16d2b7c2a0b87c94a1f393cf20a2eb41c1905bd12661b62213161c259c61a783ad11594c4e9483aff20c23dfdba266d66ee04c459d7f0c6e2a862dd54d955e1