Malware Analysis Report

2025-04-03 14:22

Sample ID 241213-31te3atlfk
Target ed505301b8905fbde63c6390a7bfc988_JaffaCakes118
SHA256 6a8d7fc518982fc77d45524d952eca72c4a244d06e5eb8faace426daea5baec4
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6a8d7fc518982fc77d45524d952eca72c4a244d06e5eb8faace426daea5baec4

Threat Level: Known bad

The file ed505301b8905fbde63c6390a7bfc988_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

Socgholish family

System Location Discovery: System Language Discovery

Browser Information Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-13 23:59

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-13 23:59

Reported

2024-12-14 00:01

Platform

win7-20241010-en

Max time kernel

142s

Max time network

146s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ed505301b8905fbde63c6390a7bfc988_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\Total = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatroll.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatroll.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c084b41bbb4ddb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4285F4D1-B9AE-11EF-8F4E-52AA2C275983} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatroll.com\Total = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\damncok.blogspot.com\ = "29" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatroll.com\ = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\Total = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "11277" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "11248" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatroll.com\Total = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000c05d047ed455d6589c467504b9b669bb703ef0e18eb80046de4643a90d91a12e000000000e800000000200002000000026457f96eb6fd6d600ec8d9637ab49ff38cd70a357ab2255ac97439a41f36d2120000000b82bea95a0787922e385bd290713ccdce687f527d61d7d324ebb400b700394b240000000c642483e1f6ca10b1e182b3d76d388fbbd7c69a8adb1d50a8d76b19874d00c97ae689f466220d12eac66c8306a551b2289e667db41fdb7ef7d3483e965894081 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000decfb9cdde0b0a0e291e5dab4f2cf12c366f22d44693b0fbf693a18727217dae000000000e8000000002000020000000b9c5c732fff31d141acc8088bb9dfa02a05c38e4efce153ba523cb3b61afcc969000000008ef44efd4c51f76cf8c52f00f8ca06ecb3fd2d453549231b46649fa3f24702de37b391c40bc063c0024d2624840747928e9ffbc4662656342721bd266c42c579a85ebbc3ad4459d6cacb2cf268d008a88c7b6d5630ab9f1147032dc91c612de05a0196a0d6fc31613d31a378d994555dc325fe4803ca3c92cb822de75b533d15cae1d47322cb8129a7372fd262dd4eb400000002453f8d3c751f35ec29a56464ad2fc3dc656792bedaae11e7c3170c7ff13b9cae944af9f3610e1b2373cca8077c156db5006ff17f5357c5b984cd426d5b982f1 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\damncok.blogspot.com\ = "21" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "197" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "144" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "311" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440296224" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\chatroll.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "226" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "282" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "11248" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ed505301b8905fbde63c6390a7bfc988_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 layanan.oposisi.net udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 dinhquanghuy.110mb.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 adsensecamp.com udp
US 8.8.8.8:53 feeds.feedburner.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 www.swamp.net.au udp
US 8.8.8.8:53 ecx.images-amazon.com udp
US 8.8.8.8:53 blogger.googleusercontent.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 c.gigcount.com udp
US 8.8.8.8:53 www.reverbnation.com udp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 icons.iconarchive.com udp
US 8.8.8.8:53 banner.adsensecamp.com udp
US 8.8.8.8:53 imemovaz.googlecode.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 andreykusanagi.googlecode.com udp
US 8.8.8.8:53 www.alertpay.com udp
US 8.8.8.8:53 mybloggertricks.googlecode.com udp
US 8.8.8.8:53 www.lintas.me udp
US 8.8.8.8:53 s2.sigmirror.com udp
US 8.8.8.8:53 vicahya.googlecode.com udp
US 8.8.8.8:53 js-kit.com udp
FR 172.217.20.202:443 ajax.googleapis.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 142.250.179.78:443 apis.google.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 172.217.20.202:443 ajax.googleapis.com tcp
FR 142.250.179.78:443 apis.google.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
NL 18.239.54.45:80 ecx.images-amazon.com tcp
NL 18.239.54.45:80 ecx.images-amazon.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 172.217.20.164:80 www.google.com tcp
FR 172.217.20.164:80 www.google.com tcp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
NL 185.89.210.153:80 ib.adnxs.com tcp
NL 185.89.210.153:80 ib.adnxs.com tcp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
US 34.226.101.193:80 www.reverbnation.com tcp
US 34.226.101.193:80 www.reverbnation.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
US 104.21.235.214:80 icons.iconarchive.com tcp
US 104.21.235.214:80 icons.iconarchive.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
US 172.67.215.31:80 www.lintas.me tcp
US 172.67.215.31:80 www.lintas.me tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 18.238.243.123:80 js-kit.com tcp
NL 18.238.243.123:80 js-kit.com tcp
US 52.223.39.56:443 www.alertpay.com tcp
US 52.223.39.56:443 www.alertpay.com tcp
NL 185.89.210.153:443 ib.adnxs.com tcp
NL 18.238.243.123:443 js-kit.com tcp
US 8.8.8.8:53 t.ly udp
US 104.20.6.133:443 t.ly tcp
US 104.20.6.133:443 t.ly tcp
US 34.226.101.193:443 www.reverbnation.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
US 104.16.187.152:80 www.swamp.net.au tcp
US 104.16.187.152:80 www.swamp.net.au tcp
NL 18.238.243.123:443 js-kit.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
NL 18.238.243.123:443 js-kit.com tcp
US 104.16.187.152:443 www.swamp.net.au tcp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 c.pki.goog udp
NL 18.239.83.98:80 crt.rootg2.amazontrust.com tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
NL 18.239.83.98:80 crt.rootg2.amazontrust.com tcp
NL 18.238.243.123:443 js-kit.com tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
FR 142.250.179.110:80 www.google-analytics.com tcp
FR 142.250.179.110:80 www.google-analytics.com tcp
US 8.8.8.8:53 r10.o.lencr.org udp
US 8.8.8.8:53 r10.o.lencr.org udp
US 8.8.8.8:53 r10.o.lencr.org udp
US 8.8.8.8:53 r10.o.lencr.org udp
GB 88.221.134.137:80 r10.o.lencr.org tcp
GB 88.221.134.137:80 r10.o.lencr.org tcp
GB 88.221.134.137:80 r10.o.lencr.org tcp
GB 88.221.135.105:80 r10.o.lencr.org tcp
US 8.8.8.8:53 chatroll.com udp
US 169.47.242.252:80 chatroll.com tcp
US 169.47.242.252:80 chatroll.com tcp
US 8.8.8.8:53 s10.histats.com udp
US 104.20.3.69:80 s10.histats.com tcp
US 104.20.3.69:80 s10.histats.com tcp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 s4.histats.com udp
US 8.8.8.8:53 ocsp.r2m03.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m03.amazontrust.com udp
FR 142.250.178.142:80 developers.google.com tcp
FR 142.250.178.142:80 developers.google.com tcp
CA 149.56.240.27:443 s4.histats.com tcp
CA 149.56.240.27:443 s4.histats.com tcp
NL 18.238.246.206:80 ocsp.r2m03.amazontrust.com tcp
NL 18.238.246.206:80 ocsp.r2m03.amazontrust.com tcp
NL 18.238.246.206:80 ocsp.r2m03.amazontrust.com tcp
US 169.47.242.252:443 chatroll.com tcp
US 8.8.8.8:53 lh3.ggpht.com udp
FR 216.58.215.33:80 lh3.ggpht.com tcp
FR 216.58.215.33:80 lh3.ggpht.com tcp
FR 142.250.178.142:443 developers.google.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 88.221.134.89:80 r11.o.lencr.org tcp
GB 88.221.134.89:80 r11.o.lencr.org tcp
GB 88.221.134.89:80 r11.o.lencr.org tcp
US 8.8.8.8:53 dw3mgzt87vzb4.cloudfront.net udp
NL 13.227.211.217:443 dw3mgzt87vzb4.cloudfront.net tcp
NL 13.227.211.217:443 dw3mgzt87vzb4.cloudfront.net tcp
NL 13.227.211.217:443 dw3mgzt87vzb4.cloudfront.net tcp
US 8.8.8.8:53 connect.facebook.net udp
NL 157.240.201.15:443 connect.facebook.net tcp
NL 157.240.201.15:443 connect.facebook.net tcp
US 8.8.8.8:53 d167qii8h0pw75.cloudfront.net udp
NL 18.239.82.214:443 d167qii8h0pw75.cloudfront.net tcp
NL 18.239.82.214:443 d167qii8h0pw75.cloudfront.net tcp
US 8.8.8.8:53 www.scri8e.com udp
US 8.8.8.8:53 d33tru5sm6wy0x.cloudfront.net udp
US 208.87.227.250:80 www.scri8e.com tcp
US 208.87.227.250:80 www.scri8e.com tcp
NL 108.156.61.193:443 d33tru5sm6wy0x.cloudfront.net tcp
NL 108.156.61.193:443 d33tru5sm6wy0x.cloudfront.net tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 169.47.242.252:443 chatroll.com tcp
US 8.8.8.8:53 damncok.blogspot.com udp
FR 216.58.213.65:80 damncok.blogspot.com tcp
FR 216.58.213.65:80 damncok.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
US 13.248.169.48:443 yourjavascript.com tcp
US 13.248.169.48:443 yourjavascript.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 216.58.215.33:443 lh3.ggpht.com tcp
FR 216.58.215.33:443 lh3.ggpht.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
US 8.8.8.8:53 coepoe.googlecode.com udp
US 8.8.8.8:53 fbcdn-sphotos-d-a.akamaihd.net udp
US 8.8.8.8:53 s7.addthis.com udp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
US 8.8.8.8:53 nwidget.networkedblogs.com udp
FR 216.58.213.65:443 damncok.blogspot.com tcp
NL 142.250.102.82:443 coepoe.googlecode.com tcp
NL 142.250.102.82:443 coepoe.googlecode.com tcp
FR 142.250.179.65:443 lh6.googleusercontent.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 13.248.169.48:443 yourjavascript.com tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 www.youtube.com udp
GB 151.101.188.157:443 platform.twitter.com tcp
GB 151.101.188.157:443 platform.twitter.com tcp
FR 172.217.20.206:443 www.youtube.com tcp
FR 172.217.20.206:443 www.youtube.com tcp
FR 172.217.20.206:443 www.youtube.com tcp
GB 151.101.188.157:443 platform.twitter.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
FR 172.217.20.198:443 static.doubleclick.net tcp
FR 172.217.20.198:443 static.doubleclick.net tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
FR 142.250.179.106:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 img.youtube.com udp
FR 142.250.75.238:443 img.youtube.com tcp
FR 142.250.75.238:443 img.youtube.com tcp
FR 142.250.75.238:443 img.youtube.com tcp
FR 142.250.75.238:443 img.youtube.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
FR 216.58.215.34:443 ep1.adtrafficquality.google tcp
FR 216.58.215.34:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
FR 142.250.178.129:443 ep2.adtrafficquality.google tcp
FR 142.250.178.129:443 ep2.adtrafficquality.google tcp
US 8.8.8.8:53 fe0.google.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 fadfc4d856b67fe65a2a1c5fb142775d
SHA1 5864af0c792cf85571ea80c81f4cb1c18d0a7d24
SHA256 edf10dfc7e980cbc81f2212c770b43ae29106dc8efacf19929bd21d3d4179869
SHA512 6a2130f1ac9a021082388e8ca4418222256c3f6952718fa8495d8ee777f5c57e327de92618abbc157d37e74a993bcee6e4d253a75f97f47d391bca5f2ccda39f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 9c3378611a1c2481daf7e5f8b4b2d0b5
SHA1 c2d56ccb21bc12c604ef9de4c6010ac7c6071d26
SHA256 f968da66c8abff78990e58d5409eb5d187bdefefd0f1016c42f5862d037afdb7
SHA512 ad5fab3a7da80b40d6d07aedefc8b82a3a22ef64aa3a95fec334ece2528ae3951209605c6e27b3428cd77ea8b2f7d721c26d90ff4c7c82ac142347e049e3107b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 fea6b3589eab72bff895dcad9bfac596
SHA1 68f7b539b6bd11a6172a4664a2496665ef7bdd64
SHA256 212136150c42ca449f23829587e759e1b51bc964e8e7d4bc23cb775540231bcf
SHA512 e536f36e83b1325b596356ed5ec68f1f61f354b36c6e12f16e88581ce1265c780bb40435358698bd12d614a2f324bc2042f1560e622f80f0ed3b1c33f28e0289

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 adfc25370efcb089db4b8cba0c4e7044
SHA1 d35fe307d94c196f2b10be4ee84778de9afbc954
SHA256 777be116d4d845c50cc0c31ba2e28c5d8601180755d77f536ec86bae5dc74d95
SHA512 725c0013ad8f467a96ec8d116cdf17ea14d19a7782b6d72d48228d4e56ce91d9e8ecaf2f930815f53c8628009fac507eaa838e4e03ebeaea80d1f18563fe7125

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e7a9431df101db27c38b14d7a2cbe248
SHA1 b3d87f7af2184439f095191c599e8286bc2e6742
SHA256 0642ef70bce43cb1f692fcefd5b08fa608c715c09a0d297022351c259ad52609
SHA512 31b1490e19da22db9a405c2f59cbe0039ddb4d92df59788cee6369cea4a5c1eb9018a3372064af36822bb2a19553cff017f66c28f0caddde6a1317dc76f3d5fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 1ac4c229b479d4722547908cc9e7f86e
SHA1 30b57eef3d102c28fcf9ef290fe53e593d1e3352
SHA256 8853271169ae997691f3ffcf5e27050ca3a7101c1937ac69ca7fba1ad8ceac63
SHA512 7916458964098f77e2581381ba66a909a92819f5a15785306eb870754da0bfdbd43c6eb35a66e1fa51da2f1ca9bf7d8196aaee93504b696e055a768b784d8710

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 de9ca7910743f945a8ae91631d2e612b
SHA1 32e41b99683db3e8902e03cb13894b87105deacc
SHA256 479a3f332efc66a96d2756896116b34aa7ed961b28e0ef087126f0c850f180e5
SHA512 757533c0e56d365433a89d51d89e91eb18f0f445c3d421d2420641b40d10b83e4fa6edd1eb78e2b8ffc2c0112738490d8b4b2edc8f28c7ce34a7a0aaa750c786

C:\Users\Admin\AppData\Local\Temp\CabD97F.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarD993.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_86F2A83F54EA52E2D59C5D2EE00149B8

MD5 3dc0950c421136dcab17a074d2989e19
SHA1 4063e2fea4389e5ab3c625fc092995b37710a99f
SHA256 8335ce11416452ef775774c2bdc7e0b2678de85f48f4e3182eecea440f84a87b
SHA512 e54845d1240b96ca11f6842eaaf21a726ff36f3ef8c2707315aa2eca6fd5d5813962b4b2128e7bc53a9b5a46b4dfd351b4cc94d427d87935d1aa3f9118cfd1dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_86F2A83F54EA52E2D59C5D2EE00149B8

MD5 9e8b40381ec852178cb50de55d344ab2
SHA1 595a2844594746cd98bc894158242434731fee4f
SHA256 56249d3daa7058f5deb832266726551c8173097161b7233cee27579088d7412d
SHA512 afcc1af245bea35522258d2e17b4eae05ba3de5685438fa12a051d459947ac9645fd969e18b8d5a9d7d69a0138e2e03d8fcede62f7735aa41c263a402caeaa00

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_1866E19A9EA470E8F26D259D51C89BDC

MD5 309825480198111ff53be041837e2b1e
SHA1 6ab37f6840a7fab0dc4b126e6c1a5d5f2ca0b028
SHA256 65df77ab4de13e3c62a153e9d105878fcb5faef619194a4bea127a55000d8c52
SHA512 22051aff8da4af08c2f746c925a4457119835a538a8a6b5bfeb52dd61143bdbdeb47a671a3ae68a53f28ce4b4a1abd69f7b9eb32a9f6f2c20f50f619e142c40e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\fb[1].htm

MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c20680dedc601b046086c6aeff67927a
SHA1 e48350f1309401b9eba839a76e0c180daafd9c59
SHA256 1b1907b80f6d7735038b425d3183bc46a4bbaab6b54c308bf4d3271f73e7e093
SHA512 e52286d16fd0184d4c995497bea33331e1fda247d714f8d09f5a05303ee6748ef575b3b59e1c27bfae86ac5f6178a077b06a3a845a51882cdf5f29d15b077fec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ba5615241919f2f76a0ca8bd034edc46
SHA1 177b9adf7cc1d963c8e55d97b8be7d45042a6fbf
SHA256 b720c3efe46665a9c414fdd7e77483ca4e6c125e8e8dc6dfd8a0525950717502
SHA512 3f8416ad3d5d769d400b03a0ded40440ed210afe5b2e541bc2cb8b0ea9fa980ab3ff1358193a8e060480d69a3da542d11c6b9b0b9ef432d9c54123b9da53ca43

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 c21b65a97588ed8a87e0f4eb645ca48c
SHA1 7db7ce4c26daf69011cb5fc93583d788c28206e0
SHA256 ecbade3edab045dd66b502188638aead69e76408fb8ea74e431369297751646c
SHA512 2c3393ee9004d507025463a705001c3c12fba34d829836b20d2c2db34e6dc05b3dfa8d1e56b493cad5fed9ecb0f542a864acae8cc0ed864737a4b5341c6fe66b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7

MD5 c6150925cfea5941ddc7ff2a0a506692
SHA1 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
SHA256 28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996
SHA512 b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f7acad7734f4fbad9cf0ee06d0b716ca
SHA1 beaaaa9dfafe8083f30d43a49def3377b51220b9
SHA256 fbcf9818cc5851b0606b85ffec715172214b4ff5e290f78cfc29ff18dd8b6852
SHA512 067b7951b67ce440844799e1307a1b2b042bb0407e2db0b50a777e698835b11b888152b438e77f2d7f3046505188ab2f414d0f51a22f31d2c9dc04a5d5bc2dcc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 00146bd855de2d585d63bc4ff7907350
SHA1 a93fa183088b4f8d7c28aef15a5e96143481e3b7
SHA256 995c94124d4655475598a692948a05a1ffd59a831ced398bd34560032e252904
SHA512 d060f6df9f57a2c212a57613417654685ea599f1f3e976b70a2241ca894b70a0eb362e1d651cf6167c5d4aa8ca5243c47cf3c3b93bcafaf095005910b3dcb121

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7

MD5 625ed711606d34e12c4983760c87b08c
SHA1 fc4121c94585614d6e52391e829619a284bd0e17
SHA256 f4d1489877d82bc3f4c3cb79f4f2b8541b443b3e23aadc2f00d4c38335f512a4
SHA512 e8f6ba99136f8cd04d8f85fb86313d79807d94a64ae8021bfaeafa5f275eeb05682e49373c490d5593cdc6c4fea5f9636aa9a355637b6580b9faec9514eef09d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a808c55f12abccaf1608b3c606bb922d
SHA1 526acbf30bc47ba22d70be57686d85f661c91c80
SHA256 1763fedc6c1cc68bb7a7a7207ef9564c947d2b2ef1c4ad6228582baf490433fe
SHA512 a9f8e1a27d0bf5e8a3f7e96566b4a5428f02fd69b807b26fa8a730290f783c5660a72c9c7ffcd801e00da3e0f86cb9f0b6add1ae83f001804dcd89710b37e0a1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 45993208afb11cfca8465e9b3ccc1ce7
SHA1 bf0037708f97d1b26a2fbbabaaf29008b826a1ec
SHA256 889b96b271c1d6d5604e0013788e9fe5e903e6b385b98830511475b42779b640
SHA512 f2b01cc1f16ff12b7d826b2cc80216a7643fbbcad9df8fa1b2fa12dff0b5b8da2fe64e29a8e038b4f2c6ad333fb71b64a3a840bd13c3e5515339a54f1a35c7ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 045330df66d425b2643763437126278f
SHA1 1bd13b10326b630d4b74e30a01d04e0f8392fdf9
SHA256 fe3e6a7aa3eac2d8f708dadea2b06d614236f005a9cfde8d576c8348b3bd226f
SHA512 dc2986fff3c46845fbbffa54b75376d9b8b9c0ac25eb64ebcbafbc99707c7125f07bf31aca3037618ed642d810a3130761e01ddc33d8fb84469c22ee3e4ee58d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 746fe20417273b9f7e1f217f53e8e414
SHA1 eaa731155874ed9f88140b88b57ab7d4666e1be5
SHA256 da6e0a85eba7496899c0bd8609a1cadc03adf4ff4585171fcb40e45f0e9c4320
SHA512 fdfa11df0b832082593184c0bc6380b31c75a9c64142fc233af3f3fbfb5c3e12fae3f8c53804e8b5b7a3bc1ec1016bba40b9f8ba3883c6a752c6ec29298b8ae2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8ccc3d998b81a329f94f1311c0244e60
SHA1 0dac677144ca16b5169dcbbf06c2b8fe30a2f635
SHA256 91490d2c773bc3e7bb6f5ea8fa5d2a655ae8c21cd03e57402a64c763f203f91c
SHA512 e80522a6241cb362f429369e1adfbf055f27b40d4a6362895dcf8014cebd7daaa4f244ff0dbc4b65a2a0d7de055e50b5d8897ca3b0f7c93786360fc4ed322af3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f8456f7b7f22ed3aa2dab251a43b58b
SHA1 ef2b9dac98dfa7a1324267021730e2dc6c66354c
SHA256 65915679f38d3ec79ae17c786458a2f727f90e5b37126584a281e2281c967602
SHA512 09d5f77e681465d67a9380aba306204feb2ecdf308962652eecc54731cd9b57a9432b8a361388bd074935495cd9a2d7991ba90deff469b1fcd580eeedb1ee2c7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\jquery.min[1].js

MD5 a34f78c3aecd182144818eb4b7303fda
SHA1 6fca78dac2797c02d86a4bf6514eda398b7dbe62
SHA256 c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
SHA512 ddec07100503fdad6655d4e90aaac246719e9667611b35b112e4694e2671b43f4c4ef0b87371d3a6e173f7ade9dfd2058e5e165a41c3a250007d49ec18f2419c

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FNBOXAI7\chatroll[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a124ef9b77a21085ff3008672a077eda
SHA1 6c2ae665c698414ec055c4d30cc635c09e14449f
SHA256 b3f2e2fdfad8abed20eb7e69386e518aceb0eacc273826b1a668c78f1b5de982
SHA512 ceac9dafa8f3a4ba89a4f3c5a529444665696bb87cbf8ef011b551db702cd8c9a75d5f4afb8995567b5be413aadad1826ba812daee69054123ae6b33c47bc2ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71d4bd24b80799f98b93e7a6df832510
SHA1 4f9e87092ec93315f603bed1433506b03ffd9bca
SHA256 83221fcaffd4ca0ee598a1ec165ba86c78e3464b0208ad54bfda2cef4122e564
SHA512 82b3d1761b046736d53a9b26b29b7f7698ae7537e68d62c6b74260236fa06481a5c4a0c8c44238f349bb5950c947bc5c19b10e468663f29f6c5f13639638f963

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 704393ee240ffbfeacd205d4c4ac2b86
SHA1 7da86bec7c982450839a9068579abd3e68e64ed9
SHA256 4a5c0a212ac6f36ad19cc777ae15c0423dcd7cf88217aad581a6ed7ad641b490
SHA512 e80d3561bab6485b7a678eab6b3987d352948ace961d0ab97a0d97522336574ef7d911d9a1fb962a92348d3881ba40e4b801e94e9e5872a1a76c366ae67b73a2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 476418433c2a798450044f55d7d72b04
SHA1 f841d6e606e36a095384f3c32105f999a23124ca
SHA256 3681bbbe0d25ff0ebc4ab980c61cf3b25ecf6791efcb7535c088421218a56749
SHA512 cf9ac7987035f9ad52a8bc6393dd8b7889db11aed72716ccb23de282b76d946c1d4192bd939a7bb5f96ef059324accdbb63c79606c017aa38a2cdac99690a31b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6c3cc6e75042d8d6f1a02e0e7a124b0b
SHA1 ccd3d6d97043ca4fd273a37a45bbae0a4b3d2e61
SHA256 36657bd065523de42b14844f25b28d947e99f5bea804f0f15a798579ec0a0c5f
SHA512 8c038d6982d5d5d8807b613ed1079b3dcf624edc362d3c84077b07ad6e98855e671704dbd84c824cb5b692a065d4d74d8c773a09c3005bf977114c6b7d0c4b95

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4701b4570d6136f541147969aafaf10c
SHA1 d4093091bbf1aacfefae76a69a0eb1dfca17f969
SHA256 035c4c69d0934ad11e97e4655b2a33d45f21e08f0f23bafc5379d4415b4395d6
SHA512 1b28bf6da8174d4d64e19d7fbc5a9cee42f6e1f81a523d76ccc501f16b2445685726258dc36d4df6e8b2ddf8d5562c1c70c1d31849ae4e96cb273f83b379250f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d3e6a17220eec5d2ade0a6e9c8cf6dc
SHA1 d2fd1ae702807c24765f99a01918420b321c72da
SHA256 dabe44acb0eb3c62c33298ec94c1d1f64d7e19c79b93eb7ef1e53aafdbd797cc
SHA512 78c92658837a3df540c95cc1ed5768951ab4f433b888f4f2377f5cc07aa02674420dd607c5bdcd314196cebd7481525acd12229788573f55b489124bd73b5410

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 48c1e20f47590ddd4f306a1ad2962bc0
SHA1 e71d33fb4648e65da93ae311733b0071ab4ecfa2
SHA256 dc3ed09dcd54357ae6cbd40fdb2104d4c1ba587a5c89ecddf564a299876dd4b8
SHA512 a04d3ba0b3933d81bf78dac2f307804932d7c6f51814f26a37eeaf11d64b94ef1b1e02eecfaf72c3f341820448c2199f68734c6e5987483e9cd9998f0afaf0a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a6fa7185eb192055c2d93652409a370e
SHA1 30d345e3a80fac53251f3e45a6e8aad4dc913a06
SHA256 8db9ddb97e5f235cfcf3d7e6baf726c0effd443975ab4492780b4aa6b2678dc0
SHA512 c6f585cf60fc93373a2775b661586e0a4e41284d93a60b418b58420fc57ca86d41d2c11f278a205103618dfc20bcaab3691e9b11da309bb26be1f5f9cfff316d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b62c77edbe4e035cb550add65487c759
SHA1 415c1fd39efd14f2d973834b7723295ccfbce302
SHA256 857be45d1f05ddd1507a3d6783f4b6cfae7964cbd65ccd5e68de7aebdebd74c7
SHA512 217318b4c5e1a09c4ad4ebe120faf7a8c96c2d6dd6df46e6b02dead7b7d29799b050b06025e523c18a2d07f8c183f55521296400b312446ba2695985be1f08cf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c2236afbdfcab9de7458d3a6b24b83b3
SHA1 bd87f5963de56da6be1990fe44c5bf6fea13117f
SHA256 66076589ffc3e1afdf595cb367e73afb8301afcb6d0ede4d22592799addb6373
SHA512 ef45483cf9317c30d45fe62b7cd38a36c0b99cd81eff1ed3c3e5b13ccb8516504bdd817af3069cd411b4c891fd16993d1c4229a2e736fab98d7045ac1f873620

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 852ee9f3acbe60d6cd04d5a9e4f3fa97
SHA1 d50a7ad90a693c8042466bf779728d8142500914
SHA256 c77c188c1af53741fd93440e365fca6298b3b762df008b02456dc1bc935fed55
SHA512 730e65d297820bc59f04300ea01cc38a20c455009f03c880e32a1b96bebfbe63d7134e8c7fa3a768b396ca74d72567e4c48723b5c6be51403b55bbe0543614cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 049ad0a3da4bb4bee7c0278e7d2dbe37
SHA1 1056589e5ed0e5b73eb38d9296a050ceceea5a61
SHA256 b2d6fac6f2ed862d0cd371867e44be84124efe30d8c9529a4b72bc024dea6bf2
SHA512 fe8700bbc118c3a1930817470a0ce0a484f7652eab21e199a9299ffbcdb1f6a6ff831a1cce47e443defba6c9aec3576d3ff93c44a15167d488e2862bac76889d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 be13782679bcac95f2bf5b14484f9ec5
SHA1 1c2fdddf4e845098d026cbab0f59118cdc4349da
SHA256 6eafc48eefd6c084ff9bb557d09f81fd9b2c6a759dc9ed5f10527472cb5ff3a1
SHA512 e0a2d8f74a4f3b5e0167ed9eb432ffef4d72311eace5de161766b81d1217e35a1f32519a362b000dcd6dd15649b6157da355686145ac3c0d7d3f0cd8dbb0f78b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bee1cfe46e8bd0076e5ffd454c924108
SHA1 77def8a6755535f11f5b471c2299eb435d6a9699
SHA256 5d033ff19b70f6a12c7dda26a86473f7f36364bc1e86c34685c464d44202fd89
SHA512 5177ab466246de2c9d64927e9b3051601072b5cf558fd5896a162bd9c2a331144496026e6bb059ca7e0899498dbc39104a1c1dcd9aa9f07ac484281d63b5cd97

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 41db66fafa431d09625eb2cb1bf9fc0d
SHA1 0cf41096294f29050785248f46fe3811ad6f1b74
SHA256 170a82a26583b577f6b32a2aa291822e676293f0b8979f648306345911f957e9
SHA512 fdb9ea6366f142d9d515e52f7b0e4bd386bec6a9a5e53bd1e7a9ae83044b9cfcbddae74f4e9e97e29fa08f9d5ccf02d357b78d34f28cc336b778815713dc755f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 83cbc569eb403166fdf6a72f9593eb8f
SHA1 625b891b272e764319c619b9ce5b884f5562ee36
SHA256 98ee76282c6824578a8b364109431c1795aec72b7d4c27aa8c81e4771d48b377
SHA512 80a9a5a472a7b477c85e7b401602425719552f2ae3a00f94de1558f6fb1050ff8c4de4a3ce770b9dd9d2b633b34c779858fdcb483219add89fa10d58486a3acc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 09b6f45889217d68ed278e67468acbd4
SHA1 ed692b3dc8fbf4034dd8a517d97d53f38af2b355
SHA256 7e6902e2eebec1ce2df4cdd62f9869ed90a8778f0fc55194400d999129322e0c
SHA512 192d5d6ceb48d1bd649e8879318ac52115f3516c2159b50b961a937b84f7add2d60f14f0a37ff0553d2167f4a5e1064e5bce9c08b0b4416cbd392880eac7f18b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b7c3043e26808fbfb7bf89c2ee7040a
SHA1 1740cb60c776a869e28f1858966f361ef2cb1869
SHA256 d9c9048ce432ab5963efebd218c12e51a577d185c4981f7af6d71824adaf39fd
SHA512 e5459216c8d1711d060acc1a3a245c736b77a6551762a36ca893b92fd82965e7313d0b0239f47c0024957a34ccfb966686406a8ddb3b55c4d23ad8ae9c69640c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 449501bb5225ef10b09efbb62a5a5e8f
SHA1 18ea5428b73166abae78d61b32d8a049e7bc2da3
SHA256 ce98a3a3354cad5ebd54d3862b03c43c4a062a5bb76d9048e382507c49bd4b9e
SHA512 148ac787c44a3fa4b96ee9c5f1dba5e80845f3a07bd02c9ba4ad75c1cf2e549b28b978cdef4d2e3c28b53663367d74b18d9c765cf9f7eed52972d2c8ff91fa4c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\all[1].js

MD5 7f5455c8e46b8b78573e5978ad17afa1
SHA1 7de71d06b0c8a6600afe4b9286dc8869815b097c
SHA256 cf04fb0129477e54dd696681a35116ddcd4f52e79d9f3db36413ff497d0a8718
SHA512 4eef7544ca24ace7de267bda4ea772853e0f9de2d06b7b5dbab2a94d0357e37787a1ac264c6ef5fb514b81de8c3d280fadc53fa1c64eab26859a9b62c6fa8a2a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 23071b6d7b4fedfaf9820b98d55e49cd
SHA1 7ad02973c0ca1a099cae733673525deeaa806bde
SHA256 0ab4945f762dc10aa50ea324491468925534bf6275b6cd5c2773364f3f2ed852
SHA512 6b64882d218cd28cc18436df41611d4ed81e0ed872f51e7fffc37c919f745dfa68a739cabdccc67d281b34262bef3c2aba9a009bcece621e71ef36c8673596e1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 30994c59d4898cd570636b62ece2f8ca
SHA1 741f61a75e76dc6887044009a4b9faf246287972
SHA256 26944a97df5bd17cd4811112c62cc146dbbed7b8d67c78493a9b0c76569eb28a
SHA512 b176fffb5ed7f3e39e054762d72e1f6b9302c69f0a4f963efbc78f2d3c1af942bf0d006706670a74c91d0ee0c23a4773f341bd65472d29be50abc7d8befa1eb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9f2d5e44722b9b1ab853821a3e1d78dc
SHA1 cf4bc77e634cec30f193f11ac845887fb044535a
SHA256 23c49ade2f43132f6906f019e2f6ee2cb05a9873e85588417406d5b0c87efcdb
SHA512 2f9373281aef85ff49e261779cfc5367d33ce5b23a51888c5813882d07e9a977058b76fcf8757a3987e6a14cb8198ae1b45c6e1ddeeb356cbb3afdfeaf78fdff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1894600742a6293488b1c867a4db4a19
SHA1 3df756ac2f245f401ef855444073dca954bfcc12
SHA256 6a63f495cf78306c58ec4db9aadebf945c058fc88d883ed7c17113ac7b71ef5e
SHA512 6a4e4200e282f9bd17facffcba5bb61704ce3e221c19d9c5f555e745f62c0d4550c3f7d216439947d95a78e7393c1cfd8f6fd5e5f67b1296200e8466f2a3dd2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c4e5f6f909f5e4179e7a342f7bca9ff4
SHA1 ca0b1d902ab71ee88ee5508baee85746381efb71
SHA256 ec639dad8ef3fe48346237db620d90311a9b5284bf4570c86e61e9ba7d917bf5
SHA512 5cd6fdf84c146f98fc8cbbc45c26cc758681fa60485a26ff36c677393d307ce33731bfad386bc96df577133966b351bc02fbac5a7bf4f0d8bbd2eb1080031311

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d999daed0032dfbce1f4135d2359359
SHA1 79b45642e70ed168ad56df66f71192acbb090575
SHA256 2107af3b88ffbfbbc94ecb6279c18ebfb7e4d91fc6362d16c47109b80781de90
SHA512 fe287c268e34bb2aeb911e73f4c28ba0459f1445c4b76033392f57b738f09a275d4023f918d8ef8bf383ac142be62177de2a883c3e175d2445de5803433b9ac4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5acf9bb24b1816aa211da8b081722f06
SHA1 fd827c91c163b1b94e07edcb11164e84ebdcc769
SHA256 e9da96e34e9a593c90afdd3e2eb8ce2f4d29da85226ee9fa09743ec08ae1036e
SHA512 fc47c4898bb0bc9f887d2543c0a2675ed764cfce19ad1540d746ada9a505aa8d994ffaf3ee067c0607745a54e39226a83eb2609ac1ffdf7bf4582c04298228e1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 edaeb7309a63fba3ec83bb4c7f3fdc82
SHA1 5d2912fa73b78ff3d6cf28256100d572f351e9e7
SHA256 1df3152ae6a2e12630a0f54b61ea470254bdafebdd2eca982d70599cff055809
SHA512 14d4da245d229ad4674cd8c5ac6c79701ccd0dbb209ec17c8622a05d649a0adf6346ca6d2dc34c78d3a9ee0a3e8934ba5e1bc3ad4496b37e77e5071ffc270cba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e183134718cb079e2525b40b732bce7
SHA1 58d1b50b8165ba31f9d1b436b383d1a131ec6e5d
SHA256 c028caf9659992aa26287e9fe7c460a3a5827cc95a6db09564cb3960cfac3845
SHA512 379816c11d4637d4f5b1f56c0c8358894a4b78cf986f9d9b95836a52b6d13b767233b1562c5139af35fa199e1841ff5c2086208e2d539fc56a1cf7f6f62f92d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a41d6f0aa5e6277e38c1d1cb2e0096a9
SHA1 39b81b99a6adc2a9e36295d2ff104fef536d1c53
SHA256 34afcf4a755059b87041b183e29cfbb2667ecd355ca7326ad8576703a1fe1b0e
SHA512 9afd8ae7a8d6949ade2919429f98c3ee4bde9edb1b59eedc1a83cefbb1316d8f6176c6f37bc11018b37db61564dce9fd6c73d8a982d308ec4e2b245c91d453d8

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKCGV13G\www.youtube[1].xml

MD5 4b37c9632f8ca479d1652b8b34621149
SHA1 89c2ea9136f46724c381e6a55283e9d4fe37f00e
SHA256 909f0b52cc078675fe2c3c8cb607dadd67c523374cf48da1851b199a66f9853b
SHA512 68114b6bb631fb04fc08b2fae062501b83bdaac5206fa08f0f16a219dace57fbd1caa322a263681a7c0f2fa262f020ecb88e03deaffe0bbaec96c17956bcc322

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKCGV13G\www.youtube[1].xml

MD5 bcfe585972b850c47aa907edfaa3d842
SHA1 0f197c9f127916b5172602a54f8d79002d8746e1
SHA256 3e1ea926177e6e3b7e5c7db3066677711cbb382c85f1a15891afe0f80075d709
SHA512 f37aca329f1b9ec11b43116f6a5a549174f22b3f65f1cb16086b39ef0173702645754e3d402cf73a5c79732dc8f9513e42c34dcc1e56e5b90b45217584b6c7df

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKCGV13G\www.youtube[1].xml

MD5 df150b1acd3b742823325f06154358b0
SHA1 f5a6817a205662418d3a6bb54884857a81cf94ec
SHA256 885e0068b07a96aa73568fca055af1eea44c1eabdfd6d46ee589fec52fe809fb
SHA512 d29c01ad296bfc8a35887ee72fb5cca9ce2dea0852d7176933bb5d19d4719ee25f88ad082f83d36a5daba37dd0abb439072d2aea6a7ab1668c6fa0194f5f48d0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\favicon[1].ico

MD5 871c1f2e03f0d59f06d5d5262ca7a337
SHA1 546bff947a8917533e8a0ec56c689bb364e0cd11
SHA256 2fa2f956b179e8c6009c18d6e25c7bdb2b9e946ab9a8df2f3ffe35dc7244d4d1
SHA512 f86d18613ee477dffc952a4a73ef85ae3a7e87c64b03a6a88723a7c1d938cbdb8c543775d1d3196d4cd0986dca02525b989b924a0f6898586f2e1aebda799422

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z8d0nzh\imagestore.dat

MD5 711a5b9890e9644898761d82996a9fcd
SHA1 3d950478408e29dd3ec1e5d8a9ffab4ad17e2a26
SHA256 326293085d76076312ffd69ffc8d01e7689154b2b9b6bebd2379c7b16301dd5d
SHA512 fd033bf9801e5c5240ed095068af00e5cd51cf61e509347680a8312956ae94e4f78e27e30a23d0577589bcea1b59ec52cc9f1e94eaf6d5861eee20da32c3e3f7

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKCGV13G\www.youtube[1].xml

MD5 10cda75660ef3ab16591c0f38afc1aa5
SHA1 fb152e0af3050a2bdb297e8670cdb22709893a9d
SHA256 fa47750af5521e2a93c97238d1c13451fd5c89a9fb3fecde8777c6c8329f9ca9
SHA512 0c32da9cb9e9f2a644af255cea095d2b0215889d609de737894646850bd9557d2805c1163bf7d45158571c3bfd4afb32daecae86634901b6f6c3759596be5f0d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKCGV13G\www.youtube[1].xml

MD5 ea5d4f5b8f924d140f00865569810b8a
SHA1 2c1085cb7e116d170fb31a923672e9e9c3f01cba
SHA256 a46e47ef9a53af2a89b6104bf9bdeda4a66f05fb76963bfc7d9b11dcacf2302a
SHA512 c186dbbc666d1a9752c5366ba28fae675ab6bbdf802b8372a371dae72b0069568e3146417f21f6bf4d3bbeb1b9be4d7f752d041cb233d2ae93d22a75602fb17a

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKCGV13G\www.youtube[1].xml

MD5 d3cc0a9c962eb5ecf0a97c43e2f939b7
SHA1 4a87e0982227236946e32a59ceac059fb1a8d41a
SHA256 d469e37ab92767c3126265855cf16f7dfffe67c798fa4be46c11dc2ebbdc272a
SHA512 0448b0772fc539aed910b3ef54c34da88d948c25f31cbeb80c4ef32697a72bea8250e7e89921c4fd14948983866ad33e87943b5bcfefd2f356382bcab080a594

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKCGV13G\www.youtube[1].xml

MD5 e66c6e8e71341cf10fe10b05dcee4f3b
SHA1 2afecb0a4f3faa021287eb7c8e27029b6eac8f94
SHA256 757183d95e0cf54985f7b94812079e4c081eb4d24120066cfa3ec32083bf20da
SHA512 d88b2723e153498197e47ff77cca382ae74746bf847783ebb597bd6d0a8e2e4457e9e795526a2b2a9f5d5fbc4e181d027c83eca48003623207405c3d5754023d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FKCGV13G\www.youtube[1].xml

MD5 3c85416fb82282d4e2f57c0877c84e96
SHA1 24157cb9893b888a2f2f4f8e993eb78b062e6bec
SHA256 7216c5f0fa18f329fc8d3d46b6104f01ef6ec4d3b6eec786cb8335a8163c3049
SHA512 a6058861a657ce09cf39b26c1cda92a9efe3b8141ef80b683fc97137442c4a877f65f0a7fa1e69e0a2f9dbdef35a7d0b422818caa9f58014bb3080512e6fb7bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aee50e71f138bdc4b96395c2ce46b0d4
SHA1 39cfe993316dad8233e929396b35951f57f5a083
SHA256 c149efd46983ef897b759afe873b5c6756c982056fc1107f939d698e9821553c
SHA512 8f7ed4ea652f71f4b983d128609da4c1d6cd5ddd3a51b6f8aeaeabd184b141d2c8060637f80d35536baaa67a8b2def1ac9132a50340e3982202bcfad694102c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 11763082a98819d55a6f38ea2963f46d
SHA1 b8f8664aad7419f0d5c25d2ba3e5eee6945d8e70
SHA256 6df90c5cdbb4de64cf9cf0335ec38ecdba987ca87a42d3b255ed813f41bb9e0e
SHA512 e424131b195f5b4b1d46f098105d9fe8d359e42b60d1fa1c96de76b285390fa4c77436347563a5c94dd139716d20270e9e14c0c9f3f9c0020bcd814621c8c1c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 68e853ee9cd47eef2fc4c3d6768ba0c6
SHA1 15c99193300d722cfc0e7fef9ebe8e3456033a54
SHA256 69caf087ef529408a2f3eb4987b238d552aff0f6a7e0403a2182743804dc2f92
SHA512 f0862842f3fb1cc62c86bae8707020a0c543d1935bfe2505f7f2c5b64f08e62b1bedd048fa886e71f8def46147c7d52d09b2f8d9f63d6686d2cf7c1353f9fb96

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e231217013c465db6e055d1611f11f25
SHA1 e7c00dc3b7cf14b38be4d7910901d93cac98cb0f
SHA256 44aa9372a6548fd32c2d0d4d2cf7efebfb4ba23e141139bb368dc9160ff1347d
SHA512 ffb16bf08f37313a19d67f8d7e0a86591e1c5091feba35cd237ef3ac50d82556f23e266e01fecc1bf9810f7ae0055cecebf8e35e1eaacbeb89a90daa6c8a1b46

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2dda903f000d3849250c3869b85fc8f1
SHA1 9fea011cc9192acc9481706877ee0f482e2d3bf9
SHA256 110972230b1d27149fa2d0d594915fa3d010387d105858b486b83f7b121b5ee6
SHA512 ae3de57de307777b26ce58885daa058947fdc7bb4611fc6a2ddbd26da78824f4a93b4def9973a9f52874e3274093d28dc9f89c5c7e23d606cd3b7aaaec838f02

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77dc90e0e61bcdd70dbc958d96bed4f9
SHA1 67e7f165181c94c183803b9c838c076b4e5d201f
SHA256 ae8253c1cb43d14899696668a39dfcceabb2a308f31434349e39160429b7d686
SHA512 9287435d1d04993cc973c327eafac89d06dbe7040b783df59d498b68e54f731cb11c98d63336026f6e1c7fb302a319b4fd7a1b27fe5843f2fcd22b6304b74672

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 529549a50c01486ef58809e7460fcf7f
SHA1 70c6954184fa687da48c153312b073315e3f95eb
SHA256 a954c9cd96346fd2782229e0f1ed82a48b89af816986539fe542141820ab4a94
SHA512 144bd502735b4d48cfb51b591a5dbb9daff9ce09d6145166c6971e8fec4b3bcabbe47c0b179b431076ebaa60d8d23a0cf136c2ecf77b5d33ea5f32a48fa73e15

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca4398ee6c977915c66fa5d484562d03
SHA1 e303e612d9c90e187482c350636c2c43123b75e3
SHA256 e4fe828f79b05ab899465d562d47075f1c60d98665e217363afe641e3994ef4c
SHA512 a777b6a9beb8ee08b28032ef34ff4fa9ad6ecbc5d42b853f40346ede4c1c5ce3ab78af18b4de28b48977f6d13b382948699e67370f364a26c627ca8a4a9543da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 baa9770d61a672189431f26ad478f26a
SHA1 8ee671d07ec8048078307cff3c10a171c8100c23
SHA256 3cdcfabe7c7483c99efde3d0a3856622bd84606f2495cd36021f54b0c455f0a9
SHA512 04b67ca3577a7f8f8816e3fb0f751091257d424c54efabdc714e6edaea2759c6897e5f9706271f0bbacc7eaa0811e0cea16aec987122c257484189b1c37bb50b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 21f4babfdc0368ce98e4a1d2f284486a
SHA1 7467a3500fc1a5a06af6703c8183be95378130b5
SHA256 2b317b71edad0f9a452005b07207052f76fa484dee9f452c0e3bd4280e9ac2e5
SHA512 d1185084a1866afeec64e6c6caff52164ac8a6687c5cf9cd8a19d4e2fe89d71dcdea81ae40aefdfe5c7d26e547e1a46fd8953de42d593b3be9ae09ee9e69231b

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-13 23:59

Reported

2024-12-14 00:01

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ed505301b8905fbde63c6390a7bfc988_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4760 wrote to memory of 4500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 4500 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3232 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 3920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4760 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ed505301b8905fbde63c6390a7bfc988_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa380546f8,0x7ffa38054708,0x7ffa38054718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4852 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x514 0x4b4

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6680 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,4362053436137813390,2679044909400265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 layanan.oposisi.net udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 dinhquanghuy.110mb.com udp
US 8.8.8.8:53 apis.google.com udp
FR 142.250.179.98:445 pagead2.googlesyndication.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 142.250.179.78:443 apis.google.com tcp
FR 172.217.18.202:443 ajax.googleapis.com tcp
FR 172.217.18.202:443 ajax.googleapis.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
FR 216.58.214.169:443 www.blogger.com udp
FR 142.250.179.78:443 apis.google.com udp
US 8.8.8.8:53 adsensecamp.com udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 imemovaz.googlecode.com udp
US 8.8.8.8:53 andreykusanagi.googlecode.com udp
US 8.8.8.8:53 mybloggertricks.googlecode.com udp
US 8.8.8.8:53 feedjit.com udp
US 8.8.8.8:53 www.lintas.me udp
US 8.8.8.8:53 2.bp.blogspot.com udp
ID 103.30.145.12:80 adsensecamp.com tcp
ID 103.30.145.12:80 adsensecamp.com tcp
FR 172.217.20.164:80 www.google.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
NL 142.250.102.82:80 mybloggertricks.googlecode.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
NL 142.250.102.82:80 mybloggertricks.googlecode.com tcp
ID 103.30.145.12:80 adsensecamp.com tcp
US 8.8.8.8:53 s2.sigmirror.com udp
US 104.21.59.55:80 www.lintas.me tcp
NL 142.250.102.82:80 mybloggertricks.googlecode.com tcp
US 8.8.8.8:53 vicahya.googlecode.com udp
US 8.8.8.8:53 js-kit.com udp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
US 8.8.8.8:53 t.ly udp
NL 18.238.243.104:80 js-kit.com tcp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 169.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 78.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 202.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 164.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 33.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 82.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 55.59.21.104.in-addr.arpa udp
US 104.20.7.133:443 t.ly tcp
NL 18.238.243.104:443 js-kit.com tcp
US 8.8.8.8:53 feeds.feedburner.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
ID 103.30.145.12:80 adsensecamp.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
ID 103.30.145.12:443 adsensecamp.com tcp
ID 103.30.145.12:443 adsensecamp.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
ID 103.30.145.12:443 adsensecamp.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.214.169:443 resources.blogblog.com udp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.213.66:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 www.swamp.net.au udp
US 8.8.8.8:53 ecx.images-amazon.com udp
NL 18.239.54.45:80 ecx.images-amazon.com tcp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
US 8.8.8.8:53 blogger.googleusercontent.com udp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
US 8.8.8.8:53 104.243.238.18.in-addr.arpa udp
US 8.8.8.8:53 133.7.20.104.in-addr.arpa udp
US 8.8.8.8:53 195.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 12.145.30.103.in-addr.arpa udp
US 8.8.8.8:53 78.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 15.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 45.54.239.18.in-addr.arpa udp
FR 142.250.179.65:443 blogger.googleusercontent.com tcp
US 104.16.186.152:80 www.swamp.net.au tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
US 8.8.8.8:53 lh5.googleusercontent.com udp
FR 142.250.179.65:443 lh5.googleusercontent.com udp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
FR 142.250.179.65:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 c.gigcount.com udp
US 8.8.8.8:53 www.reverbnation.com udp
US 8.8.8.8:53 ib.adnxs.com udp
NL 185.89.210.46:80 ib.adnxs.com tcp
US 34.226.101.193:80 www.reverbnation.com tcp
US 8.8.8.8:53 icons.iconarchive.com udp
NL 185.89.210.46:443 ib.adnxs.com tcp
US 104.21.235.214:80 icons.iconarchive.com tcp
US 104.16.186.152:443 www.swamp.net.au tcp
US 8.8.8.8:53 banner.adsensecamp.com udp
US 34.226.101.193:443 www.reverbnation.com tcp
US 8.8.8.8:53 www.alertpay.com udp
FR 142.250.179.110:80 www.google-analytics.com tcp
US 52.223.39.56:443 www.alertpay.com tcp
US 8.8.8.8:53 65.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 152.186.16.104.in-addr.arpa udp
US 8.8.8.8:53 46.210.89.185.in-addr.arpa udp
US 8.8.8.8:53 193.101.226.34.in-addr.arpa udp
US 8.8.8.8:53 214.235.21.104.in-addr.arpa udp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
NL 18.239.83.27:80 crt.rootg2.amazontrust.com tcp
ID 103.30.145.12:80 banner.adsensecamp.com tcp
ID 103.30.145.12:443 banner.adsensecamp.com tcp
US 8.8.8.8:53 56.39.223.52.in-addr.arpa udp
US 8.8.8.8:53 110.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 27.83.239.18.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.75.226:445 googleads.g.doubleclick.net tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 chatroll.com udp
US 169.47.242.252:80 chatroll.com tcp
US 8.8.8.8:53 s10.histats.com udp
US 104.20.3.69:80 s10.histats.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 s4.histats.com udp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 252.242.47.169.in-addr.arpa udp
US 8.8.8.8:53 69.3.20.104.in-addr.arpa udp
CA 149.56.240.132:443 s4.histats.com tcp
CA 149.56.240.132:443 s4.histats.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
US 8.8.8.8:53 lh3.ggpht.com udp
FR 216.58.215.33:80 lh3.ggpht.com tcp
US 169.47.242.252:443 chatroll.com tcp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.scri8e.com udp
FR 142.250.179.98:139 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 csp.withgoogle.com udp
FR 142.250.179.65:443 lh3.googleusercontent.com udp
FR 142.250.179.78:443 apis.google.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 208.87.227.250:80 www.scri8e.com tcp
FR 216.58.215.49:443 csp.withgoogle.com tcp
FR 142.250.179.99:443 ssl.gstatic.com tcp
US 8.8.8.8:53 dw3mgzt87vzb4.cloudfront.net udp
NL 13.227.211.118:443 dw3mgzt87vzb4.cloudfront.net tcp
NL 13.227.211.118:443 dw3mgzt87vzb4.cloudfront.net tcp
NL 13.227.211.118:443 dw3mgzt87vzb4.cloudfront.net tcp
US 169.47.242.252:443 chatroll.com tcp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 132.240.56.149.in-addr.arpa udp
US 8.8.8.8:53 49.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 99.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 250.227.87.208.in-addr.arpa udp
US 8.8.8.8:53 118.211.227.13.in-addr.arpa udp
US 8.8.8.8:53 170.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 163.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 connect.facebook.net udp
NL 157.240.201.15:443 connect.facebook.net tcp
US 8.8.8.8:53 d167qii8h0pw75.cloudfront.net udp
US 8.8.8.8:53 www.facebook.com udp
NL 18.239.82.50:443 d167qii8h0pw75.cloudfront.net tcp
NL 18.239.82.50:443 d167qii8h0pw75.cloudfront.net tcp
NL 157.240.201.35:443 www.facebook.com tcp
US 8.8.8.8:53 d33tru5sm6wy0x.cloudfront.net udp
NL 108.156.61.198:443 d33tru5sm6wy0x.cloudfront.net tcp
NL 108.156.61.198:443 d33tru5sm6wy0x.cloudfront.net tcp
US 8.8.8.8:53 15.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 50.82.239.18.in-addr.arpa udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 198.61.156.108.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 platform.twitter.com udp
GB 151.101.188.157:445 platform.twitter.com tcp
US 8.8.8.8:53 platform.twitter.com udp
GB 146.75.72.157:139 platform.twitter.com tcp
US 8.8.8.8:53 play.google.com udp
FR 216.58.214.174:443 play.google.com tcp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
NL 157.240.201.35:445 www.facebook.com tcp
FR 142.250.178.130:445 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 s2.sigmirror.com udp
NL 142.250.102.82:80 vicahya.googlecode.com tcp
FR 216.58.213.66:139 pagead2.googlesyndication.com tcp
US 169.47.242.252:443 chatroll.com tcp
US 8.8.8.8:53 e.dtscout.com udp
US 141.101.120.10:445 e.dtscout.com tcp
US 141.101.120.11:445 e.dtscout.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 e.dtscout.com udp
FR 216.58.214.169:443 resources.blogblog.com udp
FR 142.250.179.65:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 grasakfuckaudio.blogspot.com udp
FR 216.58.213.65:80 grasakfuckaudio.blogspot.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
FR 216.58.214.78:80 feeds.feedburner.com tcp
US 8.8.8.8:53 65.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 damncok.blogspot.com udp
FR 216.58.213.65:80 damncok.blogspot.com tcp
FR 216.58.213.65:80 damncok.blogspot.com tcp
FR 216.58.213.65:443 damncok.blogspot.com tcp
FR 216.58.214.169:443 resources.blogblog.com udp
FR 172.217.18.202:443 ajax.googleapis.com udp
FR 142.250.179.65:443 lh6.googleusercontent.com udp
FR 216.58.213.65:443 damncok.blogspot.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 coepoe.googlecode.com udp
US 8.8.8.8:53 nwidget.networkedblogs.com udp
US 13.248.169.48:443 yourjavascript.com tcp
US 8.8.8.8:53 s7.addthis.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 fbcdn-sphotos-d-a.akamaihd.net udp
US 8.8.8.8:53 connect.facebook.net udp
FR 142.250.179.78:443 apis.google.com udp
NL 142.250.102.82:443 coepoe.googlecode.com tcp
FR 216.58.215.33:443 2.bp.blogspot.com tcp
FR 216.58.215.33:443 2.bp.blogspot.com tcp
NL 157.240.201.15:443 connect.facebook.net tcp
FR 142.250.179.98:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 www.youtube.com udp
GB 146.75.72.157:443 platform.twitter.com tcp
US 8.8.8.8:53 66.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 98.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 157.72.75.146.in-addr.arpa udp
NL 142.250.102.82:443 coepoe.googlecode.com udp
US 8.8.8.8:53 img.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
FR 142.250.74.246:443 i.ytimg.com tcp
US 8.8.8.8:53 syndication.twitter.com udp
US 8.8.8.8:53 246.74.250.142.in-addr.arpa udp
US 104.244.42.136:443 syndication.twitter.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
FR 142.250.179.65:443 lh3.googleusercontent.com udp
FR 142.250.179.78:443 img.youtube.com udp
FR 142.250.179.99:443 ssl.gstatic.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
FR 142.250.179.98:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
FR 172.217.20.198:443 static.doubleclick.net tcp
US 8.8.8.8:53 136.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 198.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
FR 216.58.215.34:443 ep1.adtrafficquality.google tcp
FR 216.58.214.174:443 img.youtube.com udp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
FR 142.250.178.129:443 ep2.adtrafficquality.google tcp
FR 142.250.178.129:443 ep2.adtrafficquality.google udp
US 8.8.8.8:53 34.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 129.178.250.142.in-addr.arpa udp
FR 216.58.215.34:443 ep1.adtrafficquality.google udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

\??\pipe\LOCAL\crashpad_4760_DUOMFUEYCHFHNTFN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 631dba93b87e18394df80c2bce768034
SHA1 ea7f88d3b1dac706c033c1c46d5147892739743b
SHA256 129ca4727594403ca376ea78cfdb222fbf1520a4e7ae206a496a3fae222dd2e6
SHA512 248a8cb67f345302a346decd37105c4964add718d086195ba938f98c5c22041a228e97bc4e3532ff15ffd640aa0512dca5605b7ad9067ede76ddc7fb82b4b3a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8c0a6361961fe94578e6cd7662358b1e
SHA1 4d01dca8179c5cad1af6ab806bf653928f64cfee
SHA256 c0f4efad15bdcfde45e9740c3f7776976258dd68f833d70130975411209bd214
SHA512 e90704ea18b1577bb08eb5f24c84d67e897d9a37f2a54601ba901afa350614e32b8693b7e9c59189e00491e13e66dc066be9a1d03d70e742d2a5f156fc5246e5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 daf4456bbd3a332cb0b55cfd9101047b
SHA1 4e9094bacf82497d40c3310110d123589390707a
SHA256 8f3c3cc370ea1ca71329eee7b24aaf1f6391f6055d35fae01c437777d27a9571
SHA512 2ceba26ececbb4c98e76b26e5e656020d5903bbaf0e76aa4c7474be47ef6648c43ad156816e1a6de57c2d7ceb546b8e81599f7c8c9f57c26ee55842d15ecaf88

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a2db36881fc9ad8d682d9a64c359defe
SHA1 e7739e5b4a6e2709a82259416bb1cfea11901ee2
SHA256 f056825f7713404fc1313de9d051fd71163fa96334ef3c928103081f681602db
SHA512 feb38e2a2e3e188d9480e4aa397e4629152a466fcba1258a91855bc8711123e1e62d06b2b9383af387f85abc8df24423991f4252edf47d723875772428b244ad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

MD5 1da8deabd421929fa1a865599f43aad8
SHA1 88af7573c39022643333f85b523a329cb6448675
SHA256 07b01330c36ae322ea1f1e2ea70e60b629b292b3f7ee7aae5a9968dcf341e685
SHA512 0be3f8d02397c3cc32164b116c807115c42a310fd70c72c94b3b523732422ea2b222d8762e81d91ef0c36a8328df4f7ae8e4570c4bc46ab94cbed5131389ea3d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 918f218da8b9beb733beacbcd67245cd
SHA1 355cd81addddc986f72b4e8d738005a51f932021
SHA256 352009a5f98e48b3f7a7e139be24a30b4339b61d80bb477ca4752d561ed1ee42
SHA512 1c4db75def933b16b1d2a9211f0038b362b549a76c7f79a15950845e4b71c972cad84524ba526cfda12e309f8c1659a313d9c52e2861cc65d870269aa9b916d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582a76.TMP

MD5 cb57ac384323b0254fd6f8b653d24f3d
SHA1 959a1a786a7a350cf11e23392c4050b544fe7a24
SHA256 9a8bd09fe4ee43e64beba45ce18cfee25096607fcf0db118662cc2d812b75868
SHA512 7643190b8bee6ce1019ad3e4f2ffc37a0c60a38782d3d858328b5bd2c6a1c876e2fa8fdbd31e5fad543bee2cc2bcd4b6af7a7185c6a48f946e4b8fd20042327a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 910b975a95b66e5719af044a99569d40
SHA1 3dd87ee4769e1acaafdd157a96d89334711c3771
SHA256 f5ad9833cdef3c6b2bb57f12b2068703cc034d415b5ea1978cb8a248e0b4ef3c
SHA512 a80e3998c7a2525ba2994582e4c36093560afc463c55729c17453710c9c97615ea786f2a7284b5f41468f9328cf8b8b7339c7925fbd5574cb28e36fed3a6da4e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 8ba93be5bf115c8735b325fd8445dbd9
SHA1 824191123d334e2091d7276ddbb9d1201bfa49fc
SHA256 b19794ff2999fe505bc71cb0e4838e23eac95a39736b18085849e9a362da33e9
SHA512 1d3d4660169a663be251e5ec6cf8d122825a559b70a09e1fc0f51feb3b7a9b81b9e33e5d4afeb2dda0e4aed5dab332845c5c174920704963578f2e6929e185ae

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d7681d32884fb505bb30f05c239db621
SHA1 1daeef0ef2bb676488fefaed1c7c6423e96e16e0
SHA256 20c4eeb04572a2895fe26f6663f8da8469463af336dc795a6dbe62837c8b597e
SHA512 cf9560faaea4625c0b86ccbb5e51ce7aa600580b52429bda75dbf3c1ce17884390414b308e0aeac529f7028b4acd1f2fc79ed5189468e9a166b1de05106af573

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 699e55f9883f462df81306f720b700e8
SHA1 bd0d662991ec9cf30e5e497c115c0b316ca44a07
SHA256 21e53d3dada68e4d1fcc8f4dcd51d88cdcf832b3714474e8f62a1d6d815af0b5
SHA512 9ec10a74e82c032a29f1e264122454f150cdb949f9eabc9d5b5a5475abbd86063930f349371e74ebeb68a9370efde9ca5d943ab7e815be1ade3247678a2e94f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 00be650237b3b6b7bb0fdfa5574eb971
SHA1 e62a83ef077b3d33e4c02cf3b503858aabfca13a
SHA256 7e235414e04da34f24d8520abc26384ab6bbca75504e82329868670431d87c7f
SHA512 f8371f40dbbcce2232b2c4efb70e22c8c36977de7f9ad84d470b139edb92ecfd648bc7ee117c776705f0c04d5bb607e3f097601dba7280ebec15aca03ae16b06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 b543eb7fde132947226c3daa57c0ec47
SHA1 d1ba3439939e37928707b5232ea54607b7781acc
SHA256 359a913914ad1f7dd8c61eadc40c34f99bbfae025816d78c48e5f852e4efd111
SHA512 b85e4caa0a7d4cf87a871e1c690f813a607502f8990b032d93b11801074c370177adbae5dfa3924565b1351b5cb1bbd34c5f424c3afc30e84cd9638e1c5f0e79