Analysis Overview
SHA256
1faac4cf8ad8c5d3268daeafe61510c7a5a5922819867cc97a4e05cc6e8ce0a9
Threat Level: Known bad
The file JaffaCakes118_d96958e906d6cab2973e49241b5ac729 was found to be: Known bad.
Malicious Activity Summary
Detected google phishing page
Legitimate hosting services abused for malware hosting/C2
System Location Discovery: System Language Discovery
Browser Information Discovery
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-10 03:13
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-10 03:13
Reported
2025-01-10 03:15
Platform
win7-20240903-en
Max time kernel
150s
Max time network
141s
Command Line
Signatures
Detected google phishing page
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | sites.google.com | N/A | N/A |
| N/A | sites.google.com | N/A | N/A |
| N/A | sites.google.com | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "21" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "21" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c91db30d63db01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb360af9620a04aab70a997bc25d1e80000000002000000000010660000000100002000000061aeda31b36c103cf8d7b3bfbbc94c55405d13dc9bd70e4397fecb789ec7de0d000000000e8000000002000020000000bfabb53f29aafb1822f868b893f4cf2e4e1c41493b62f71affed3df220928462900000006b2fcde786bd7ef7cb4518814bbf03ac59eb10ed3814569674102c2df1aebb8ffe82ba6d604818aecdabeb88eac470ec7fd65a39d3fbfe4c4a9126ec74a535eede3a7b7ec3bb4bcbfdedaa49d74713c20acc20b883acdafa51cc290401a654970c42728efc941d89a8980315525c203a2c02b85f2e885241e684b5f34e62bac4ebaa986e850a8faa64baad18a12e39a7400000005b1d6c422fc979babe0350eafc564d3d6bc1ad0824331585b32144ca75c856ae2c53302a5233a9e0b811898ed9c6185d2138b54650e201c8e028f494dc735b47 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442640660" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "21" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2AF9A41-CF00-11EF-A2A3-4E0B11BE40FD} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb360af9620a04aab70a997bc25d1e80000000002000000000010660000000100002000000065161d869afadb73c50aa97e76c574946fadd3aa6987b1136aa3dbbb1049299d000000000e80000000020000200000000b934f7134054602961c70ce1f4ad6b5b1052c716b86ab38a1df0c6ccaca90a0200000008bfa2e863651abbca56f2bd00f90299f04031ea99e3c64ba6227b80d42a9c17f4000000038d81b429211588cd172628ca50de78fb1922260bdf793fe6bb95a30a28f8b34271d5d09374a43b9101ac48cb78e46fa76c9ae8c72bd07b1553fe858d95adb09 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2660 wrote to memory of 2704 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2660 wrote to memory of 2704 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2660 wrote to memory of 2704 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2660 wrote to memory of 2704 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d96958e906d6cab2973e49241b5ac729.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | sites.google.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | lh6.googleusercontent.com | udp |
| US | 8.8.8.8:53 | i.ytimg.com | udp |
| US | 8.8.8.8:53 | lh5.googleusercontent.com | udp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| US | 8.8.8.8:53 | cdn.ay.gy | udp |
| US | 8.8.8.8:53 | lh4.googleusercontent.com | udp |
| GB | 172.217.169.14:443 | sites.google.com | tcp |
| GB | 172.217.169.14:443 | sites.google.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| GB | 142.250.187.214:443 | i.ytimg.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| GB | 142.250.187.214:443 | i.ytimg.com | tcp |
| GB | 142.250.178.14:443 | apis.google.com | tcp |
| GB | 142.250.178.14:443 | apis.google.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| GB | 142.250.179.233:443 | www.blogger.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| US | 104.21.64.1:443 | cdn.ay.gy | tcp |
| GB | 142.250.179.233:443 | www.blogger.com | tcp |
| GB | 142.250.179.233:443 | www.blogger.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| GB | 142.250.179.233:443 | www.blogger.com | tcp |
| US | 104.21.64.1:443 | cdn.ay.gy | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| GB | 142.250.178.3:80 | o.pki.goog | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| US | 8.8.8.8:53 | adf.ly | udp |
| BE | 66.102.1.84:443 | accounts.google.com | tcp |
| BE | 66.102.1.84:443 | accounts.google.com | tcp |
| US | 172.66.43.117:443 | adf.ly | tcp |
| US | 172.66.43.117:443 | adf.ly | tcp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| GB | 142.250.179.233:443 | resources.blogblog.com | tcp |
| GB | 142.250.179.233:443 | resources.blogblog.com | tcp |
| US | 8.8.8.8:53 | publisher.linkvertise.com | udp |
| US | 104.18.0.75:443 | publisher.linkvertise.com | tcp |
| US | 104.18.0.75:443 | publisher.linkvertise.com | tcp |
| US | 8.8.8.8:53 | stats.g.doubleclick.net | udp |
| GB | 173.194.76.155:80 | stats.g.doubleclick.net | tcp |
| GB | 173.194.76.155:80 | stats.g.doubleclick.net | tcp |
| GB | 142.250.200.14:80 | www.google-analytics.com | tcp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| US | 8.8.8.8:53 | s10.histats.com | udp |
| GB | 163.70.147.35:80 | www.facebook.com | tcp |
| GB | 163.70.147.35:80 | www.facebook.com | tcp |
| US | 104.20.3.69:80 | s10.histats.com | tcp |
| US | 104.20.3.69:80 | s10.histats.com | tcp |
| GB | 163.70.147.35:443 | www.facebook.com | tcp |
| GB | 163.70.147.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | s4.histats.com | udp |
| CA | 54.39.128.162:443 | s4.histats.com | tcp |
| CA | 54.39.128.162:443 | s4.histats.com | tcp |
| US | 8.8.8.8:53 | r11.o.lencr.org | udp |
| US | 8.8.8.8:53 | r11.o.lencr.org | udp |
| GB | 88.221.135.105:80 | r11.o.lencr.org | tcp |
| GB | 88.221.134.89:80 | r11.o.lencr.org | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 104.20.3.69:443 | s10.histats.com | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.19.252.157:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| CA | 54.39.128.162:443 | s4.histats.com | tcp |
| CA | 54.39.128.162:443 | s4.histats.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 18491453fc2fd2cc3ba0c5bb6b4ebaa2 |
| SHA1 | dc8cdd263156146f57a4ca90229048eaeeed2e12 |
| SHA256 | b4a370b2c78d2526d642cf0029d90aaed725c7ea59c5b7df33de830bdd5b8a9e |
| SHA512 | 3cdea648ee88867d041ff0538b0394953d400a48b4b5ccd26adf737083dbf44f3781ea88d3ded0281757e10b9004118a682e9af29052b28d3a2c6d7649e97832 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | 5fc6ec83d0ce1616da8090e121e5fcb4 |
| SHA1 | a1dc0c7cf0a8ae298a4434a9036f7ed03adbed89 |
| SHA256 | 48987d21a25b7b95886240c9f7b2addf32fb430e1b23b02e859bd0fbf7b63224 |
| SHA512 | 0cd9715bef597a108bc2cbe023ea4ceb5f21eaa2f84e2edbcad9b2e8ebbce32b441504ce2e418d84a5bb07b73090072de7d18ae3376dfaf507990ddeccff8945 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | a6344d20d86df78079d49bdf68cba0e0 |
| SHA1 | c64f9b93a5d0a92379337a70f9d8ffb7ecc77b71 |
| SHA256 | d428b48c7602249d84291431214031b997a5cc291f8592610cc1b9a30bcd6da5 |
| SHA512 | 0b9870136ed3763607f3151778a6cbde415fc5230fe0c69314568749de632ddb22634203d95e4189ca9de1444ec69453c1f60a97b9d2aeaa425256ae52e9b00e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
| MD5 | e935bc5762068caf3e24a2683b1b8a88 |
| SHA1 | 82b70eb774c0756837fe8d7acbfeec05ecbf5463 |
| SHA256 | a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d |
| SHA512 | bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
| MD5 | 8ee221fc1064b233484c3f7c5235b21d |
| SHA1 | f49cd89102234fa1ab9a112a6928d3f2a0993747 |
| SHA256 | b77fb95c91e04f6db2c030c0eea6e6f5f4fc22527eb64e4b8f88b7ba5f8cb851 |
| SHA512 | c5160a6865fe53988b7cd156de9ae54365fa6bfed6a960604f25d7928f5cba9d7454ffa5810450ee9794ed112d8abcea410e01c83b7ec7aeecadb24d1bb24003 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
| MD5 | a0487189d5f2af3530af6c1fb21c56d6 |
| SHA1 | c0433df6695230eb2c65b3502763b97551a97d77 |
| SHA256 | dc9674942e474f566eb1f2b932ac1837a1e63f6580b84d34d0f0b75009f4743c |
| SHA512 | b2832021b3583243d6848dbdf4b3a3144c08abecc5d852b93cc1eb434d6f7b7b6d0a2792f475513c66d7cacee2a845b1d0de6c7145fda035884711a7ecb37bb5 |
C:\Users\Admin\AppData\Local\Temp\CabEADE.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
| MD5 | 1124a1c744138f1a63d4ed0699bf3761 |
| SHA1 | 8464ba0d13fd089b346e07f93fdf772937360da6 |
| SHA256 | 2fc83a4802b98c01f7a3a56afd7c0037e276124f57b1301a35ac56fbed00322e |
| SHA512 | 1df2405a2dc74a7fe36e919af6e02aff487d2f313e5dedc79b05ef443105a78208174a4b0463a756d10e3c47d936b99465e7873d02b52430f897cdc71aa7dc0e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_DFB78462C65FAC2750B89E1A8A1F9A53
| MD5 | 49c9f12014d8f3d433b090048e7e4fb4 |
| SHA1 | 6f9b6242bc9165e012e09fd3ea65753780d2c8e3 |
| SHA256 | e4afdd47f9a9fd68d1431bed1a737a0c9de974df8086a93df80b87942b991d1c |
| SHA512 | 1b34782341afb1e676e27a018415b3f860142efa9e2f08a4ef74077a612e59c44f2fc027eaa34289a70c79380fe62aed1ab49d3bba8020c3572288a6abba2a41 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_DFB78462C65FAC2750B89E1A8A1F9A53
| MD5 | 448fe5f76a909bc1299d42b10e2ea376 |
| SHA1 | 769ecdea5641f149939b94ccb8ba04a84ffce42c |
| SHA256 | ee85a9034e47062eb66c5047e0793be7e3010ce383ffa8f628be0d1c89fb3634 |
| SHA512 | 4be280bf1f36103c223526a5608def81921a60043f080492594736599fce4ca66e471995c84b770b5e5c0bfc3937c5c6de145fb2b8ed5f5b62e157c91b0d43df |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_DFB78462C65FAC2750B89E1A8A1F9A53
| MD5 | 8377e945af5dfa56e8d7901c984babb8 |
| SHA1 | b6afdee24f70d21f0c07b704ecaa3129156e2c6b |
| SHA256 | 459bccb899957de6ce39f5d67e800ced58dec08bca2d57c3a29fc456cc59a314 |
| SHA512 | b66d2ffbe8d4e165eaa35a877dbd9c08e9e65b329a552c0ba14f11f3305a5c161ac1e16a6ae3a7539812c00446888bbb4b79352e48c97843927b9c7ade18baf6 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\ga[1].js
| MD5 | e9372f0ebbcf71f851e3d321ef2a8e5a |
| SHA1 | 2c7d19d1af7d97085c977d1b69dcb8b84483d87c |
| SHA256 | 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f |
| SHA512 | c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\plusone[1].js
| MD5 | 06f5699c1728d6915b166fe908f1f479 |
| SHA1 | 6fe929111f9715ab4b3aab9a940b6c3908250761 |
| SHA256 | 3a0414e021f7b69d5dfab91563b7b88d93d0584c26a6ba4d7614e642ba774a03 |
| SHA512 | 9ec15f17e0385a767bbd51206d20185f165124acd2c64f571a4d952aaf3dbf262bc51e27ff364121aa7dce24aa805093d6da2d93311b3df693a3ef4e5e4b5fbb |
C:\Users\Admin\AppData\Local\Temp\TarF156.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 206252ae35a36d5fa61b6fbdbda20d2b |
| SHA1 | b31b17257f0a16d687daeaae8f58e00c86d7c2f1 |
| SHA256 | bce89439e8c2b82652c974b177a3b1104e47683c4ed2df441a7d1f3d10d67b9d |
| SHA512 | 13e95d9c0d8225f1c8c6d0aff32bde4b6634d951ebf8e77ffb9c48190f05cb84f943d347174d6d9b28949751f131f35eec70d9b75d88ac1a104cc538b7ef2ae2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 10fecb34704c43e7d0546b6d9a6ce3b0 |
| SHA1 | b1051f2700c964a6f8a38ee70995603a557700dc |
| SHA256 | 7ac997d15485f54e4b79326d8249b4a88df97ed3c6f56f881ae4696f4dc020cb |
| SHA512 | beedb5929546863ed69f90998caec335b2290d2a6bb201d9f6864f1ecbca90dad056e6d111e7563b992964fab7420f285b697f760c17b03441c8cc698eaef3fa |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0I0VVMWQ\m=_b,_tp[1].js
| MD5 | 8e974a1c8adf8ca30595885c9b523063 |
| SHA1 | b1df5f0c61d470270008eb435835d49bdd38ef55 |
| SHA256 | 4292b7548789ca2718f56298836b37e50f39b94cf74ef2002a973bc5bb98bf3d |
| SHA512 | 0ec3a7c5572908e3014003bc418fce9cdfa6b7965c4c3419ab6e1a48e972e3ca191cdda1a5f0a4392c4a7605b6d178e6420b2021033f805fd9f7a009da5da496 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\m=VXdfxd,fgib1c,YwHGTd,pxq3x[2].js
| MD5 | 0212f84f9b3c279098932d83a43b6448 |
| SHA1 | 22ef0e934187e4a4bb70bce5a59e7eed3e45e82b |
| SHA256 | 9dffee8e9e10ba5883b18f8f0803e06bcdd3751909cd3a2ad48195a33a4132c9 |
| SHA512 | 846ab48914f0d202bea88b83a3c81772dcd4a1afa47d3641fc8be2649783441def213b18d1fa82e58e0a3b699592d2be8421c6adb02c0d7f679f615b378775b6 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01LB6K3J\TDV9HG77.js
| MD5 | 8e3ba669c421e761e60eba68f5ee948c |
| SHA1 | 9e42c2b2b44a57d5d4c22cf4d757f4f94f5c37df |
| SHA256 | ca9dc915515e1173eae06f352f983247bcb4480c60ed3b7bbd98e0e58f5a6e31 |
| SHA512 | 9cc1a4f0879511c959b871fddf3743793fa730cb7f89f27828b6b0c29db560e486b3828f421fa3f02262da490122d75573356ffc86c00cb3d56f0c38e72bdcfc |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\recaptcha__en[1].js
| MD5 | 19ddac3be88eda2c8263c5d52fa7f6bd |
| SHA1 | c81720778f57c56244c72ce6ef402bb4de5f9619 |
| SHA256 | b261530f05e272e18b5b5c86d860c4979c82b5b6c538e1643b3c94fc9ba76dd6 |
| SHA512 | 393015b8c7f14d5d4bdb9cceed7cd1477a7db07bc7c40bae7d0a48a2adfa7d56f9d1c3e4ec05c92fde152e72ffa6b75d8bf724e1f63f9bc21421125667afb05c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e7e1ff2b0b97d4721da41a6455aa5b2d |
| SHA1 | 30d46b5a69f1c48f901f1fa6082d5bed5aec3873 |
| SHA256 | 4258d9996508f37c2b699d5f9ed85deb2759ceffc2db9363a56ee91ea1f35e10 |
| SHA512 | ca89240c3fcb62c00b7371634c96fe5908f3ff7cb819b91d6dcb2f03d56c1e2dc5dae0c92da04fd1df4a8ebb95dc6414c42e9fe7677590ed2c95a35adedb1327 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5a04dd5679cf1c2e7581f2a4488feb2f |
| SHA1 | c1b4c59d059b9ffe96a3ae056f282e712953737d |
| SHA256 | 15b443fbaf0bae282d2eab771648560b622f7f044c5d4e3ead5b03a91c3a2fb2 |
| SHA512 | 7e65f4c0bec420196735adea60302dd796effd5673b56ae1dfe1e8e468ef626f27f9dc643adafc1583decbfc062aecd33ab54447e4cf5bd5374e22de036c41a4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4e3df9653e214f4725e0536ce5a7cf4d |
| SHA1 | 043ac48ad08f46861b9cfb00facfe798d03973c6 |
| SHA256 | 0d3273120a3ce53b7f555ab35c80206affb1c55215c259c333bc3caaf6b09753 |
| SHA512 | 3c737a48044c10bc5e5e3d9ebf07e2f08b4323c3c83d21a729cd10fae2c874a90c614f1405f4075238037909197e0df0bc3ad846bbff233c302dbc63b632bc3c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6aeef7d4a71c4b3a571a3363ca34c463 |
| SHA1 | 74a6f8cb2b6c9f81f469a468814f6c7c5e9057ff |
| SHA256 | eaa72253c02223ce509af83083f22814e9a6a45484e91868f8d2c7a2a50a9570 |
| SHA512 | c14985a1ee67bf63956de2067b22340170de06059303d7d23e19e6dcffbac4d7ede15f9b1320a7a7c3c01dfe89951364c2606a9a6b8aca56952961271a25ff5c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cbf52f0f6f447c4be292ada6d33911de |
| SHA1 | 81249a29ef0e70f8aeefb60edfd56b213367a84c |
| SHA256 | 49ee2de8ce5b3416b7f58c1cf86215f3d9c622b93c82b0a4fe1adb2caf3d200c |
| SHA512 | 56a4bcdf29f1fb08dc7725cd2f47fc88f6979b2a9463a35cdd52f4dc255eb9599008c72e05679fec02373299c0ce66e943b55eb0c86a58ea82ccb055e2d1401c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1c63013c3988f12245b7fc7adc034d73 |
| SHA1 | 4236c76ae5414aeceee29898e081d51aa38420e3 |
| SHA256 | 227c7fd5b8d60b0bbf6bdb174fea0e11e616c2c26c98d979303373d82d604c3a |
| SHA512 | a720af0dd1e6a7f0a6e6948b61f20f8cd99e3f27119e5f840e0d79def793252e2173b7cb262447aed9ffec3d61dccda2c1a89456d65d0f6bb5b0b20a8918c07a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a175fc19d0dd7079dd6f8a87cace2a9c |
| SHA1 | cdd868c59a9066da49c558cc6640279fb015f33f |
| SHA256 | 0c08300511e0de01a55f712f543b1e48596c50333a59ecc9d3489b540d28a77b |
| SHA512 | abd57ab33b5c9bb1dda70073a79a8d8326c594499c574f670ffa66ef78a0b0047eb7ac827e8ced25b08d32acc2f76525cb28f5df9e1357084d7a10711914e199 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cd0058abf514b27cbdea2c0a77d90afc |
| SHA1 | 6394e95dab150435c437b68ea257eced6fae50ab |
| SHA256 | 00bc24695c63d4481de14f0a22768d54432f9f9b9b95c385ab5eebbf5ba43532 |
| SHA512 | a0fa6a70dfc88c310ddcc6f2adc9e7817bcc53011c193bc9382c86aea5f36da0443f4c8ba87d3b6889a71db59b4754e34e7bb3ee1afd791435a6fd55aaf505f8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f074f8e9f60aac7e1893725ea6115cca |
| SHA1 | e11719c6d3873e5e8a3baabfabb0106d28d33899 |
| SHA256 | 45efa53a2cc98f37ac23d6b9e208e4e6cefc872012efa11964bcf7c6a318c582 |
| SHA512 | c4841065ddd33a35f2838b84ff97bbb9c5cfa91086f68b2a2561cc334ac2421eab9942f0769a7eb216e2d41027091d74cbba0de2da18f529d7f5bc13eeeb792a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d456b91fda767318c0247ad0da5daa31 |
| SHA1 | 717e532feba1a926459af859b592667682ebde8d |
| SHA256 | 68651bea233cf5651cc6f6d400126fcefd99fbe2da275232b3371726860f146a |
| SHA512 | a5529752ddb19e79a37d0fca9469534e7478d3d3ff3dbfad5472284e7d4164a22fdc5e79d3c9d52f9bd74f17bfc1c73cdd75b7b2a5b2e20ed11a485bf2d614db |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e1760f7e1a34a2de6c951c79bedf16d2 |
| SHA1 | b0bd8beb94069c36c490ee258cd7a201686de63c |
| SHA256 | 9110245fb2f190771ec4cbc3dd501f36bf3d21217247c548d0ca211eb29fb6a7 |
| SHA512 | 114bc2f42e2f661577a36ffc2bdfb5e7e8fa4fadc158c342286322a6acacda05235f177edaef2ac86e62bc1374175d41e27a0fac0db0b7fd90b6166611395af0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 363fdfe55f4b6fbc9a445accead21c6c |
| SHA1 | d3a073342a9a86f98381b8b1a71dda072b2295e9 |
| SHA256 | 024cffd804db13714edabc3278aa0a7ccdce45338f7bf398299d1350fbf28dcf |
| SHA512 | ef83e72382fe01ef1bfd95fabc28c291aba51776b49262298fc0568d8faeaee47658f2c4a38ad6aea2864854e8e3a8d4acbe1b297996d0a0ef9da104cd3683fc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 48fd1c87db0850e3833e86f614e08562 |
| SHA1 | 1fbe4caa9e81aa826bf8dd7cfc533d495f956686 |
| SHA256 | e9b8fe97abb0dd77faeec81305795a84dd0b36005c7e2c9a3fd3c91a5a79fb85 |
| SHA512 | b4ed0b7e4c607278e8f97a1f88a21e2a6741ada550589241943c68b6350cb0fc2dd3c9cdd5502ba16fe7e09a7909e63fc99f60349366b50cb3ba2171da09d191 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b178f84985ef68f689f3e1c48f3ae9af |
| SHA1 | 58ef7492c2b0b7d5e70acb2dd33a9bff71a1d5f3 |
| SHA256 | 3655f1f78736f9e2309298b3759ca1d879be6ded222c5a9226231a7f42885630 |
| SHA512 | 3764a3b156d50193f872bd2a56e5cbac591ba9ed6c43fe0b520529060bbff0d955497200f9058bda22bec4d3bf1aea28534c29c50598e34232f8bab7982f123e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6f4764388f63337738a618127569dc06 |
| SHA1 | 88f67b671c464ceb67134064cc1a90e916831c41 |
| SHA256 | ac0c24ebf7bb5a066aff29d2a904c57194c44a87c132a0c49f081ff42839e7ec |
| SHA512 | 16488367d3c2f6afc0abff40774eda44b37ca82e0836d32f2f0574980d4f8e63d35c292c2cb91a0531f4a74d89b6527f06c501f936f6d3de5140f04c53b10f3f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4f10443b2ece0dcb7c874e2783c83464 |
| SHA1 | c1e2fca17c56f9a2d910d52bb4db11b403795ca8 |
| SHA256 | f2c55e9e959289d57d4ab3babb4efd6b24222f2928447de7399e6dc95ee7072a |
| SHA512 | d0c70d602c430ac242f412da8790deefd4915aecfa5275d9e08b7f1cd31df365f26d23aaa949640b48a48d2ba80aeaae98ad655effcdc027938bf4a751b041df |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c6c471451d4204702d10a316e40b148e |
| SHA1 | 46df394c825bb9d17977604fc6b21c40ede2243b |
| SHA256 | 4461c7a23530692c6ccf2d75a7e4fc3470e08834b8a7f23d9f9f6d1e33422a86 |
| SHA512 | fe276d2a4fc4f43bfa884b4fc3ca166b2ea94feb95ef14dea99b30186b29ad709196b74b7a2326ed809b747796dcd56184ba3428b0d3a495c064c71241ffb437 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 4145f87a19f8edbacf3b64a445867cdb |
| SHA1 | 664246affb676c629e921cb23fb9546413a98c56 |
| SHA256 | 646386b776632cafdc440c3c2a38f4a036ccc135b647d347036be3c01ad535a0 |
| SHA512 | 932a5e05764e13c56724f06fc2a87cbfde65d96fab92e49c979b12ce6aacc5ed6e650eeb648de944af5e72eb1884b725b6c25892409328afa181985ba9ab0b50 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cdde8782ba38733c9542926e5daccdc7 |
| SHA1 | 3730d0727951ec69e0f15426cee5e1cd19113aca |
| SHA256 | 4007fcd67d9beab541413cb8ecd6188538aafea30e7aa3f3ce2f520aa9cf2ed3 |
| SHA512 | 84f6f9f419ea1c63a25ba07de87a57e7f1e288facbe4a28be7b111b458849597dd5199fc82f740802b6801b266de7801442ea240ab30e9866ff8d01a0de9c6eb |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 148e20d222b4958c2ddd2d4036f6eb0e |
| SHA1 | db6169aa4af7ebf57a44635bf35061eb7da24f83 |
| SHA256 | 5d085f37c66e3d64f5a82977f1a36a4fcb86e4b31553a704798cc74189943ec6 |
| SHA512 | 9df8ddb0ecb0c42bb41251753024babcd27059f82b365f91b6d273646bceae18d13a5e500034cb158dfd21b08b9fb9190336ee08b92ce63e78fd398a3a2b2aca |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e50735a07bcb8bd86d2bf42a26287587 |
| SHA1 | dd4c6a9c4ae618d48ab8577b9a4e7666bdc61de2 |
| SHA256 | 3427f3ca5a806e25c8f4dc74bb467390970e9d90fc640285a62b43e723c78908 |
| SHA512 | 9e53f2fec8b2f6fc0ec2d9d125d4e0838a0b6e182e6878c26aac0496c578b2c4440ffefc9173e2e45d51359533bf9642ca9617be8cb96ce3fe596e36a82777d9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4e222ea7df3d8ade58686df3691a3954 |
| SHA1 | c401dc454da3c5794966130a873255eaf8fb3d7d |
| SHA256 | d78fc2203acac0772e2a4b1dbbc7d0886bf04d918d854d1a592db0ea9bea0f35 |
| SHA512 | 3c5f479ae3d5024c2712551c3bb85c3b25a50bf9ac1e26d352a9e441f3f040555247ab155bd9a17de0feca567d4abe998482f01615a78f00aaaa8c64d24b5604 |
Analysis: behavioral2
Detonation Overview
Submitted
2025-01-10 03:13
Reported
2025-01-10 03:15
Platform
win10v2004-20241007-en
Max time kernel
147s
Max time network
145s
Command Line
Signatures
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | sites.google.com | N/A | N/A |
| N/A | sites.google.com | N/A | N/A |
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d96958e906d6cab2973e49241b5ac729.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe9e246f8,0x7fffe9e24708,0x7fffe9e24718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9479980560231227002,10244925751961420562,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5260 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| GB | 142.250.179.233:443 | www.blogger.com | tcp |
| GB | 142.250.200.2:445 | pagead2.googlesyndication.com | tcp |
| GB | 142.250.178.14:443 | apis.google.com | tcp |
| GB | 142.250.179.233:443 | www.blogger.com | udp |
| US | 8.8.8.8:53 | cdn.ay.gy | udp |
| US | 8.8.8.8:53 | lh5.googleusercontent.com | udp |
| US | 8.8.8.8:53 | lh6.googleusercontent.com | udp |
| US | 8.8.8.8:53 | i.ytimg.com | udp |
| US | 8.8.8.8:53 | sites.google.com | udp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| GB | 142.250.178.14:443 | apis.google.com | udp |
| US | 104.21.48.1:443 | cdn.ay.gy | tcp |
| US | 104.21.48.1:443 | cdn.ay.gy | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.187.246:443 | i.ytimg.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | tcp |
| GB | 172.217.169.14:443 | sites.google.com | tcp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| GB | 142.250.179.233:443 | resources.blogblog.com | tcp |
| GB | 142.250.179.233:443 | resources.blogblog.com | tcp |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.48.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 246.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.169.217.172.in-addr.arpa | udp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | udp |
| GB | 142.250.200.33:443 | lh3.googleusercontent.com | udp |
| US | 8.8.8.8:53 | lh4.googleusercontent.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| GB | 142.250.200.33:443 | lh4.googleusercontent.com | udp |
| US | 8.8.8.8:53 | adf.ly | udp |
| GB | 172.217.169.14:443 | sites.google.com | udp |
| US | 172.66.43.117:443 | adf.ly | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| BE | 66.102.1.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | publisher.linkvertise.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 104.18.1.75:443 | publisher.linkvertise.com | tcp |
| BE | 66.102.1.84:443 | accounts.google.com | udp |
| GB | 142.250.179.233:443 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | linkvertise.com | udp |
| GB | 142.250.179.226:139 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 117.43.66.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.1.102.66.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.1.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 227.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.187.250.142.in-addr.arpa | udp |
| GB | 142.250.187.196:443 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| GB | 172.217.16.225:445 | 1.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| GB | 172.217.16.225:139 | 1.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 142.250.179.238:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | 238.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| GB | 142.250.179.233:445 | resources.blogblog.com | tcp |
| GB | 142.250.179.233:139 | resources.blogblog.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| GB | 172.217.16.225:445 | 2.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| GB | 172.217.16.225:139 | 2.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| GB | 172.217.16.225:445 | 4.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| GB | 172.217.16.225:139 | 4.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| GB | 172.217.16.225:445 | 3.bp.blogspot.com | tcp |
| GB | 172.217.16.225:139 | 3.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 142.250.179.234:445 | ajax.googleapis.com | tcp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 172.217.16.234:139 | ajax.googleapis.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 37f660dd4b6ddf23bc37f5c823d1c33a |
| SHA1 | 1c35538aa307a3e09d15519df6ace99674ae428b |
| SHA256 | 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8 |
| SHA512 | 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d |
\??\pipe\LOCAL\crashpad_804_FKYIMCWEMBQSZTDT
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | d7cb450b1315c63b1d5d89d98ba22da5 |
| SHA1 | 694005cd9e1a4c54e0b83d0598a8a0c089df1556 |
| SHA256 | 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031 |
| SHA512 | df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 77bbe505c515b77d6e7b51f27e60e2c5 |
| SHA1 | 5042d18aa87e7ade58817b7174b0208a0c64c5f6 |
| SHA256 | 5447431de118b35093e3119fd2157fc1c2e632b95722d05ee7206d1ffe53a980 |
| SHA512 | 1551678d8399521a8c7a75b8e264a7ac9de9a9441add5630bf06314237396e6237c25b7804fe63345086e39cbb88aad074079aa976687cfdcbecf241571c04c7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
| MD5 | d79b35ccf8e6af6714eb612714349097 |
| SHA1 | eb3ccc9ed29830df42f3fd129951cb8b791aaf98 |
| SHA256 | c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365 |
| SHA512 | f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 5aa395f7e316378b6a3524e2b8d6f49f |
| SHA1 | 4ab342db3aaf5739a4c13930f13f994eb58b7f9c |
| SHA256 | 80523cd4afc494d90dd9c3d8075f6eb7dd26195f05668fdfcd2074628fed239e |
| SHA512 | 67f2893d603892d9f9fda73b6d7bc955a6cfdde5c62095181176f6375c0f2b41c524a009b53a0abb3d07fc732241b8dd72f7202a265c3bcb7a2974d665d4501b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | ebc932695c9188d7c0eb64190e5b457c |
| SHA1 | ae0eaa6ab7f09e7251f4f70fea7d2f9c24246d78 |
| SHA256 | 5860ae463f22d7d8b0d7e4441756dfb62c969d2ecee4a66c1c253fa764c783a5 |
| SHA512 | 5f4bac38d945c9f3c8056f8e84f59cab7d6b4ca1b4aa52a03db2635f79edc21abd3a7be330a4e85fbcad23cd3ac7e09ffa42d1edb6fd04ef3ce7ed716f163aa2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 219127cfa9affee0609cbecb32f22f3e |
| SHA1 | 7cf43250d8317f0449f04e092d8e72eefd10bab6 |
| SHA256 | 253acc75d0b1bddbcafe3a6b6b89efd422a985b8b317b901b2947067dd4cf73e |
| SHA512 | 724958217c3110a82b71ce1f197a6f9cf3187980f090cc02d55338a4cf99a296a91ad2dfff8d1254d745baf2165cc917f411d7a0fc66a0b71143d328ff529654 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 7e9488a69cb07759c64ae5d8bc2bf847 |
| SHA1 | 1ee1b671b2a8ac7318c35fb36ff2939850230a2f |
| SHA256 | 466e47f66d5fcc3184ea8d8b47092348d1436278ce7a45337a62dc72375df114 |
| SHA512 | 9ac1d4ff6bc04bb2e42286e29786a0801d963cf5c69c3f4785730e8221d850f0a7973b40f041c011f33d1022b69c448fe7abe82033c47d111b89e93e44b3ea9c |