Malware Analysis Report

2025-04-13 11:37

Sample ID 250101-lgvqca1lax
Target JaffaCakes118_4fda3c9b5bdd02c2d6d19af359c370e7
SHA256 392c7b2e863988b135d852c3b50a2b299de1a93a266ed874ad4186bbf7f9c711
Tags
socgholish discovery downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

392c7b2e863988b135d852c3b50a2b299de1a93a266ed874ad4186bbf7f9c711

Threat Level: Known bad

The file JaffaCakes118_4fda3c9b5bdd02c2d6d19af359c370e7 was found to be: Known bad.

Malicious Activity Summary

socgholish discovery downloader

SocGholish

Socgholish family

System Location Discovery: System Language Discovery

Browser Information Discovery

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-01 09:30

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-01 09:30

Reported

2025-01-01 09:33

Platform

win7-20241023-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fda3c9b5bdd02c2d6d19af359c370e7.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf000000000200000000001066000000010000200000009fb83e95ce5e575c1126f43b69e30843ed1635406aac87010f5f869e47a6a13d000000000e8000000002000020000000f30dc9a6479d489d77bf858a7dd3d75442f3e036c992884191138a693bbf555c90000000be7d13ab107301f03e7e2453c068259bc849135631b36d7c6ef3a5de15507bc9502c87f012f6b206718edcdf8443175c7c41bde65d2e20ef7b4297b635f9547934768da5edd4b9a67c92e12091f007cd30cadd4ee1c7a6c429f0b40e3e3cae6414c218b97c7880faac24e10e1428e8aaaf6713b921501e0b72d309a99bca9ad77dc6ea499f05f51d8004f0a7f40590b3400000001711e0a9bacbe98827a223c3331fbbd92d14754dfe5d763280a5194bc9a92f55f8385b181407840bb22ad2d5f59320b693e9f1baf9a12d375fcedaa8fa7664b8 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf000000000200000000001066000000010000200000007d8189c46e1ec94c44fcd911062b624ff2ff14f32b6c40f3c2de26dcaf02146a000000000e8000000002000020000000128912f94b7469d2a761bec381d73c1be20a0e40f412adaf9e2da8727a569de520000000763a094538452aa441e2ed6e553c740e9d33813d631b589392fbb607f94cec3640000000257c1f8397037a688727f3db52ac6966103e38f6dc5904f7a26022f2da32fa72e17b55739e8786d5564bb5259a7c389c56452b9c18ffb2b81826b9473b804560 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441885715" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1466F121-C823-11EF-8FB4-EA56C6EC12E8} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400094f42f5cdb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fda3c9b5bdd02c2d6d19af359c370e7.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 googledrive.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 www.lovelybooks.de udp
US 8.8.8.8:53 www.linkwithin.com udp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 142.250.179.97:443 googledrive.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 142.250.179.97:443 googledrive.com tcp
FR 142.250.179.78:443 apis.google.com tcp
FR 142.250.179.78:443 apis.google.com tcp
DE 195.160.160.89:80 www.lovelybooks.de tcp
DE 195.160.160.89:80 www.lovelybooks.de tcp
DE 195.160.160.89:443 www.lovelybooks.de tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 88.221.134.137:80 r11.o.lencr.org tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
FR 216.58.214.169:443 www.blogger.com tcp
US 104.18.11.207:80 maxcdn.bootstrapcdn.com tcp
US 104.18.11.207:80 maxcdn.bootstrapcdn.com tcp
FR 142.250.179.78:443 apis.google.com tcp
US 8.8.8.8:53 w.blog-connect.com udp
US 8.8.8.8:53 snapwidget.com udp
US 8.8.8.8:53 booklikes.com udp
US 8.8.8.8:53 cdn.abowman.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 www.shabbyblogs.com udp
US 104.26.8.123:80 snapwidget.com tcp
US 104.26.8.123:80 snapwidget.com tcp
US 104.21.69.222:80 booklikes.com tcp
US 104.21.69.222:80 booklikes.com tcp
FR 172.217.20.170:80 ajax.googleapis.com tcp
FR 172.217.20.170:80 ajax.googleapis.com tcp
US 172.67.133.250:80 cdn.abowman.com tcp
US 172.67.133.250:80 cdn.abowman.com tcp
US 192.155.91.172:80 www.shabbyblogs.com tcp
US 192.155.91.172:80 www.shabbyblogs.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
US 104.26.8.123:443 snapwidget.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
FR 142.250.179.99:443 ssl.gstatic.com tcp
FR 142.250.179.99:443 ssl.gstatic.com tcp
US 104.26.8.123:443 snapwidget.com tcp
US 104.26.8.123:443 snapwidget.com tcp
US 104.26.8.123:443 snapwidget.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
US 192.155.91.172:80 www.shabbyblogs.com tcp
US 192.155.91.172:80 www.shabbyblogs.com tcp
US 104.21.69.222:80 booklikes.com tcp
US 8.8.8.8:53 bookjunkies-rezi.blogspot.com udp
US 8.8.8.8:53 booksandsenses.blogspot.com udp
US 8.8.8.8:53 booktastic-world.blogspot.com udp
US 8.8.8.8:53 bowsandbooks.de udp
US 8.8.8.8:53 buechersuechtiges-herz.blogspot.com udp
US 8.8.8.8:53 durchgelesen.com udp
US 8.8.8.8:53 www.damarisliest.de udp
US 8.8.8.8:53 www.favolas-lesestoff.ch udp
US 8.8.8.8:53 www.hisandherbooks.de udp
US 8.8.8.8:53 ich-liebe-fantasybuecher.blogspot.com udp
US 8.8.8.8:53 katja-welt-book.blogspot.com udp
US 8.8.8.8:53 inflagrantibooks.blogspot.com udp
US 8.8.8.8:53 lenaliest.de udp
US 8.8.8.8:53 lenabosblog.de udp
US 8.8.8.8:53 lesefee.blogspot.com udp
US 8.8.8.8:53 www.leselurch.de udp
US 8.8.8.8:53 levenyasbuchzeit.blogspot.com udp
US 8.8.8.8:53 lielan-reads.blogspot.com udp
US 8.8.8.8:53 maaraavillosa.blogspot.com udp
US 8.8.8.8:53 michasbuechertraeume.blogspot.com udp
US 8.8.8.8:53 www.mybooksparadise.de udp
US 8.8.8.8:53 bookaholici.blogspot.com udp
US 8.8.8.8:53 sharonsbuecher.blogspot.com udp
US 8.8.8.8:53 www.sheerisansbuecheruniversum.de udp
US 8.8.8.8:53 spoilerparadies.blogspot.com udp
US 8.8.8.8:53 scherbenmond.blogspot.com udp
US 8.8.8.8:53 blog4aleshanee.blogspot.com udp
US 8.8.8.8:53 wonderworld-of-books-from-hannah.blogspot.com udp
US 8.8.8.8:53 buchgedanken.blogspot.com udp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
DE 109.237.134.8:80 lenaliest.de tcp
DE 109.237.134.8:80 lenaliest.de tcp
DE 64.190.63.222:80 bowsandbooks.de tcp
DE 64.190.63.222:80 bowsandbooks.de tcp
DE 195.30.85.220:80 www.leselurch.de tcp
DE 195.30.85.220:80 www.leselurch.de tcp
DE 172.104.149.86:80 www.sheerisansbuecheruniversum.de tcp
DE 172.104.149.86:80 www.sheerisansbuecheruniversum.de tcp
FR 172.217.20.179:80 www.favolas-lesestoff.ch tcp
FR 172.217.20.179:80 www.favolas-lesestoff.ch tcp
DE 85.13.164.33:80 www.damarisliest.de tcp
DE 85.13.164.33:80 www.damarisliest.de tcp
DE 85.13.147.197:80 www.hisandherbooks.de tcp
DE 85.13.147.197:80 www.hisandherbooks.de tcp
US 8.8.8.8:53 was-kostet.net udp
DE 85.13.147.197:443 www.hisandherbooks.de tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 172.217.20.179:443 www.favolas-lesestoff.ch tcp
DE 85.13.162.62:443 was-kostet.net tcp
DE 85.13.162.62:443 was-kostet.net tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
FR 216.58.213.65:443 buchgedanken.blogspot.com tcp
DE 85.13.147.197:443 www.hisandherbooks.de tcp
DE 85.13.162.62:443 was-kostet.net tcp
FR 142.250.179.67:80 o.pki.goog tcp
DE 85.13.147.197:443 www.hisandherbooks.de tcp
DE 85.13.162.62:443 was-kostet.net tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
DE 85.13.147.197:443 www.hisandherbooks.de tcp
DE 85.13.162.62:443 was-kostet.net tcp
DE 85.13.162.62:443 was-kostet.net tcp
DE 85.13.162.62:443 was-kostet.net tcp
DE 85.13.162.62:443 was-kostet.net tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.146:80 crl.microsoft.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 392b7cb419b91ef273b4b85bc12ceb47
SHA1 7f1f5dc5fa575a204bd007bb796465eecf654a47
SHA256 83efce1919aeae1d2c9b916a967aaa234187dce1c0635279bce646b2df018970
SHA512 af8a1025a60e6e63a4595209d16a45acf7a599cd911c430d3ee35b4bc7e819993189bca0ea8343654e5799d80bea06b07f76f6d665e5c613365993edbda1f7b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 2770ced3aae4c7bc04ff84025141ca70
SHA1 29f20ad0cddb0822b52447c3ee9e1252965810d9
SHA256 81f092361e5ee8232689dfd94cee407d95bd2374937411ce0bc4760c2c8c4fee
SHA512 1ca3ad8e421c4ebc4655cc63187145b9c9e336cf5051ae2dd6f9939bb1aef1f3835b64a9e5b7c8c4e115b7b1a09ab8c32a7adedafde1510a2097085768f3c50d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 e672700abbdf0232be24aeff88d0b182
SHA1 b835e61892f297465a0be1787f2b18037af80df9
SHA256 9ab517a780fe9cc82156e95d82bd82705c63e27f320d240b6237f252a888fbcb
SHA512 b0a507760f9a53a90f9542b9dc002c7bf4c82e5ee0aed4a0f568a626da9002a97fa6e24bf973424988f2aa03c0590a31eb35a2630ea353c49ba4ee7390fb0a47

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 5f08ad7a688023d7a4bb9e2999b9e9ac
SHA1 9e096fd6d9546e0a82238050ec7f0487b7334fbd
SHA256 a9ff6399b28fe3f087d3897e93ea35055f63cff07d686fe2967403910a35007f
SHA512 a42cb5d9cac5c6f6fe09ac7cb4ac5ac295f93bc215d7f8d09fbc6547dd24206171a2200c31b89c2eeafe8ef1680089470eec70dcdbc76ed8db30b5a7a6848ff4

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6J4GCMD\cb=gapi[2].js

MD5 b103bb58d9e7cecaa60bdf377d328918
SHA1 0f094c307bceef833a64f408d2f749a10f79de44
SHA256 81dcd274347bd909cf132d3c8bcc9924e41921c33eca07fd6fe5e2a59ca4f5b7
SHA512 b1a4fa329b76df7c861771e1dc36749155895dff623cd916811f2af8c95f3bcf9fe75a3b9a56833f066a227444982ff4883459e24f7eead79b521c2ffdcaa844

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_191023D640896A0CAAB6B353590277DC

MD5 90958a8933537034a0ec934a8ecf7dcd
SHA1 6f185b8d7c2ec0041b22332ce456e0312d4e9fbb
SHA256 fdcf82ec8f0e5c32bd6bc0b5ac31e4d1e91fb2b84c226750b78ee1778314fc47
SHA512 05dbffd2a8f435bec62ce25748727796b045ad93e774c816ce376b6bb9923f43525377cf4dec27d65383f3d1d4be524a73783c5105cd4917dc57c129c0019b9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_191023D640896A0CAAB6B353590277DC

MD5 7e1f96cc33ac11c86f5a56f5de6727a5
SHA1 957fc6dde662f3293d62ce78a22a58f063b0533f
SHA256 43012d8c16002725c4a69edd96f850c70464756ffeee482dde4c6e2da5d6011b
SHA512 bb2004b37280e2a114c90958c03870bcc58dd4309266ba730727475029a38c0c5301c2ec0b1571bcd270517d6cd01d3973c00c0b1e7a57b53301ee32eac2e34b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_191023D640896A0CAAB6B353590277DC

MD5 3405098cbc603d5f473ec0c36a14166c
SHA1 1572c6a56b9e43d26e3403d0bdb70f523476f58c
SHA256 efb66750a4f90cc5dc31cfd82e58ccd628497494466b85f8237a0e6983d2c061
SHA512 d3d67a30db575cf81288ec7cc15c4e73c51a21718c39bf1b6323eb85550abe0a37bbf41a953f9ea173608ae760e5527e28831d23333acb60018f664e8a0e3179

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a29649e12408f1f7aa548dda72cdca44
SHA1 670c8f2f77d7e8b4a92c7876e6af28d30159ba5e
SHA256 49940c424f6077004d938669122fe77d2dc1876d1cb194b210376abe6992f02e
SHA512 7c3e0231f1d64746df2376420ac8763bd92e7568175601a4e34dc5f1c3d42e31c28b0b9046c1fd314cee3a1d6b48d16cc22173861462e0efb2154b8a47963ae5

C:\Users\Admin\AppData\Local\Temp\Tar9D3D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\Cab9D3A.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 39aa9949e0de378daea6546db7ec7433
SHA1 6fc6b9851c2bcd00ef0bd405ad47a911956af233
SHA256 b56ae4782af186b75822984c9535bdc2c993b0ad98ce63c823d8525833999523
SHA512 97e7c73adc8f58f534d36c095a931206035d6d085c9dc6853fcd128961cd50fa59cb3f4e8f513c4b72325b82758a9f870d8b4bcbe2e4bda735a831473c2247fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec422a8b74baeee137290f951f499c15
SHA1 3760f2f93faff12191f9465f44292451a415b793
SHA256 6b1c21ffcac91ad49ccd5cc960fb52477e797c3383e1cefd9baf6441ccb6cb90
SHA512 1a56085b82323950b937f6deae5fc821fa5b9c57ab7769dffa0ba0e08a4c04ec9b9765d128a3ce65a84a8456a61b3e304de13eb4c399216bc8733a788775a7db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96941bb47b13ff406361f20683c83f7e
SHA1 ba2a3baa4f00f4f9b91d05dc589fba60989dd4e2
SHA256 ba57448c5cb90bb410edb3d94ff76d40299de51ff4efab9350eed5c6046c533b
SHA512 6b26bbb525fef2d36265083547b86e4afc6681ed3729ad5e3a0fbe89601127be1e1b4c7c4a01dad509506921e9beeb4083aa8ceaa7fc6899e40f0e0efc5bd395

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb0dc22d19a509e2bd54c10d14139eec
SHA1 f1f6f82e5a28c8c1078e29269603459ffcc95b6e
SHA256 ad39b70d4111b507ed65e5b7536717d60dd7c822eb1b317614a324c0ce2ae39b
SHA512 9b3202ca79ec2f1eaeae7013950cd5a5738191a4fead1f6a30dc7457b5c2a8d4dd5dd402251162d0ff907932879a3acc0488c6b21a97ab948451b57983e78f47

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f82b15177bef5426bb216de7ca5c7e0b
SHA1 98ec6bb57d6a0b2b07d852af9b57d4a6ec83b427
SHA256 7ba1bc70d7e8a189ba2e92c4d9a238aa271364dade494905da663db512b6965b
SHA512 18d55964d7ef1a4f26717ed7a2d2068ed097c5f3feb2290464aeadce0a08058537c2f3b41aacca9c622c50f310845664c1bcf57d87d688857634562c220c55ae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 82d9fb436f12f3744b61127746d2b672
SHA1 ed56f3ced03a08b7f18e29c1547b76b79b9113d7
SHA256 8e273f425c4f4056deacb77ec594b209972f27464aa6449c9d2c1ba45cbae81b
SHA512 6a6394ee1fb8d2b98e18533b6b4a31e6ed3e94651e685b8238c2694fffc819987b23f3f491bf1ba13ea2e22efd5b0dadfa3f1e4b876a78c0e9d5fdf644a75dcc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bdba9bf3cd18c3859f6c10a324c7bd23
SHA1 b191360bd3005c3e2df08c1880794102f8e0e255
SHA256 3c3232ccc9f6016cb82717204254a25fb8195ba1a68db6ec43e4abbf02c757f5
SHA512 5b2fae1143686cd411d6f1666b2d91dff5332c13f66e0313dca557a7fedf41de731043dbcea73c657a760725ba281778cfd92124dfe5bef2620ec1d28c3d437a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d6601e81528ee5942d4b77aac065a6a
SHA1 ee33472bc4d82fce1838ae17c064795d6c17a55a
SHA256 145609a96dc7e36ff697e677e82f5a81e385dfba40b7e92ecc2869d48eef5bec
SHA512 3ff87c0bec848cbc0b9ac0e0df58e9d59434d792b1566f624bdfa36735a7079f68655430fc82621758b69cb5f189db8b0700285112840d8ff8c618efa47bde0f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25cffb81ccd9a3fbd36bb0dbb3278e01
SHA1 50bc970ef6e651b4104aceb530bb688d28aff595
SHA256 76f9434bde07450da87461907ffb37ca1bdcf65e2edfedfe14dbf2089eb06c58
SHA512 1f9f2f713c5c1669d68b851f9666d7f8e70144daf7cb29db08de54b25235c388c300c500960ac70cad691b62860b010e8f87669b03ad3e60c13c91f091158132

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 801bbc6f2be48ed87eb862faa96d57f9
SHA1 d1e361c8f7b23384b13b4ba23a56ef9c9c4c754f
SHA256 605bb869ec22accb40ab5cafb0e5b14120e1b75ebbf6ffa458ec06c0f992be61
SHA512 6bdecefea5029a7358962ac88286daede2c1e59e48bdd821b6d8dcebd61fce7f0261c9e5391f0e602692a38f1fb3196141aa80530af1719f21b28d3fff861eb4

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\2254111616-postmessagerelay[1].js

MD5 c264799bac4a96a4cd63eb09f0476a74
SHA1 d8a1077bf625dac9611a37bfb4e6c0cd07978f4c
SHA256 17dce4003e6a3d958bb8307bffa9c195694881f549943a7bdb2769b082f9326d
SHA512 6acd83dfd3db93f1f999d524b8828b64c8c0731567c3c0b8a77c6ddcf03d0e74ee20d23171e6ceac0c9f099dce03f8e5d68e78c374da2c055973f6ac2db4e4f9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6J4GCMD\rpc_shindig_random[1].js

MD5 25879c1792060210aabb2cc664498542
SHA1 349848a5e88088b22fb4762ca2a619d1a7f40d97
SHA256 1c0dff80b0111b04f387f0c39fe8d199e909c285f5471da80d6da78c79f9fc79
SHA512 845cb435d102d39b001e7f00d7528dbc3f8505809f5fbca039587ed82d9790b16c9179de8877fd48f2fdab11e7308ad003303821217213a2b99e60d9915a9c88

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46d1929b39515ef56c1a7a2b4670500b
SHA1 498639f7aa06d0b555f76d8667b7d502b6a4ef86
SHA256 96d0466e24d24de5d5fa8aa9cc81c722d00c29d6a7ef5a4d5e6562dc85f8f709
SHA512 3a906881136287155ce0c14abcf36f3a4b79c856c588ef03f4840e8768dc312ce9c0769d6996b22eabd987185b90141099da6b142330cb2b4d977cecac84fea6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afae92b4257d0e86447d78e0312afa17
SHA1 3aaf1bb5e30834ed727206be1cdec20f4a567e24
SHA256 49d620b002b0b27cb64ca3de57c130c0e70bf7c374825eff0ee17977e4d7ab46
SHA512 6333950a0141666591ab6d5744368423733e85224ba94f713e330e002e24082a8b9f5daf33c7f723afcd8f99d837d27518cb2dc43192cbe874f653efe95e6d6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 d9abc981273ba0980ec456438d2035d8
SHA1 acd83191371b0a5aff61320ed24fad305b5b19c1
SHA256 48162d120666daf27db0662bf07ceda3fbefc4eb0166888358aa58ec837205f3
SHA512 54f58e2bc96a50a4a4fd35966a43c7361c085967234dd99ff90783e3ff3a44a746b7d434ab36c2b863c88ef7b2da0d6c1d5edb0b57684b28cc230235cce0ce7c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 af0ec034de5c846c3eab86a235dd2abc
SHA1 19c8f68541640d23ea47c709cc08a1f39ba4ecb8
SHA256 fc510439428d0eab766ada4eafb21e37cc6eb652496ef88672f3745ff41b0e2b
SHA512 1d8156448ec94be1d989596365b0859bb22416d6606af69fee526fa95d2704997252c7c59e6cd81ac8072957c1636131986f2deaa61373ec0a08f895b6327cd5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ea268e3d09c446d7d8df1b6f913fd292
SHA1 86b17e92cddcca71e72c5ac18a6a55b6d5b9f82c
SHA256 aea644125f07441cc7ea7afe4bfb11b943ef2fc4d53abe00e351c8d882934553
SHA512 8f556865c029ed15c504b9db2a78cc2c4bc3e488595f3606be7dea61ee1892823734bcc562b5713946c1344ccf495212863e506304dababfd0b1ad428fd46d28

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 35d5f0758d66911f5f4036ba5e738ac9
SHA1 38eba1abbd78b8d99d0775f500cf1b66ef74ba01
SHA256 d685bfa565dae46bd73b2e2260609685029a5321f735269d4255d75c2fccd25d
SHA512 e91e601da8994cc0bb32aed07c242d2ab27cc760f54dc34b4e4ec3c1d10a6b4e45a8d5ff32c40d96a7558b778738ef01b4a935a423c7c53d48d373b25386d556

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 68edeab8efb2dfe68d29861af4e2af19
SHA1 63f43d8481b300f5c055c63e324c72bd26eb9b84
SHA256 0a3013d8a9c66726e77c3847453e7b4b3eb0f443851adfc6d3e194f80c48db2e
SHA512 0f239e543589fe26bb7fb1a24a9b7c0cdbb198825915015b18f582c683cd4ae90a4c41f0ce2b716c98f6ab196835122f6b5b94628fcc32a3263f37bc59ab33a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b311fac7cfe7fcf1e59bf27c1c548bc
SHA1 1215d83c2fd5229cc37995029c90248ba3c46718
SHA256 051cd7db1416b7573edddde1b28a04eab0573a9527a9e954374bee81c82ca22b
SHA512 742b7404738e4084d0b7b9e3c8dcd9ea5f900c1f3ca362b1e933216d6436fe7f4509d71e9e7bfcabc98e8f307c06f35452690870de9dbff16446f61a61dc1928

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 7fbc83a1cefe92a90a26e33c19735bb6
SHA1 082d2450ffaf56d97a53ba493fe7e7e79357c35e
SHA256 0b8c4652bc0666f9d02fd9625b7f5308a0e43873852012b813137760e8ed03d7
SHA512 13092bfc38028a434b20d2bedec9aa6f095bb9255992ac59a903d41a422ac5fc90d50144e92163a2dba949558a18ca7d80f2a850b96cde8f7f9886b875fee4f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 291a1bf1ea68a82abf1c32b30975d77b
SHA1 5cd03dcc3da6bc5a1788fd6b04d7beaf8b1edde1
SHA256 4443f970cd24b11cda2d648f5cad007b99bebadafb22949c6768aa40972471d9
SHA512 8652d349d42d5fa947ed16a875d0eeed1ca674fb350e477234bff9934a592346423197260afd54e9ff1398c2e0b79eb04675bc8f34332f039c28dc1efb36a29f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 30db003f5334aacce0c4a607803160e8
SHA1 1044f38b8d73f453488130c013e0dee93c3aa3bc
SHA256 833281681f8ec655e1bbb4512d172f8420364efc34ce75a02acd7356678c8716
SHA512 0179f62a13b7a52df1eaff350b7b5e41ab9b2eb34819ad34ecd290f182b7a4163ac44c6140d97e9d0c0d76c6ab3735ef1ebb4c027500629b9b29ec560b126481

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eabc8ec0ee4109f3ae76ed857ee606c9
SHA1 e870f589782ef2fdef5913502514688c641bad83
SHA256 148d298c5dcce0daa9fd30c9ecf09c991651d65e6d8c3586d6979ef1ee0c05dd
SHA512 9bfa5d82320c22f899770068065113dd48ca618b53fa99bb128b422ef8b349874abf33bcd2522d408d5bb0dd08e12387ae1a88efab24af41d103e23e4af0094d

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-01 09:30

Reported

2025-01-01 09:33

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fda3c9b5bdd02c2d6d19af359c370e7.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3636 wrote to memory of 3308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 3308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 4476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 2100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 2100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3636 wrote to memory of 1780 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4fda3c9b5bdd02c2d6d19af359c370e7.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81e1e46f8,0x7ff81e1e4708,0x7ff81e1e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7918485129450005892,12388954754908312831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5952 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 www.blogger.com udp
FR 216.58.214.169:445 www.blogger.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
US 8.8.8.8:53 googledrive.com udp
FR 142.250.179.97:443 googledrive.com tcp
US 8.8.8.8:53 apis.google.com udp
FR 216.58.214.169:443 www.blogger.com udp
US 8.8.8.8:53 www.lovelybooks.de udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 4.bp.blogspot.com udp
FR 142.250.179.78:443 apis.google.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
SG 118.139.179.30:80 www.linkwithin.com tcp
DE 195.160.160.89:80 www.lovelybooks.de tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
DE 195.160.160.89:443 www.lovelybooks.de tcp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
FR 142.250.179.78:443 apis.google.com udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 169.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 97.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 78.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 33.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 89.160.160.195.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 104.18.10.207:80 maxcdn.bootstrapcdn.com tcp
US 8.8.8.8:53 w.blog-connect.com udp
US 104.18.10.207:80 maxcdn.bootstrapcdn.com tcp
US 8.8.8.8:53 developers.google.com udp
FR 142.250.178.142:80 developers.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 snapwidget.com udp
US 8.8.8.8:53 booklikes.com udp
US 104.26.9.123:80 snapwidget.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 142.250.178.142:443 developers.google.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
US 172.67.213.133:80 booklikes.com tcp
US 172.67.213.133:80 booklikes.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
US 104.26.9.123:443 snapwidget.com tcp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 img1.blogblog.com udp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
FR 142.250.179.99:443 ssl.gstatic.com tcp
FR 142.250.179.74:80 ajax.googleapis.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 www.shabbyblogs.com udp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.214.169:139 img1.blogblog.com tcp
US 192.155.91.172:80 www.shabbyblogs.com tcp
US 192.155.91.172:80 www.shabbyblogs.com tcp
US 192.155.91.172:80 www.shabbyblogs.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 207.10.18.104.in-addr.arpa udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 123.9.26.104.in-addr.arpa udp
US 8.8.8.8:53 133.213.67.172.in-addr.arpa udp
US 8.8.8.8:53 99.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 74.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 73.79.16.104.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
FR 142.250.179.78:443 apis.google.com udp
FR 142.250.179.99:443 ssl.gstatic.com udp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
FR 142.250.178.142:443 developers.google.com udp
US 8.8.8.8:53 168.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 110.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 65.179.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 oceanlover.booklikes.com udp
US 172.67.213.133:80 booklikes.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 img2.blogblog.com udp
US 8.8.8.8:53 img2.blogblog.com udp
FR 216.58.214.169:445 img2.blogblog.com tcp
FR 216.58.214.169:139 img2.blogblog.com tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
FR 216.58.214.174:443 play.google.com tcp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 ajax.googleapis.com udp
FR 142.250.179.74:445 ajax.googleapis.com tcp
FR 142.250.179.74:139 ajax.googleapis.com tcp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 www.blogblog.com udp
FR 216.58.214.169:445 www.blogblog.com tcp
US 8.8.8.8:53 www.blogblog.com udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
FR 216.58.214.169:443 www.blogblog.com udp
US 8.8.8.8:53 bookjunkies-rezi.blogspot.com udp
US 8.8.8.8:53 booktastic-world.blogspot.com udp
US 8.8.8.8:53 booksandsenses.blogspot.com udp
US 8.8.8.8:53 bowsandbooks.de udp
US 8.8.8.8:53 www.damarisliest.de udp
US 8.8.8.8:53 www.favolas-lesestoff.ch udp
US 8.8.8.8:53 durchgelesen.com udp
US 8.8.8.8:53 ich-liebe-fantasybuecher.blogspot.com udp
US 8.8.8.8:53 www.hisandherbooks.de udp
US 8.8.8.8:53 buechersuechtiges-herz.blogspot.com udp
US 8.8.8.8:53 marys-buecherwelten.blogspot.co.uk udp
FR 216.58.213.65:80 marys-buecherwelten.blogspot.co.uk tcp
FR 216.58.213.65:80 marys-buecherwelten.blogspot.co.uk tcp
DE 85.13.164.33:80 www.damarisliest.de tcp
FR 172.217.20.179:80 www.favolas-lesestoff.ch tcp
DE 85.13.147.197:80 www.hisandherbooks.de tcp
FR 216.58.213.65:80 marys-buecherwelten.blogspot.co.uk tcp
US 8.8.8.8:53 inflagrantibooks.blogspot.com udp
FR 216.58.213.65:80 inflagrantibooks.blogspot.com tcp
FR 216.58.213.65:80 inflagrantibooks.blogspot.com tcp
FR 216.58.213.65:80 inflagrantibooks.blogspot.com tcp
DE 64.190.63.222:80 bowsandbooks.de tcp
FR 216.58.213.65:80 inflagrantibooks.blogspot.com tcp
DE 85.13.147.197:443 www.hisandherbooks.de tcp
US 8.8.8.8:53 was-kostet.net udp
US 8.8.8.8:53 katja-welt-book.blogspot.com udp
FR 216.58.213.65:80 katja-welt-book.blogspot.com tcp
US 8.8.8.8:53 lenaliest.de udp
US 8.8.8.8:53 marys-buecherwelten.blogspot.com udp
FR 216.58.213.65:443 marys-buecherwelten.blogspot.com tcp
DE 85.13.162.62:443 was-kostet.net tcp
FR 216.58.213.65:443 marys-buecherwelten.blogspot.com tcp
US 8.8.8.8:53 lenabosblog.de udp
US 8.8.8.8:53 lesefee.blogspot.com udp
FR 216.58.213.65:80 lesefee.blogspot.com tcp
FR 172.217.20.179:443 www.favolas-lesestoff.ch tcp
DE 109.237.134.8:80 lenaliest.de tcp
US 8.8.8.8:53 www.leselurch.de udp
FR 216.58.213.65:80 lesefee.blogspot.com tcp
US 8.8.8.8:53 stefaniehasse.de udp
DE 195.30.85.220:80 www.leselurch.de tcp
DE 85.13.147.197:443 stefaniehasse.de tcp
US 8.8.8.8:53 levenyasbuchzeit.blogspot.com udp
FR 216.58.213.65:80 levenyasbuchzeit.blogspot.com tcp
US 8.8.8.8:53 lielan-reads.blogspot.com udp
US 8.8.8.8:53 maaraavillosa.blogspot.com udp
FR 216.58.213.65:80 maaraavillosa.blogspot.com tcp
FR 216.58.213.65:80 maaraavillosa.blogspot.com tcp
US 8.8.8.8:53 michasbuechertraeume.blogspot.com udp
FR 216.58.213.65:80 michasbuechertraeume.blogspot.com tcp
US 8.8.8.8:53 www.mybooksparadise.de udp
US 8.8.8.8:53 bookaholici.blogspot.com udp
US 8.8.8.8:53 sharonsbuecher.blogspot.com udp
FR 216.58.213.65:80 sharonsbuecher.blogspot.com tcp
FR 216.58.213.65:80 sharonsbuecher.blogspot.com tcp
US 8.8.8.8:53 www.sheerisansbuecheruniversum.de udp
DE 172.104.251.198:80 www.sheerisansbuecheruniversum.de tcp
US 8.8.8.8:53 spoilerparadies.blogspot.com udp
US 8.8.8.8:53 scherbenmond.blogspot.com udp
FR 216.58.213.65:80 scherbenmond.blogspot.com tcp
FR 216.58.213.65:80 scherbenmond.blogspot.com tcp
US 8.8.8.8:53 blog4aleshanee.blogspot.com udp
US 8.8.8.8:53 65.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 179.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 33.164.13.85.in-addr.arpa udp
US 8.8.8.8:53 197.147.13.85.in-addr.arpa udp
US 8.8.8.8:53 222.63.190.64.in-addr.arpa udp
US 8.8.8.8:53 62.162.13.85.in-addr.arpa udp
US 8.8.8.8:53 8.134.237.109.in-addr.arpa udp
US 8.8.8.8:53 198.251.104.172.in-addr.arpa udp
US 8.8.8.8:53 220.85.30.195.in-addr.arpa udp
US 8.8.8.8:53 wonderworld-of-books-from-hannah.blogspot.com udp
FR 216.58.213.65:80 wonderworld-of-books-from-hannah.blogspot.com tcp
US 8.8.8.8:53 buchgedanken.blogspot.com udp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
FR 216.58.213.65:80 buchgedanken.blogspot.com tcp
NL 142.250.27.84:443 accounts.google.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e443ee4336fcf13c698b8ab5f3c173d0
SHA1 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA256 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512 cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

\??\pipe\LOCAL\crashpad_3636_JFJPWCIOQOGYSJJV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56a4f78e21616a6e19da57228569489b
SHA1 21bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256 d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512 c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c8adb88fe998aeba5d5984a9e3e81226
SHA1 9fb9b0b6e15721b7dd1af7952d6774681db5a7ba
SHA256 a62b5e180c9d0409a7cdf44cc52eb363306ba682f73cace8c73d27b30a710755
SHA512 90f1dd7dda5e1a43094a90c36a171bc13ac5a733d034311159e570444265d4ee27b7c6081a6e1304d51fd5b2e6928412a2248fe4ce0fc97fa562c5e64ce6310c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b96c9d1dabf8a414b0f0bacc9cc8fd29
SHA1 9d1df96954b98b10c915d4c3bb3b8241004303ad
SHA256 662da8758a7388c0b5f18e7ccd913ba76867ffd098574fc9f59b9d135fa87f8a
SHA512 fcc10d8cf393bfa63e4ece78ab7ae5b29fa5b817e5c0abb46fbd9430154a0bdd46f96dacbfb2150a8b904503509e578afb71f87379e978fee66f84244e687e04

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dbe85f32ec8962f1e3ddf90722841dd6
SHA1 e5ad2462249ecb179e19a36a761940f21dd72587
SHA256 b04892327befe77911e7e393541d0ce9d084ee047528270d067617e8e23157d1
SHA512 2c17abc6ac475830c487b94af2eb92738ed4b0e9436e52721ce269a9f8cc78b6197298959a298815e0939e721a69682cca5e420424940763135989349c65fce4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d25941afb7a1a3562a334b5e4b6674bb
SHA1 ba8b7587f284f6637c79fbfe74f241f9036f11d7
SHA256 31714cbb6c60e9971ba5dd765c4a27a321201b9c3b1a06f8b3d0e46a0b0227d0
SHA512 d9b2f205dcba4f45fa6ff5cb7f85a6347cee9fe3a9669c3acbd9bff8d2b267b5244979c5ef278d451110198ba3252c9ae3dbc176affd0fdefb637066a753df74

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

MD5 2ebfdbd309ee762211b4a2ac39708c4d
SHA1 b002922c672dbe1dd4caa02af24d0b1e7da616af
SHA256 54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797
SHA512 d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 db18d71c473f06bcba1c1223a6a3785e
SHA1 8b39972e7b40bebc7a26129b81542161ed227908
SHA256 121cf03316b26331959283ab495dfd231d647dfa9aefa71a0b58dad876112d54
SHA512 2e651622e61874011329d516ce0ccaa6aed7ff88e9a04ba0293b34ad786299fb4156b74276b2072cc83ddfd2d3820629a2eacba9969fc1c1a79b1c3dc2dc2672

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ee821194af6e357ffedb7ad293b2fe6e
SHA1 6b3783558fbd422bc7b9e5d242e5dc26319c21f1
SHA256 a9763e944ba89028c490ecdc19c9838fdd8bde29ccb1bac7b571360cbdfa0bb7
SHA512 391e3b2dd5b69559eabd3a0e1ffa12de7507099b344647908d910d5809e2ceb43bcde1722d86a4b760bf557c8a4cd3ff041dc13b4d64162f665da12d70c3842b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 71011f7cbec6f99e7a29a0eadf88e236
SHA1 c00025d7c3aa33a05f748fc8e8cdb6275a57cb81
SHA256 77269383947a34bd640faff6523e50b51d886651dc0bf414cdf11a2b7a8f26a7
SHA512 2f1ce2e9f04f5368f5c74a141d80f37b2ae5a000a2906774cfd7c5d2d670830c2c5635f43a95a5d8ed18fb8841607239f1123c2a30b90e1fe73a42c67f37aee7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 88de738a97ab6feca0496706776afe90
SHA1 2c90f4c1e6bec9204af7927535bb41d396a35600
SHA256 bc0294a2e5f2e254732c0a9b292147196572cee1eb960f1ea633fc2aa51da77a
SHA512 6f788560436a91da6a0380f5634efd7fe940e16c50133828e6d04e8a45ef64aa9118dec7609006944105c0c0bb87481545a8ef150bf08cc58417d14adc9dbf01

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594472.TMP

MD5 31c65d8a0f4cfd2e963d6b78b65ce27c
SHA1 9f1cc23876c586c90e82dbfbb48e79b5e68447eb
SHA256 99217674a453444c7d50e81fed3403aa6c04f7752968c5007a0e2d21eb4189c1
SHA512 52b9716ca2058294204b31394bdc570c0a01989f90f4ec7e1fb1a2a85c412fee1ddb9fdcccf910df692da720c1ee02441d8d56ea0996682190bd04a15f32bae7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c1839b4d4ed12c53d0cf1858d7578d83
SHA1 7fc42b58f6ec5837c2cd0a038277a62797b8303b
SHA256 afbd677cb1eeb3e5d0f5bfeb1651d20a7af990af7406e26ebe1d53a6bfd203b7
SHA512 dccd16144322af140701c3240a452d3e80b2c27f409e56cf106e4d00b82bc49f99ee12dbf9a7bf70c7a4d72833ff0f6ce855424e40dab84fdfa188ee727fbefb