Malware Analysis Report

2025-04-14 01:00

Sample ID 240602-2jbcgsaf69
Target 8facc2ab1a0cef896f0f9156e7f0a7b0_JaffaCakes118
SHA256 25d233f192c284de300882057d4b74cdddcb89f7107edfb9ec4d82922729c1b3
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

25d233f192c284de300882057d4b74cdddcb89f7107edfb9ec4d82922729c1b3

Threat Level: No (potentially) malicious behavior was detected

The file 8facc2ab1a0cef896f0f9156e7f0a7b0_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 22:36

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 22:36

Reported

2024-06-02 22:38

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

152s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8facc2ab1a0cef896f0f9156e7f0a7b0_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8facc2ab1a0cef896f0f9156e7f0a7b0_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=2064 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3708 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5404 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5516 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=760 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 51.140.242.104:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 13.107.6.158:443 business.bing.com tcp
BE 23.55.97.181:443 www.microsoft.com tcp
US 8.8.8.8:53 gov.cn.jaxqn.cn udp
US 8.8.8.8:53 gov.cn.jaxqn.cn udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 104.242.140.51.in-addr.arpa udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 gov.cn.jaxqn.cn udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
GB 104.91.71.140:443 bzib.nelreports.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 181.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 bdimg.share.baidu.com udp
US 8.8.8.8:53 bdimg.share.baidu.com udp
CN 39.156.68.163:80 bdimg.share.baidu.com tcp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
CN 39.156.68.163:80 bdimg.share.baidu.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.42.73.29:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 29.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
CN 112.34.113.148:80 bdimg.share.baidu.com tcp
CN 112.34.113.148:80 bdimg.share.baidu.com tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
CN 163.177.17.97:80 bdimg.share.baidu.com tcp
CN 163.177.17.97:80 bdimg.share.baidu.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
CN 180.101.212.103:80 bdimg.share.baidu.com tcp
CN 180.101.212.103:80 bdimg.share.baidu.com tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
CN 182.61.201.93:80 bdimg.share.baidu.com tcp
CN 182.61.201.93:80 bdimg.share.baidu.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
CN 182.61.201.94:80 bdimg.share.baidu.com tcp
CN 182.61.201.94:80 bdimg.share.baidu.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
CN 182.61.244.229:80 bdimg.share.baidu.com tcp
CN 182.61.244.229:80 bdimg.share.baidu.com tcp
US 8.8.8.8:53 175.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 22:36

Reported

2024-06-02 22:38

Platform

win7-20240221-en

Max time kernel

141s

Max time network

119s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8facc2ab1a0cef896f0f9156e7f0a7b0_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84E51071-2130-11EF-87C3-6E6327E9C5D7} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423529642" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000191f0209cb7f3f41a1260743387db40b000000000200000000001066000000010000200000003c509f9acfb6c7caafab701cf905a0032136e34deb729b1c529c7df47aba84a6000000000e800000000200002000000082c83dce8ea47ab9f5cd298621347378ae3502a55113a2d6887a4ce0c5740fba9000000084c4c91186540247415ec299c490957327d9f60eed4d92d2224819576b10ec55ca2205e600f157fe38bcbcf3cfa85a94beceb880b3b67a2ae7c4a9534448da237902ac5e9240eb29073c19a1f255e5e1b41ab33129c3036ad3aab23edc86c3ab49564d36b01771cbd304f55aea3445d6cc3e61696daf7eea3b64e1da1b28453820f4946fd7cdcd087d9d807feebbf8fc40000000b290b634dfcb81fd32334610170ac98a825f99286e546be813996a62b9279d6a28ee60041eebf8f035c6be3858a0c12c161454dcae4559659007ae3760e72a82 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10db459b3db5da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000191f0209cb7f3f41a1260743387db40b000000000200000000001066000000010000200000005821009cd20d5628a0ce9fa48f4f82aaee6382a79f75bcda1a6c117f561c1fc1000000000e8000000002000020000000fc68ebf2ee1a0397a4105d596e9843b8be63a2e18f51d18f176dd65dd17f9f0b20000000f09a2802c7b1de85ee8fdd9644d29269fb6146cda596780fae6b28ff87e1b60a4000000038e1661c8e0481279100e5f39e26bd0e35620e1b0a71e8272548fbee1ac9ed7c2f64a75073dd8302f53ce32f892e4a19aec2fdf87798875a2d7766d4403cfc5a C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8facc2ab1a0cef896f0f9156e7f0a7b0_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 gov.cn.jaxqn.cn udp
US 8.8.8.8:53 bdimg.share.baidu.com udp
CN 182.61.201.93:80 bdimg.share.baidu.com tcp
CN 182.61.201.93:80 bdimg.share.baidu.com tcp
CN 182.61.201.94:80 bdimg.share.baidu.com tcp
CN 182.61.201.94:80 bdimg.share.baidu.com tcp
CN 182.61.244.229:80 bdimg.share.baidu.com tcp
CN 182.61.244.229:80 bdimg.share.baidu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
CN 14.215.182.161:80 bdimg.share.baidu.com tcp
CN 14.215.182.161:80 bdimg.share.baidu.com tcp
CN 39.156.68.163:80 bdimg.share.baidu.com tcp
CN 39.156.68.163:80 bdimg.share.baidu.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab1A83.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1B76.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ac805ba3ecd7c356f870b60fb5accc25
SHA1 0857ee8ae2fa2c978911124d211481de2af05c0d
SHA256 d14b5e9b69e4c7e22bc2d12e8f052fcd2736b8401efb0fbea28b65542f442540
SHA512 c1a8d039c8919a2d8f58d86550b26994586d39ead4af13a5233eba557f98aaf2647cd863c9ab1239e33a86c1fd7f5e6a8dc2140ad50e611ca9b5f0a755c31510

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a6d96f049accb09bd4283a36c14a6345
SHA1 e7f8f4820d9e04a1668d15eaa7a0e2ac88cab65b
SHA256 6a0f362ad992ad4f6f2846dc5c34cd3ebc03d2a8081ca0e6847a09472638f170
SHA512 447cce25b0f7dcb6add976bc6d92d7f858407ea65d075f02ede9b142a888249909e35fe2ba84f8792e587a6539869ea4f742fa6f386e3488fbfac0bc354bce97

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e0d38c77d0d121c3a0d095ab4364120a
SHA1 8702d714b2e1680ff69718e0c4fe66993f3a6f41
SHA256 ce6d7517fbeaf576e7f90e807557b2edc34ec92c90835ef718be7337359708b5
SHA512 2d1d19c80aa908446eaefc9adfa5fa6de9884dd6647296f589083fc6201084915bb65ec3957a362fb48e6ac0caa722a21abdd39fc80cc5c721cd9fc9aeebc550

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 56ca09e2a434fe5c88cb85a784dfeba9
SHA1 1d8c08f91512f121ddb7d510821f6cc5590a0d59
SHA256 47cd156f4bc1bb1efd00d50c36fdfef74f9b6948ec9e61a0c6bc7047b5c6c07a
SHA512 c7892e65e2ab055b2e1d7b95ab902c1ebc955f63be8917ac477d19f49db6800e2005606baabec75a7df41cd639a07268fbc80ef8cb645863bf1d68d9122b10f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c34aac61a81977ba173b90b6f91cb5c1
SHA1 45f532167ceaf61ae33ced1af960d807cfd21e58
SHA256 deb8df49001c402769951013b893948cdf04f2da7c7d1439dd552c404d8460e2
SHA512 fa1f9833f5b4ccf9607d2d7a53c48507d91555d4ae23d0c4137b76d25d9087a994509ccae06923cf649e8656cc8e0255d9b7f529df095c0b2e820cf90bdd54a0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b1f3c3f7b3a89b88e1a065d0682e0501
SHA1 22a1c0af2bc47672f79cd3d51adaa7afb1c32c75
SHA256 c26c9a968867fb9bfd1597fee1b0683a2564cf1d2dcd1013ccf7e9c70223cfdf
SHA512 b5f3ab8481e4a9dbbac22d2b8110ba02049b4ce2932001cb5b1be34d539864ec64c9b30a0600e85b22542ad7f6bead509c95c543f857f19254c4b4b4d064b782

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 298a0deb3dc402d81e3fa69175b89746
SHA1 e3a15fe87f66ca2747051a85abea5c93c458e524
SHA256 7c855b5c1588b853ea10b3cb9b06b9d6302e26103f2c98332f825f1ef3006c1b
SHA512 316882b0e8d5e3c9d9bb96853bd23af07e22bd3b7176b126532b64b6721d9e6e198e858529d93e9702ed7148af72b51f5330455742ff6993a0a90aefdf35010c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0c390a3276e484de7798738c1b4213a6
SHA1 89fb566e47a20cfa88ce57dfc75092d0308a8883
SHA256 d216de60358ff0dbd467793fc0b7c23dbe7fa0058200893c6a26f6becbcd5389
SHA512 e7b0a5b14c10d2919c95df9e6fb189cbb61a6e3e2b83219738c96a87362b10c0752807005250d618466ea7ff3b7363173690f6ad1c29489fcf79bc388c9f7917

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15e57b71a3b1f1bbe12e125848997fbc
SHA1 71b486d88fb54548a21b633285057058e782c4a7
SHA256 fef77847f55ba87c088cd746a3f83e686347a5f5f946c64b3e5e2290a96f6840
SHA512 142668d725543ecdded4605f1bbbee7f003a8e6af7f9fdf690968d609b347a036085308530eb45fd4c46b0ba3943780eb142156a9177bddf27f374cfb32db9e4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e93111a204a01199cda68441166b2b9
SHA1 af3b9dea554d05847e5c426123563ca829853bff
SHA256 3bddec9d32066594588b598ba1628ae785da748ea5a0565486eaacc8ac5e2e4d
SHA512 28edad3401eca2bae6dd6db73499b06c09e698bf96767ba5643150fe2ade8a74f1770cc3838e9b71d4392c18f544a41524603f04d271e0987670c13754efe34a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 80bd7e1e2137c957f4e243b1ebedc0e1
SHA1 e2fcf8fa48679532863e2eeef04e31b6cd407059
SHA256 f66e7fe475cae1df1b93a375eb08088e9b4627bbd8caf321e2eba3bdc5f3c4c2
SHA512 5e5eaea977f16ca52ed40911fb5c3f770c63c04e4e61d4a88a33a3c632b5600f53bc889d5a7c60be33a96a5ddbd9e605079e8f4e670e21352121ab737ec26127

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9f39649508e8a7911c106d1ce47a3fd5
SHA1 508659323e8352d09edffd6688a181932d377767
SHA256 45c5f4cea0c6d07f5385404124556392ab001e334c3816d6a6e78e768e20dfa6
SHA512 b9e65434ed742a3818a2ad59d5f438259665c5343c84d85a954668b4a0b8c0fefcd4dca151569f5b04b3957ab278e9eb0f6d2a337d53fc2ecee73be00dd0f2e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a825bd1f9fb4d7d921650e884bec38a
SHA1 91226cf9d4b2c5b89f90ea73a72e56074c45ad3d
SHA256 6b5a901f5714d5bc9fb59d8ac686cdcaa0c688df0608382500e35c753a361bb5
SHA512 da1f8560c22ca7ff5a3f81ba0d68234deaad6bf0892791d66c363a877eba15ae7e58b4f62b0a3b0756141a83f39941648de05ff40cd613ac8bd0e5861e878dae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1eca32a6efa37ab196f46a3947479f6
SHA1 4f7b37e7a06ecb9ed9c40720efbee2c37d88bd61
SHA256 d3e41f28e942201e1a93265d22fa14f1b8e7711cb13fa28b0b41f2f34a2ed219
SHA512 45b10fe02ab91b80fd55ef1f568ff8c3e2a8af9b8fba97eb3f18374d9b5bd589248d4b5ec2a168342cc03e97f488571fdb5d477ea82ebd2a34891b428f5f8d6e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b2dea86ab5db0c47a69dbc8ed5c05d7b
SHA1 3e0c1116f92e7ab9672be186cb498563bd812e50
SHA256 aab8d81b8c05dcc9f202a63592ec0b7f21ebd0434134fe37889addd78ee37bd6
SHA512 b2def2c6d2324d378f8fcffbae81b5b21952def3bcebcad190b3baf2a26fa5d2b49ff11af8f84e548a13efe9cd7e899720295e2e4604d0190e285afd4e3d9eb9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 69562f55a91af1af8778d9414001231d
SHA1 5e7e1a7266b951ad20adb86c3699ee35d6120e5f
SHA256 65d8e8f355e5689db60b230ca201b42c4e98721a3999e34fb8eec33a261f434f
SHA512 04f230e4d271df8a2c13b40f7c3a7ef84764c8b0044feeb82aff16f10a84e7df9d316ed6ed7b46fc48a9431c34d290f29a4162a4c5f7826d9ccf427cfdbbf74c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9c2f239b01b965ed8eec5fc90ec99b03
SHA1 a9acfb749b1bf304f1ba5c75863db633b0111bbd
SHA256 12d02e2afb87a6acd971c5dd3f4fc3ac8a3930b03ab8284e20488855de832e83
SHA512 e98f66d15c4734c5f82f4b018b502e755f2b2b7f735a4205def6d21fd507ca81e788942b04062e177ca60caa8a3e2a5ffce092ac171004fa4ecb33c04fa57d0b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3748ae0272a9b2795be1f744886594c
SHA1 3f789cfb597d9a3bf7e573d24aa818b8187e1b3c
SHA256 f50b848a4e4031afd0590d89d8a2dff61b1f104824215b15b03ebaa9a458c96d
SHA512 ea132a576ed9ac7cdf563fe84f2a3705b4e0d3e0843b2056efc89d45a2f1372417e277acca3e7e802dd57e3875053c2481c3103fe2cd69188f0e15263a52a1aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3af5165ca9c0aab1462566e9b4584326
SHA1 ae23dc8f97671dc44299abd2d8be81d544933ef2
SHA256 017422c28ca0cb1a02fcf05bf45756daa81db2e0d36c19f33c184eb673d70121
SHA512 430c4dbbbe9808d051ea681779792b290b398d8d1119d9fa3c9a9818858d69e645c5eb74de923393a093e3a6d5216e757867821ded1a6f96618021c39901521f