Malware Analysis Report

2025-01-17 23:55

Sample ID 240603-qkaxkahb42
Target 91ecdafa723faff20ece98209c8ca461_JaffaCakes118
SHA256 77b49d6001c483ec2de2dac169fc017e7bd0f555c3ca44bd9f2c4d97072d3e07
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

77b49d6001c483ec2de2dac169fc017e7bd0f555c3ca44bd9f2c4d97072d3e07

Threat Level: No (potentially) malicious behavior was detected

The file 91ecdafa723faff20ece98209c8ca461_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 13:18

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 13:18

Reported

2024-06-03 13:21

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91ecdafa723faff20ece98209c8ca461_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91ecdafa723faff20ece98209c8ca461_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5768 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3744 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5680 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5536 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4396 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5848 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
GB 51.140.244.186:443 nav-edge.smartscreen.microsoft.com tcp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 186.244.140.51.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
BE 2.21.17.194:443 www.microsoft.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 2.17.251.4:443 bzib.nelreports.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 4.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 194.17.21.2.in-addr.arpa udp
US 8.8.8.8:53 img.sedoparking.com udp
US 8.8.8.8:53 img.sedoparking.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 205.234.175.175:80 img.sedoparking.com tcp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 175.175.234.205.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 52.168.117.173:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 173.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 www.payment-supports.com udp
US 8.8.8.8:53 www.payment-supports.com udp
US 13.107.253.67:443 tcp
US 8.8.8.8:53 www.payment-supports.com udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 64.253.107.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.253.64:443 wcpstatic.microsoft.com tcp
US 13.107.253.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 91.16.208.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 13:18

Reported

2024-06-03 13:21

Platform

win7-20231129-en

Max time kernel

117s

Max time network

127s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91ecdafa723faff20ece98209c8ca461_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e835a3b8b5da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423582592" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d00c09d0cd551c478c948bfa22c4fb950000000002000000000010660000000100002000000007b7ea191d1a695ba4ae26bd327a3418908552d6ac818489cf79f6bfa106358f000000000e8000000002000020000000955440ace5e1d765bae8e1f5ec1e18ca8919dfa570fcbaaea3d9b0eb2b5ab79090000000bb351f485d0dee5cf407a677cfa8846d757b84289241c8568cda02d6759a3fb90ac9f4e6dd35b824f7ca84caf4e604cef70d5cb5fcdd8ab33c6a1dae9fabf551aef0750825c007c06914375b20497315204ddc9888152eecc6654b732a157e6008668b6f294b6550cb10778336fe8da527499a7be6a0b7fe9e37f3ff168348d1325a0f2cf502828e2707c34119dc74814000000095a36039938154134c75469b45419746a257f5503c4f35e14b21ee8bdba36aad5abdbf23330fd748492e0a99d353c9818145f15a5609ffb8f17ed564c678a6f2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD8AF941-21AB-11EF-8D15-FA7CD17678B7} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d00c09d0cd551c478c948bfa22c4fb9500000000020000000000106600000001000020000000da743df6982e28d4efdc9a04d0c92884bd356d9d6dc97d39b3263f05d6d8d405000000000e80000000020000200000007972964144d4b458da0ee56a20e66cd03b0b38895c24c0a86144c96ce91573c620000000ef637ab4c1351912870cbbd570b18e84dfe5765a37c2af38b9b052773cd4257040000000abc0729735957b9c0c9ac1d3207deb0c60598f6283db91bd85f6107aab32e0999d5a3f7058e549b97ccc393c4d31a23c5b63e1b06631a9d1bdac6db41ef15ae5 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91ecdafa723faff20ece98209c8ca461_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 img.sedoparking.com udp
GB 142.250.187.196:80 www.google.com tcp
US 205.234.175.175:80 img.sedoparking.com tcp
US 205.234.175.175:80 img.sedoparking.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 partner.googleadservices.com udp
US 8.8.8.8:53 www.adsensecustomsearchads.com udp
GB 142.250.178.2:443 partner.googleadservices.com tcp
GB 142.250.178.2:443 partner.googleadservices.com tcp
GB 142.250.187.238:443 www.adsensecustomsearchads.com tcp
GB 142.250.187.238:443 www.adsensecustomsearchads.com tcp
GB 142.250.187.238:443 www.adsensecustomsearchads.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
NL 23.62.61.72:80 www.bing.com tcp
NL 23.62.61.72:80 www.bing.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24

MD5 3e455215095192e1b75d379fb187298a
SHA1 b1bc968bd4f49d622aa89a81f2150152a41d829c
SHA256 ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99
SHA512 54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd

C:\Users\Admin\AppData\Local\Temp\Cab1EE6.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1EFB.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a1f0d2ad8ed34ee9b6f85c6ba6b9ea26
SHA1 9df1f8bc0ef7bbfac8cafeaca20cc3dbb9f89ac7
SHA256 62f22dec20d61e5408f60e18c2a77f93c01525d68df61b38b4f36ed708ca1d96
SHA512 74f5353c3eff2d0085f0d17328785650cb046b05abd24e004fc49bd5c2faf5ab4b4a364d31ce5bacbb5b3e4af595e99a907ea9a220f3f261c338eb9848fd9a00

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 e2b71a7f0ed918346b3cbce1c29304e7
SHA1 2daefaddc0c94ec04800d09e84579c29ef732921
SHA256 195fb3aa9fd5d123227b68f48ffea009510d7c11c692976ffa06c1671280a40a
SHA512 66154ea5b8f0a19ef9bdc143276a74e7283ad437d0cfcf31ba6f5efb7f39a151a195650fc7dfa5b64f482d5b4291d5f390aab23efb65ee509c7ad13295cc00d7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 13ed5e0369cedc64c8437eb9a493a981
SHA1 880053c91809fef7b2a3d688143f554d5a05c0bd
SHA256 3560614f2f62c19498d2ad6c3b9fa8f232883167479de05e924a5a3ab19a8454
SHA512 18b3c940a3b722b58c476af4141ab987ed9f7557c1e52f3f20548b2c209abd67c943761d22e20ed59c36d69f8cd911285aff7efdf2d20f51c35cad62932aefa0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77814cf2249bc277f9264f3c95b7e785
SHA1 d15e5298f0197d83830768e117842778d7ae3a9c
SHA256 c8d5730510c2dc5d35ab4416f30ead5bd9e0fb3d8219ad501d6935efd66a4895
SHA512 4c11bf32089035c8f8bf9ed2a94b4c5a7b57c13e95c25593bbda077edbaab539dd0a5bfcf249b282b5a695276d4e7be4e43657433837b2b7f7e42ec28cb49d16

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a81907fc7369f66e337ec0e17f093206
SHA1 345555a93ec23eff4e009b6dd6aeede5a456e9da
SHA256 e0a232fab269d8d8b39f0ab1eb90cd7377ead1fca7b2ee22f490f70370eff7b5
SHA512 0e7fd86726e2472364a174469ccf0a6a706495070d5163049356e5f72db415b00c0a1ddbe933f358d865e384fb6d10bed2cfbfb42be052fdcff056d80c80ab9b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8a608c11c3daf5679687763472a0bbdb
SHA1 4b6595e75507e3df01ce1aa1eac07c65a39444bb
SHA256 def64b6844a51408fb66da6d2d571c47b75e03be235a3b58a4f979cfdb07fa25
SHA512 d6268411f7ed0d7fb86bc82fee8881ce6c72ee7842abbc41f71db0b09200c702d3b4a5a60701f3bdefaaa54940e38387d2f27b0903f652683dd867dc26c47554

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bea2be3906924b3a71f383a18ef622c1
SHA1 ab6a46aeb28c923f7c60abb7327f1112c16092f5
SHA256 698e074f98bf72dbdf214a2beb44eac340fe41fb8142603d2d89e61c2544be53
SHA512 4e69e69437b4ce1d66a2456f5d373eefaccf70ad8eafe86c1142b5c4a81a8cc90929ebb84f1db71b066b28bd743768803587e571565a51c94d008c4fe61fba87

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 139b1c35df16bc1810c78c9e1ffc1dbe
SHA1 e13155e2df7d2a77b609e15fe54004c0d447bd7e
SHA256 6a412eb0c569ca23088834868495a5dca70f105f816effcaa202a023a0ca49a3
SHA512 0f2f9977ce7a73f6030bd261d21c6635ae41222035e6c1bb26d4f1742c6b491333e221f0eb538acebb0e0291bfd8ed2fef51101039eab5b31f3aed2948fa9c12

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ff7db90693e9df09e3e236f47848f456
SHA1 d85e7b75ccec5b203c9a21ded618de72f256cb09
SHA256 23f5d50b11b37a9dd5cc8356c4868e8fe0688bc2114b158ac52265998dee59f5
SHA512 d52ac248ce89583b9a8590fc0ec995d80836ed9a082622fc95a4202d7b8fa69f21d8650db11fac05f9e0b321b2435dbe82af1cc81d7da2c339e7ba9535f7ddd0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dbf397c50c4391a6283c4614cf14bb99
SHA1 f5a8948afb45633abdeb39357340c0c824d37e96
SHA256 f963127660c74af30be0b852cd9922e34d2651568747dbc756aaed8929600127
SHA512 67e8e23a120ecf93ac749810c7209e11db92a73d1a843cc2dca5a2420571cf4dd4525894d02013e78e7165df4490cddcc3364c1afdb105a6e252c420616d944c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ce571036e3fac9eb247f956a9f94c95
SHA1 f8d4c0568a10b5e42b092689a1759196f3ee021b
SHA256 b5f3928525c2261bc813e110d09f466bf46eee333c78693cef1f1f944d467b37
SHA512 32d091c958250d981d085f7e45823dd17027208d51b389df8f33ae43c1726f24ef9e810f6760d0730f7dd3193220290ced84fec257a52e5f713af2351dea8841

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 581d1ae0bfe5791fbef8ffa1198615e2
SHA1 dce16de3829eae5dab255d148bb02849c6fe0858
SHA256 6fc448516e47772429e290546ed860c0b69b5ecd6113d7a7c42640b452f4c3c3
SHA512 0bcc23f2dcdc44cd575b7fcc51d8b3408ed8af579168e33560862df257f3777d329a09395776e971e579ab54174911c5669b660f694ba186048d0aa609dd2064

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f48fdcf277ab99cb36fc24c17df87dd
SHA1 b4fa0d299a1f94eb288895fc931e80e7ebbe5422
SHA256 9a315c95245420c6c4853b96acd2ff32ef0674516a6481dc622f0a64ae3f6431
SHA512 58f12f8ff76724224e44e3b4f8a152409c5fa18cdf83752145edf8b04fda69e6e03861dc0b73cb739c8d332321c16a15ec83a9aa51f5dc01515057356953e9b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7dedd268f968c30b5752b102cacb69c6
SHA1 3b409071a562cdd4c461350e61e50550ba3a8d59
SHA256 f022f0a78311ac1263583c0d6b4b7c01e547f4afa17f94bb994152f870b6596b
SHA512 de32ece8caace6221d201b914df347ace70d90c6efc7a1f610dc4281add58bef4285db82957a8c70ba2ffc854969b579be1c6368d874f768649ddc1c7754078f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92c9612eb756116595fd66f5cb228841
SHA1 2750079daadb00676689746d198d2f3841ba5b9e
SHA256 bc3ef08ff1bc88317fc88b01b6abc901b3c4282ef946d584110c66f83a9f9718
SHA512 b63078e5fc9e91e3440c027fd46d21e6f675b232bc545b00ffcac1ebd5100d3a945df5208deb18962d23106a74b9770920dfc8a10ef5a1e61a3af5f85741f84c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ea3526cc653e952ca84cec81f0dfbb2b
SHA1 9d50d75e765914f764cf6bcdfb6f345d0d675843
SHA256 fe5c57d41bfa8dca9e2cfbef4d8ea8c986abb246c4f7d582dc2f6ee29eb7c87e
SHA512 4d4d5503b6a300579080365f2e098571754a0cd6825b380266a75ab10b67f31b100a7b23d6af03e99bc8abfd9240139ad18f40742814f661c872d6049ccb0e36

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 137097f5aae0ef1c830902615c33f89f
SHA1 208a83a321117fde9be7b7b4c11776c97f9335de
SHA256 88b4bdd41972693e2b5b23952fd5789bf5c13257c5e4140130f99e1e14063927
SHA512 c778cfb5e05e62bae9fd76197af67775159eae4836736c42914c3105020afe0121f9a48b07880af8a00b7866e92de8dd82dba9b00e0252b1b2d54b68c5df987d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b4ef2c5d937ac3daf8cbcd3b56e461b
SHA1 297efa1dcdf8bd545b32037a4384cf7ecf5aa95b
SHA256 cac77e3202b2daae1cab8e4fd682702c9dbcf4231fbc26e92c6528483f49e96b
SHA512 8aaf5e2e9876d88bb99894a61ce463e8d17af035c6761e22442f59f2cebdf6e2b5de10c75d918197a0c895498393b2cf27cd4fc0dd3af3d6ae5d1c57638dbaa0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 19162a3c48da6d689f5651ffa2dbcd29
SHA1 8349da6b66e215547168519f34d94bd58632c2fb
SHA256 d8fa7df452331075aff097f607204264317e5b12e5735e0643ccf3290f04571d
SHA512 921613b6ef3ff842c94e81a70a3c6c940e3b48efbf8cc34c55508bbbe9cba3856fe5f0747dac1919954d918f9425d21c1cd11f8fae1448a757b76715e91be214

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81d98f57924773098c3b470f5e992098
SHA1 54158c553db032e0fb0fbd587072757db7f88dfc
SHA256 561ef37a26aa4b51d5c21cf44ec09f78cd9de4359f8ab71e686aea2183e63fa1
SHA512 124a78c3affbba39160102103fd3e6876cffd5dddd2f5aba2a50e23c14955b238b7dcc5bc607c9e5212f2a7ede3df0ff34f494da488c148fd73d57e752b92263

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 762dcbd59ce71bad5c751f31af8fc911
SHA1 e11d71ba8ab56ea8cbd22b82efe85b1a18909489
SHA256 487e353bb3acda425ea8031e9f0b9106531883cf15a9771d80fcdcd8081931d3
SHA512 329d6e7a37b43e64ebeefcc4fdb6db35f455f0f6dcfb2f45e6116de448637529a99cb9e8e7164fdfcd8430ee017428addac904930622da083750dc5c0fb7f237

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 349302b0eb18816124ff8574fbf1354f
SHA1 4aabefeb66570a9f3d8d3dc7aa8d63ce152ef9a6
SHA256 755b6dcd9c6cc5c66c0ce5f04020c45ae8b7d6b22ff5816134492a85f99e3d87
SHA512 56696c5cae58a2e81e1608ad744ab5affe8829a925277ec61a4ffadd9a8cc2dea636a946306915b30da0edb058997b2cdba6d07742505d61180a7e01a5c513c6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 56e8b3cafbee243d9044f8039759d523
SHA1 5d7f179dfc4522c347bbdf225b21351e886a6dcd
SHA256 5f70d760ba0b819e588864b7748c93d778ca83e938679a4ad5705d96f7a02f4e
SHA512 1960a0c293699ab7ff3a038fe73ac3293f1dae1caf6779c8ce9fb9f4d956b6cedd45b15bc50fc19dc54d580d5f37a1b44a63c4ca996a826794befff2e68f3bb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ae0d1e7f269b7cb019de305390d94f97
SHA1 26b42eec9dc289d1a2b849867f2f536b6b0a0f24
SHA256 fbdcc3a124165f2f3d31b284d04f40d49f61ad15a66ea93b347e3b54bde9f9e8
SHA512 56385263d2bda8cdb0ff4ac22f79ef39e8059b55ff3d044dd84b8005d493206c61ebbe1dede895a523aadbe6c0c1f0ec10cfe94a519c10ae9d26b2c75f41a2d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ff6506a2afa8e52044d3df416705c58d
SHA1 f4430c94547ea096649b5b7a3f047bfa1c72e504
SHA256 0509ab705e7bb2975dfd32cef3cdd5eb9ff64b0ee276d86c3babbf29054e39d0
SHA512 ec05f37c291159a2777147d27c31ab02f0acf69c6973f3e4d430d1c93bf6cff6c732f242d2c87818cba00923db075c7c01001338f9fdc06dc0aafb61591410d9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b023c5078b8fbc5888ee489e95b01171
SHA1 4b30d2e5739313367e7681161b91009538831c47
SHA256 9bb2231b03554bcd10903d023cf430b2a86d6c3461853d524be0d91cdf7b3088
SHA512 2e476867d472c5c227e206b3c8adcd79362c84f2a82f26e04056c1c74620a3ecd001fa2bc783ca53c76161c444fa504cb85f873cbb868caf47d50903725ddb70