Malware Analysis Report

2025-04-14 00:32

Sample ID 240601-w3vmksbg55
Target 8b5bc12c3fce305a84f0ce93e6de5662_JaffaCakes118
SHA256 365d2b20a36c534d36a24821eb4041441296cbc24f550a432a9c4f7dc05b5297
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

365d2b20a36c534d36a24821eb4041441296cbc24f550a432a9c4f7dc05b5297

Threat Level: No (potentially) malicious behavior was detected

The file 8b5bc12c3fce305a84f0ce93e6de5662_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 18:27

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 18:27

Reported

2024-06-01 18:29

Platform

win7-20231129-en

Max time kernel

137s

Max time network

148s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b5bc12c3fce305a84f0ce93e6de5662_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423428307" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9489AB91-2044-11EF-9E06-5628A0CAC84B} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a5348251b4da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001fbb8d569926f04991a05cfb07d0171300000000020000000000106600000001000020000000ce6fcb085a609977b63f96f2dc23ad1193bcdefbf8c38582e7530fdc6ebb7399000000000e80000000020000200000004e2e7823dcfff89522d598d329d0755ce45fbb8c35dd12825fc30583be8ea4df20000000dc563b537c36b191c2614f8e4a7635f2a781bb4caab724571ad98018c5ad5ea740000000f0094ff737899d2c9d4637c58c2aa3c76b7706627b42d712dd029278a03138bbc619497da27058faad1373ab9d46dadffc5c578b4a047f044e0dd7f97e82ba45 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001fbb8d569926f04991a05cfb07d017130000000002000000000010660000000100002000000017d40f0e5a75b7f263e180b509df1bba2cca92c8415a55bd47009c35c2297e41000000000e800000000200002000000033e4910d67283dc74e111a88b067c959871b2327653e00767d1a2b1de2edfbdf90000000728784460e0e48d290764e55f0465ccbb5c39d8ca99a03afce70b6ebbd27f4c649c1bb8f38772813a20b6927d19fd903fffda34e71fabdada560fd7fc06771f080b9a14bac27e8aa047825755a2318248f83cf0fc9b469a239958433062b7434e3e2c0da4eb889d8ba33799e3d0655986d8c6f78db0f87876b05802cfa8175007df86f2508b94d61dd9096ea6ed66d0d4000000092126584af4665f4a0fd8b8f8a2ddd613ab18a42f346800e4bf1faca39aee6e7eb60f1c45c440549f6fb1a31e40bbb9d62a544472c1e12dd61389732465e688b C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b5bc12c3fce305a84f0ce93e6de5662_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 farm4.static.flickr.com udp
US 8.8.8.8:53 www.michaelhaeuser.online.de udp
US 8.8.8.8:53 www.autointell.com udp
US 8.8.8.8:53 www.otomobiles.com udp
US 8.8.8.8:53 www.fiero.net udp
US 8.8.8.8:53 www.takemetocuba.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 data.mactechnews.de udp
US 8.8.8.8:53 www.carstyling.ru udp
US 8.8.8.8:53 www.avto-magazin.si udp
US 8.8.8.8:53 file.vustv.com udp
US 8.8.8.8:53 gallery.brit-cars.com udp
US 8.8.8.8:53 myautoobsession.files.wordpress.com udp
US 8.8.8.8:53 www.toocool.se udp
US 8.8.8.8:53 images.travelpod.com udp
US 8.8.8.8:53 img38.imageshack.us udp
US 8.8.8.8:53 www.cartype.com udp
US 8.8.8.8:53 lh6.ggpht.com udp
US 8.8.8.8:53 vintagereveries.com udp
US 8.8.8.8:53 img1.blogblog.com udp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.200.14:443 apis.google.com tcp
GB 18.245.160.68:80 farm4.static.flickr.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 18.245.160.68:80 farm4.static.flickr.com tcp
GB 142.250.200.14:443 apis.google.com tcp
DE 46.163.120.248:80 data.mactechnews.de tcp
DE 46.163.120.248:80 data.mactechnews.de tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
DE 217.160.223.149:80 www.michaelhaeuser.online.de tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
DE 217.160.223.149:80 www.michaelhaeuser.online.de tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 192.0.72.16:80 myautoobsession.files.wordpress.com tcp
US 38.99.77.17:80 img38.imageshack.us tcp
US 192.0.72.16:80 myautoobsession.files.wordpress.com tcp
US 38.99.77.17:80 img38.imageshack.us tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
DE 217.160.0.192:80 www.takemetocuba.com tcp
DE 217.160.0.192:80 www.takemetocuba.com tcp
DE 5.35.225.160:80 www.autointell.com tcp
DE 5.35.225.160:80 www.autointell.com tcp
US 13.248.169.48:80 file.vustv.com tcp
US 13.248.169.48:80 file.vustv.com tcp
SI 46.19.9.226:80 www.avto-magazin.si tcp
SI 46.19.9.226:80 www.avto-magazin.si tcp
US 199.59.243.225:80 www.otomobiles.com tcp
US 199.59.243.225:80 www.otomobiles.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 172.217.16.225:80 lh6.ggpht.com tcp
GB 172.217.16.225:80 lh6.ggpht.com tcp
US 45.79.0.147:80 www.cartype.com tcp
US 45.79.0.147:80 www.cartype.com tcp
GB 142.250.178.9:80 resources.blogblog.com tcp
GB 142.250.178.9:80 resources.blogblog.com tcp
GB 145.239.252.65:80 vintagereveries.com tcp
GB 145.239.252.65:80 vintagereveries.com tcp
US 8.8.8.8:53 images.travelpod.com udp
GB 18.245.160.68:443 farm4.static.flickr.com tcp
US 192.0.72.16:443 myautoobsession.files.wordpress.com tcp
DE 46.163.120.248:443 data.mactechnews.de tcp
US 8.8.8.8:53 7seasproductions.com udp
US 69.163.225.91:80 www.fiero.net tcp
US 69.163.225.91:80 www.fiero.net tcp
SI 46.19.9.226:443 www.avto-magazin.si tcp
GB 145.239.252.65:443 vintagereveries.com tcp
DE 217.160.0.225:443 7seasproductions.com tcp
DE 217.160.0.225:443 7seasproductions.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 cartype.com udp
DE 88.99.208.67:80 www.carstyling.ru tcp
DE 88.99.208.67:80 www.carstyling.ru tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 45.79.0.147:443 cartype.com tcp
US 45.79.0.147:443 cartype.com tcp
US 8.8.8.8:53 carstyling.ru udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
DE 88.99.208.67:443 carstyling.ru tcp
DE 88.99.208.67:443 carstyling.ru tcp
US 8.8.8.8:53 avto-magazin.metropolitan.si udp
SI 46.19.9.226:443 avto-magazin.metropolitan.si tcp
SI 46.19.9.226:443 avto-magazin.metropolitan.si tcp
US 8.8.8.8:53 myautoobsession.wordpress.com udp
US 192.0.78.12:443 myautoobsession.wordpress.com tcp
US 192.0.78.12:443 myautoobsession.wordpress.com tcp
DE 217.160.0.225:443 7seasproductions.com tcp
US 8.8.8.8:53 lostwebtracker.com udp
US 8.8.8.8:53 green-tracker.com udp
NL 95.211.75.26:80 lostwebtracker.com tcp
NL 95.211.75.26:80 lostwebtracker.com tcp
FR 35.180.146.158:80 green-tracker.com tcp
FR 35.180.146.158:80 green-tracker.com tcp
FR 51.44.36.204:80 green-tracker.com tcp
FR 51.44.36.204:80 green-tracker.com tcp
FR 35.180.146.158:80 green-tracker.com tcp
FR 51.44.36.204:80 green-tracker.com tcp
US 45.79.0.147:443 cartype.com tcp
US 45.79.0.147:443 cartype.com tcp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 accounts.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
DE 5.35.225.160:80 www.autointell.com tcp
US 69.163.225.91:80 www.fiero.net tcp
NL 23.62.61.106:80 www.bing.com tcp
NL 23.62.61.106:80 www.bing.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24

MD5 bd807e0149f1b0f95b42e754c83cd963
SHA1 d82968038f5419e0b119a146f97ad703afce5fd4
SHA256 de8e3b799efbb04f23f18b00c222b738b9317592ae78a6a5abcfd7b90d8be055
SHA512 d69e9a80114bbe663527c61a11807c8815bb0232913cfc29e972ae5aae7bef779a07165b40c145358dc7cd2e5fd92efadaa0274dd3e9d91422b1339bbaa10207

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

MD5 3e455215095192e1b75d379fb187298a
SHA1 b1bc968bd4f49d622aa89a81f2150152a41d829c
SHA256 ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99
SHA512 54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24

MD5 582fb9e4edb4930382a8ab00c81a7d84
SHA1 94bf28eb434b6c5b5219237e575b701b929e1e73
SHA256 8f6acbb6686b5bde295693f790b46cd8dfa774c243a8387ba4d4126b261f759c
SHA512 f4b4ddc2f582f9d392ba8cb1f5fcde0948066810e50cc78353f134a1503689713e57f1d35786c33d72ff2542b1543a6936db86f044bdc375436b8cc58a91cb60

C:\Users\Admin\AppData\Local\Temp\CabFD9.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dd65fd72029c04ff9a54ff5b96b754bd
SHA1 db032189415faa297c9b5e3cb6433b34e0761732
SHA256 2ebe9e764b5781b91ae2ac0e4fb8861a0dfa04d2e87bb1f0006f5d35fa98144c
SHA512 5358713c2c52870eb2d71b1e0c25b6c05668ccb488399a139f0345e83c44e9dfd166f20fb4fc8a5ae58a4662a4174e1fca5a2ce1b3c6eadbf896434900725061

C:\Users\Admin\AppData\Local\Temp\Tar100D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d703724ff452cf94c393cd061f1ad730
SHA1 0fceee0a2baf9db2bcb62de42adb4b405a390ef8
SHA256 318f60462a5adb8d13b8ecd4b2906719e034d2425f345d2975afc2d855a52dac
SHA512 aeb0aa929fd897ea90080ef54392f4c304e172e02c55f12529cf887a077ba6371dc3e704be0ec424adc19563e8e0a5004a25fa3ec26ebb9030c172876f20851f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 85fcfdae7460553b0b26555c2b9f767d
SHA1 8ab05825a2e9f2b470be3ab0e68705de8c5e5f9c
SHA256 9e28599a2db0970b1c2e39b68d7a8a9ea7cd209d27739a7367d4e5ac5b992762
SHA512 74b2a11c8188b2df7cb71b27ef05ac1dd4aec3b1eb017c4e347a346a97610d681ded4b96b7e6cbd456bd8fabaece7367cfbc4e64dceb02da8603f85ac5824556

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 65dfa629c6a63ad3bef0e08585b8538c
SHA1 75b9cfc9b6b172dd9783535257e315d639736547
SHA256 7c96eff5230328aa9156f050aa2af3375f0c089bd4633a5512e9ed8e5deaeb41
SHA512 b1a4df8007f51ba3c7b5a8221ae513dae5f9708c21100b5deb2248546186c96fd1fa32fdda064c502efcedc747824bed2f1f675ecb68ad78b51b80c2ffe9560f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 257ee64b241a88c008c41f03a86e48b2
SHA1 f1024111b9e71f2c4e5550552855d0426bfe8d28
SHA256 56843dee50700a82b57b33712deb6774c673a713adf79890cab846e8aa39bb16
SHA512 323faaf630c2b385c8e60ae4b4d72e250452dc5a2c3f438a5f04b45478da6c7cb56b149fa9b8ac692750bb3e31024d4df22db4944fa199ce28a06e3ee639bdce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 291c9857518bd4792d1274b23f8b2c78
SHA1 3d92c92c5ae9fd8e740cc27911a5c75f76a2c574
SHA256 d42d3908687462e2b5e507f06250183bfb338c99482f86b6cc98bb54da63daea
SHA512 75dbd19e1ed54cc51255cfacdd5ba4780378f86072443984ca2ab84f1f30513009945d7984f8a24885855ab5cfbc6195127c9075acf55fae926a75775b002a25

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d00b529400071524b3663952fef6e154
SHA1 5f7531c372478e4706366704a3fdc1ef4d79a871
SHA256 4daae7be78fb76478fbceaf41b3e2c752ce489048ad8607a3db77039c32a66fb
SHA512 0512dc85d5164196eb1da61efc32210c29fff274b6ee57c7fc470d81740eea35cfd6306358d107ef8862c901bd85fd1ee5bdb241b9dded106031a0385cd260df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1

MD5 ebe9fff245c12f154e546da1ad738f90
SHA1 633d7e9d0afedd2e9c6a5c2503ed176191aa8ea9
SHA256 83ad8e030a9b9a79f55dba98cb05e2ddbd586e53432bfdb7e6960bd5fce53268
SHA512 0859f186aeb61119dfd40633e9110157e3a125a01cefbb4e326615fe6d9fd1abbb1e42cf3d98865920d5bf9c6e92fe4c056a8249492581334f7c63446b5e8179

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 09a0dd45563350ee7fa40fba4b9cec4d
SHA1 db329c6f5e3836414f7596ff4c5040cb34bd7eb0
SHA256 1294006677a6480f7f75525ad8c599e06b13bae478ae9ca6ebb2766b8129b2bf
SHA512 684528f3bccbfc498f853cc5ef34c9078cab17eb96ddde37c2d6d91c1fe06c3a96f44fc37d72fdd3b66b9bf1f73fd5962fabee4f5777f28c86196e002759356a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 667a7092eeb2dc719be3dac4444b87e9
SHA1 d1c81c5ef44b45c2708d36a8245d7c76525d01b7
SHA256 3fac64059d2f2030040524a9b9fe5defe06e947b52be796dfdbd6e91e810fb3d
SHA512 02a921e41123f62468c7782f17bb86256ad09acc93d5f29b8fdc72b3c19882ef77529a01a2770efa7ba6798106c13c3c1ca45e2819c44bf45e82fa18189cfe3d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 650204627df167484675eb8e481d0a3c
SHA1 ce50d342c2085e9097a1281c6fd22f45625a6351
SHA256 e2e43ab96b8e8963fe870b495e7f88491a7dc1cafb98f03d87a1584d84c341df
SHA512 e81e82270a5cc0c09d718484ba39fd25e1791b3bc3ad3012c9c254ecb6221e7b8fc1ced71f76468f16b371d378e1c2bf8e3a225803390580ec090073037284f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 4b0508cfcd3598af2456e0feb1e91f83
SHA1 89897f1e82a2dda2ff8c669cf8e8f5e58757989a
SHA256 3e9fe89d41849a9533c39442ff4376812fd17b3b2861ea4eacbd460faf45bfec
SHA512 929e4752f8de06801bd029ab3bacc9ff5b3e05abe0a7dec5d235664efcab2b1f6a3800064c4ba7e68d480871b797e55ebb9520c87a09ab08980fe9892f4f989f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e982aebfa58b4f7fdacf41d1a90a03c9
SHA1 def065fa7d197aed75074b66827b5e3daa1448fe
SHA256 2d7d177d083d843cc95261771195bf67dc2871d2c423c38d98731b6eb4db2973
SHA512 d755585bb40cd197905f12c1c4295ba83af58838d979124a54ae97a39a7dcdac37425c313a1a86e277de4289e63286b2792c5ae305a5427775f33c8d125f2cf7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DA695452A2653B0CC75985EBF4200AC

MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5PIV7FEV\plusone[1].js

MD5 53e032294d7b74dc7c3e47b03a045d1a
SHA1 f462da8a8f40b78d570a665668ba8d1a834960c2
SHA256 8076b082eadf0cab4a8823dbd7628a0b44f174c17b3221221c0e31e7c60307a2
SHA512 fe263fe86aea2ba1b86d86305650cdeee45cd1f7b4339f9d4fb81db776b78abedccd0ae77262f45d579751daa26f81385354b3d126fdb5577036e9dd1db33276

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5PIV7FEV\cb=gapi[2].js

MD5 f9255a0dec7524a9a3e867a9f878a68b
SHA1 813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b
SHA256 d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d
SHA512 d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a8363739ee0d6f3d3e0dff4bd1994155
SHA1 bb3dd679a09dca9adfda5c37e1eae045d5d9bd23
SHA256 b34cc01617d3a2a75cc9a38f5fd308186d4e5d6f5add8bd19f298736fa36c51c
SHA512 bb3143b1cca47ee30ac83d8d667ac54f648b37271d71a3253bc99aed94b3a5f8fb98a774f51d19cfad6711db00c3c27741996ecc3dad24eaff1310d025eef9a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce0555ea421cd5ebc94bfe93702169dc
SHA1 fc4caf336dcb71c8acc586e13bd6268f9b2c467a
SHA256 71224e00729d0ff7866ec7a2422ac6bee02138eb07355e882a842c272196cb05
SHA512 192d028e368a10aabe328a7020ce185621ca1ea8919dbcb561a65ba186a97b717d891cb4ae5b3a542df84a993fa8eeb136edbaa487ba85066878e14546bed398

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a95728c1044d3cef15577bfcbdc657e
SHA1 d70c0c497234d3e822cef7b1eef1016aad2d96a9
SHA256 cc559695af09ce6b20500d1066007b9be8ca00a6b56f6f548a081fd89f143e69
SHA512 bb9e640ee31a686a872229b50896761e04f786d287113f7235830a4d781b27f3bc364bbdc4b0027acb500600afa35a212a2dba555575d894af21969bc8898126

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a135d455aa73bb3b84e1e457c03fc47d
SHA1 8063a9b4bf22692f9b0be5aa72dc0f41feb28612
SHA256 509d24c9cb6907cc8f9fc10b2d002e60786d2a7b7edcf9365adbc0fd619be457
SHA512 eca2ba8116de79f254266541e6eb9d05a3f0c16cd6d3e30ce25ff5db0b55d853cc587990980f2bb79dd70a50088d7110b100c2d0e6757b05d6d6f7dfe927a697

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2183c1f25a63c6437ec3a8ec989c659e
SHA1 eae7bac5210998bc9414af539e4e39661f82fead
SHA256 d0129f128a6d2620e42db9f445de4b64a12ffe01f69a0206a6f448ab5bc592d7
SHA512 cb4195ee7b96bb5f19df67f37f8252d4ec8ccb09f84ffcfc7438efad9033682b57853fe076ee0c3b90f72c1e617d3ba46f40d2536428c1251fddf4c12add02d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b09f6045cbf3ff896a1b69500bb9e80
SHA1 37a4e085ef8bbf1f9f9f410918891b3713624609
SHA256 78f28090708f87ad2b2702a5b4dd252adb981f5994089d697d76d092dc85cc56
SHA512 f17f9f5440ca8a0a34af16698f3cda6cf8f6dd54448dd26eda7c299a5c457c655de52e3a742bda0d6c0f3cc94474bdd4c56a621193ebb841552458744ea99d06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a4910c2ee0d83281330e491eef6a769
SHA1 6dfc999397e642fa74f8a072c4796fcf0083a9c7
SHA256 7ec617e19e77016d2679d9cfa6594801ebebf8d0e9185d1b2a296e7b7dc8f86c
SHA512 401333ffe0627f51565b9032ca67b87026c642a6d4726c58f455564ab059a78bf7b12eac37ff6231c34d96bc66cbf69b2f70ebc87bd517f9fd946b7bf3723114

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 36bcb53380b8d0c4dd6da1d12ad24caf
SHA1 83d97878fa59c30d31f364f65508ba1451ba145e
SHA256 f1b861ded2a08f0ed2f17ed1453fc10b544165835b10538246c202744ea84eaa
SHA512 1ced36f57b02c39ccdd5cc25d5acbe27a1053942cb12b775d608294387e74f2ae9efb1842863138cd109360a80631618e55f00ca0ee238a0b766283a927ca00d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ad626fed2bf3033130115e855e77206c
SHA1 ea63e7388cfb29e200e5fdc19b275711f0648310
SHA256 5699af2ce4010fafa3ada1fab33d904d44a7426c63ae55db9b653a1e11435604
SHA512 762ab24db5dfc57063b6b947df65e188eeaec3a9933f844fd8ede13c18b2c95f57521e37e1cecc7b161477e5deacba2493524b098aa28ae60ca66174dbeac122

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b923c53bd1ca3ffe00e163e84f1bd03
SHA1 0e115a348574018a0b202b46b57df11ab2206515
SHA256 313836439832dfde9801086f3e0f9d0864bf5f45c7ff98d53859c0bf16c8e3a0
SHA512 9140c12572b65e9f2b2af081bb5d6461eb02fb63e0e89b1ca91ca7da9a83e831b466ddab926e522d2f22a21661332c089a053b947005f136721ecadb3d4c30e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 362c02637c8c4353686a282e1742ba26
SHA1 66d468fe61488c46b3f51a97f1f4aa67e54b8d32
SHA256 98497bffb0a568450498950a54d8b20e362af4a3da55d62815f50d355244da94
SHA512 388165ba465319ab27e693e0e301b4f5fe7ca15b4f687492c9f59ce62398fa19503ae410a28ca9694ce854689b8a16e9e74d8fb0d11ab4b9a239e7e895d2b6d1

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e6ff664f03525430ca571f3e7585679
SHA1 ecaaa8cb5323788f2b9453b30ac4e1857c9aa650
SHA256 bfa462b4089cde4bf667acf7012fb5ee86734c9ac944798fed71165ca4f069d8
SHA512 754ead3b6d2f521d47bc760bd7d65e5c00498979149faa3076102eac685802223b720b66728694a2472e5d32dbf23af8878fc65c0095ebc91e6a821c9b021067

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d63a66a10de7c697c53092d7ec4fac7a
SHA1 ce3a91fc97613de6e99c67798c75cf2ec54f09a4
SHA256 66bb23621cafd40c493efb1a4cdb862ef7a00978ddaa08590380b9f92578c6f1
SHA512 c79bfe8bd3e1ca5670c57108e9f993835db409c55a47bcd86735cea80c801f3e73c3003ec197cccfbeeaf50c4f988e47aad3fb0d2c3f3bbc40c2011c0af1fcad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3edf1c424272f7e19c55818d6c2ce77e
SHA1 ec497c67b448b139c95431f7ffa29e7ad07eb4c1
SHA256 798f00e261fade22f2ca17803c4a41b84fd0779f7f324a1870da043c1e7f0b96
SHA512 cd93dfc328781549199462c58dec42ff9c08719b8fbd10becbebe2e6b0950fc456101a27cce735f78df0715ff195a0ff7b7979a1d7bb15dc2f020fc124ccbb65

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b4ceebacafc4ebf44a7b6cbba27e6cd
SHA1 982c51e9502f8c8f862a477ac228bbcc0a529382
SHA256 359519240c35ae23db5aee470187ad3716f24bae1e097bbc5b51fc41de068ce1
SHA512 d5ed10c08a8271039d2fa31abfee829d5c05aae887e54218ca3e7bb618bf27cd7fca45b6c9ab6f6b3797200d90b0e0741d919bb66bd9a67eb419905fd4ddba6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bce7581bb58cf65c83c93700997e88d3
SHA1 b3e27f659d6f761e929aac9d2d35a9c09f8863dc
SHA256 a42ba656810050ed994b924d6c2df6fb9d3d14892c41dcfa4f44715e2a063b5e
SHA512 7854e879b5b00f40963b74832d3958ce0e03c9a6b78c9b5a79ae44fe65281526ce8ba4307b20c02a8fb122db026dd42eb0a0d76c70a743c5c10181a9138e74e7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 01be5f5f343006380cacd0c7daa1ca6e
SHA1 e03031c07cbabd9d61d14fffc6aab2ee2760e232
SHA256 bce06c5dc9e5a8e29f83baebdbd1dffc8ae02af09c26ca7751b65afd6dcc9c4c
SHA512 46a757a1c6a8d45851b3405a1766bee511a3b5608b4f8e67bfe34518ecc94678ee4ade93c87201cba2c72c7edad81050a88938676833c63a32c953771881558f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e64e4066603b283bfc66cd88fe429aad
SHA1 81d2324b08f9d0a9ebe121a2eb5871b202b07052
SHA256 79041484e101af109ab34cbf4c1f1d3d28a17443ff61844dc88dcb75b07ae3ca
SHA512 b117f57e98116020ba11d256f896409b2dbd6a169dc712fb6f8228141824a2505f228b32f2e198e603b3531d4c025f4d1d99d97bdfbb8bdcd47475d72f51bb89

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e22ef1bf70e43991ec3c03584e723155
SHA1 f73702bf120f968262e043d1d57b883398931432
SHA256 744736e2915b58272da06c5591d7379e4c083f8a3a44a36c6a5b934c4867ca95
SHA512 6a706bdd053137caac7b9b84f4d8d0f0344595873eea84b11e2252524429c391e3667ce695980dcca952782c79b179297cb014d456496749f6125ab4879fe4fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3bcf5868e0d2ea683d40b1f6de22071
SHA1 9b8b311e07d5577d366955747f09d7965649d855
SHA256 8349cbb40f6608b4943bfc8d89c00905461419922e8a264b383ac48c58ee1283
SHA512 e71ea6a6acededd498d228485cc50eb1a25a9e5d2682d1ca466323fa608cc7e6048815e0db9a3fa8bfd5389e2838139f019c9d5620dc0c281fa24f16147394ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d4aa0f6304674f30c6688c5b3786a75d
SHA1 cd64afe641beb4c0984f31421f6ad5bac33c812d
SHA256 6d9d0178c4aba380ca192b475ac4c929229d9ea08ae2400b99e3424cd8de9d57
SHA512 aa6a7c51c891d1c107aae3c47a36b753bde8a99abc525456630dcac7c6e48f06c3999c049a7301cf38a1d8c9d4a21b4b784003786b9c0df5b51df0ba982db2b8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5PIV7FEV\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37AJYVPM\rpc_shindig_random[1].js

MD5 6a90a8e611705b6e5953757cc549ce8c
SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 18:27

Reported

2024-06-01 18:29

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b5bc12c3fce305a84f0ce93e6de5662_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4764 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 2664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3188 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3916 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b5bc12c3fce305a84f0ce93e6de5662_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf58f46f8,0x7ffdf58f4708,0x7ffdf58f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6640 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6640 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,450435362628504028,2609760531142831759,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6272 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 lostwebtracker.com udp
US 8.8.8.8:53 green-tracker.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
NL 95.211.75.26:80 lostwebtracker.com tcp
US 8.8.8.8:53 www.michaelhaeuser.online.de udp
US 8.8.8.8:53 myautoobsession.files.wordpress.com udp
US 8.8.8.8:53 www.carstyling.ru udp
FR 35.180.217.25:80 green-tracker.com tcp
DE 217.160.223.149:80 www.michaelhaeuser.online.de tcp
US 8.8.8.8:53 file.vustv.com udp
US 8.8.8.8:53 gallery.brit-cars.com udp
US 8.8.8.8:53 farm4.static.flickr.com udp
US 192.0.72.16:80 myautoobsession.files.wordpress.com tcp
GB 142.250.200.14:443 apis.google.com udp
US 8.8.8.8:53 www.autointell.com udp
US 8.8.8.8:53 www.otomobiles.com udp
NL 95.211.75.26:80 lostwebtracker.com tcp
FR 35.180.217.25:80 green-tracker.com tcp
DE 88.99.208.67:80 www.carstyling.ru tcp
US 192.0.72.16:80 myautoobsession.files.wordpress.com tcp
DE 217.160.223.149:80 www.michaelhaeuser.online.de tcp
US 13.248.169.48:80 file.vustv.com tcp
US 199.59.243.225:80 www.otomobiles.com tcp
US 8.8.8.8:53 data.mactechnews.de udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 www.takemetocuba.com udp
US 8.8.8.8:53 www.avto-magazin.si udp
DE 5.35.225.160:80 www.autointell.com tcp
US 8.8.8.8:53 www.fiero.net udp
US 13.248.169.48:80 file.vustv.com tcp
DE 5.35.225.160:80 www.autointell.com tcp
SI 46.19.9.226:80 www.avto-magazin.si tcp
DE 217.160.0.192:80 www.takemetocuba.com tcp
US 8.8.8.8:53 www.toocool.se udp
DE 46.163.120.248:80 data.mactechnews.de tcp
US 8.8.8.8:53 accounts.google.com udp
GB 142.250.187.226:445 pagead2.googlesyndication.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
US 8.8.8.8:53 images.travelpod.com udp
US 8.8.8.8:53 carstyling.ru udp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 img38.imageshack.us udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 192.0.72.16:443 myautoobsession.files.wordpress.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 26.75.211.95.in-addr.arpa udp
US 8.8.8.8:53 16.72.0.192.in-addr.arpa udp
US 8.8.8.8:53 67.208.99.88.in-addr.arpa udp
US 8.8.8.8:53 225.243.59.199.in-addr.arpa udp
DE 46.163.120.248:443 data.mactechnews.de tcp
US 8.8.8.8:53 7seasproductions.com udp
SI 46.19.9.226:443 www.avto-magazin.si tcp
US 8.8.8.8:53 www.cartype.com udp
DE 217.160.0.225:443 7seasproductions.com tcp
US 8.8.8.8:53 developers.google.com udp
US 38.99.77.17:80 img38.imageshack.us tcp
US 45.79.0.147:80 www.cartype.com tcp
GB 216.58.201.110:80 developers.google.com tcp
DE 88.99.208.67:443 carstyling.ru tcp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 lh6.ggpht.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.16.225:80 lh6.ggpht.com tcp
US 8.8.8.8:53 avto-magazin.metropolitan.si udp
US 8.8.8.8:53 vintagereveries.com udp
SI 46.19.9.226:443 avto-magazin.metropolitan.si tcp
GB 145.239.252.65:80 vintagereveries.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 cartype.com udp
US 45.79.0.147:443 cartype.com tcp
GB 145.239.252.65:443 vintagereveries.com tcp
US 8.8.8.8:53 img1.blogblog.com udp
GB 142.250.178.9:80 img1.blogblog.com tcp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 myautoobsession.wordpress.com udp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 192.0.78.12:443 myautoobsession.wordpress.com tcp
GB 142.250.180.1:80 1.bp.blogspot.com tcp
GB 142.250.178.9:443 resources.blogblog.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 18.245.160.68:80 farm4.static.flickr.com tcp
US 69.163.225.91:80 www.fiero.net tcp
US 69.163.225.91:80 www.fiero.net tcp
US 8.8.8.8:53 149.223.160.217.in-addr.arpa udp
US 8.8.8.8:53 48.169.248.13.in-addr.arpa udp
US 8.8.8.8:53 248.120.163.46.in-addr.arpa udp
US 8.8.8.8:53 192.0.160.217.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 226.9.19.46.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.0.160.217.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 17.77.99.38.in-addr.arpa udp
US 8.8.8.8:53 147.0.79.45.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 65.252.239.145.in-addr.arpa udp
US 8.8.8.8:53 12.78.0.192.in-addr.arpa udp
GB 18.245.160.68:443 farm4.static.flickr.com tcp
GB 142.250.178.2:139 pagead2.googlesyndication.com tcp
FR 13.36.144.223:80 green-tracker.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 68.160.245.18.in-addr.arpa udp
US 8.8.8.8:53 6.39.156.108.in-addr.arpa udp
FR 13.36.144.223:80 green-tracker.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 www.blogger.com udp
GB 142.250.178.9:445 www.blogger.com tcp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_4764_CGPYABWDWHHLNQMF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a41fc04803218f285d105d01bb762386
SHA1 b1e4b2202d71ef39eb4114266278ea680b3bb0bc
SHA256 3e2c58793f419c1380d29bdd4e55b403dae016b08e539469887b83d484ddd335
SHA512 3ce0893f3a8a5f586f4084584014103bb7b1f0d595692e84bf7ed31670b646b2c871d36d91e5ce254db012517b1e94a4d8272b571e5ae6a348b6a3bd4389e3e9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

MD5 23536ccfe05b737ae639fe63ee4cc435
SHA1 6d2e9822835dc3e6117a4d2addfc8f241fbdbc82
SHA256 6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce
SHA512 f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 630bcfc226a8da72cc472c90405281f1
SHA1 fa395d5018d1ec8877b4977a58f66f7811c36fb2
SHA256 70081caa2d235f581b218553489938e825bff455c7992be6c91878756bd5fafe
SHA512 f560e95506f343cec23a6c87f5462af11713725985a150b7a0cd215d4eb13c8706300ed4f8928155b8f505d914ae7acf2578ce56084fe17d9663a2d7fec3243c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a8cf446ade84a1bfd73d9a0b57514aa4
SHA1 227ec7bc4fcecbc0932be0d46ced8b69e8d4b639
SHA256 0734ee9cda05ad6d8bc85edcb60c5f0f28dd7b0030859dfc3934a6c69ac06b1e
SHA512 f59ee0acee9632174841b4f30ece6cf05beca33a7fbd642368f2779023bf722c6f0c952d0e554527bdbedc2fbed65c427cd24b164a0654cab7dba73a2257013b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 39a32b8cdfa3eaa882007e5ddecdb773
SHA1 6ef64339d8b2519925e3dac78fd5c71cf13ad08a
SHA256 df6e225e1779f052bf82f2ad82ca54d78e5a4e694b6172cbbaad5f040578f04e
SHA512 0e89d20a524803c51b6610f6f78fbae1c889e9a37ba0dc8ea2964e7dab52d706b8341f6572f3dab3d3e1dcc97915230875bfc7fdae6609ca7ff5659d813d7968

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 23d84fef01a8e9b4ad89ab4d09024c39
SHA1 09666be72eec741f1d944a2767bfa81b07b56da4
SHA256 03e3045bf6795d714812c1f9c196ffc7c4e3d09207ff0b188ef0116d84244496
SHA512 76343061fe89eb20a150eb2937eda413a61c094dac6b6230dd6ac7d8f759882d325f4c36669310dde8381ab2521b0a0bc07b5efad725e90e96d6a7771dffc721

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 41c810eb23288733b8f4cf7298267715
SHA1 69ede2c1f311c873b32e47015b95be7b685f3319
SHA256 5b7babc1430b27c157b733f8d2c611bfcf173cfd1fdf3552264521afe12928a8
SHA512 e1d7a77238521c696b11ad18228aff2c6681d7ea397d8da1703242a6de47ac67d56dbc6557faa67a80342701b7b961472120d67de0384fc60e045ee387aab6b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8725daeed4397eb7f54c31c4eb1b499e
SHA1 49318d82f472e07888cf25101295511bea4dde02
SHA256 26144deaefd679de8e017bd8f7c51eb683232701d0d38c66246a21fec12a5264
SHA512 0ce53ac23aa23fb2fdfb8e17476d40b8b7ebd9c9f83ba9bd50d4b9fd7325bf4d7ab543fe62229be822a50cf27e32f4e320470f8a84b659ceaa22fa4b42abcb18