Malware Analysis Report

2025-01-17 23:30

Sample ID 240603-qnae7shc36
Target 91f0d0beb1f1c34ff7819e07ab199e8e_JaffaCakes118
SHA256 476b81dc748c496c107143e585737491a9cce75674046bec9205ee4d4edb0bca
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

476b81dc748c496c107143e585737491a9cce75674046bec9205ee4d4edb0bca

Threat Level: No (potentially) malicious behavior was detected

The file 91f0d0beb1f1c34ff7819e07ab199e8e_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 13:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 13:23

Reported

2024-06-03 13:26

Platform

win7-20240508-en

Max time kernel

126s

Max time network

149s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91f0d0beb1f1c34ff7819e07ab199e8e_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f8da76b9b5da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000096f61f0414ec22ec20c27f0ec0cde92d1bc50cb10fdb0c894e09456aef0698da000000000e8000000002000020000000503ff02795d8fc8ff5b1907622486711f3b53681504155a94fc7a19f2c5253a8900000005cb30a74ecdb1afe3097f2a7a9c18beb1d556231cef57a7e5380853e25ae3954a10d9719850a58748527a2a2cd4bb0addce6626f8b6e5c655084f2390364dbc1cf9a791a28c9237ce6e713fc43e0ba8c367fd71ba02a1af20b4bc212fc98d17100869ac2d2e19d156bcb475a94b5b4d7dd7935ce48aed8cfaec5b85d6051ee4c078e12488a29eed82a833df7693a161e40000000054b0d742c4558f92c879f2ee36fad36c6e078bfc89c9de0c3946c3add858e14bfae4c9e01df249bc98333a56c16ad83cb4d96234ef4ae6bf915e3faabf0436a C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000045ea744df81dacde241969c591e87d105f640ab94c63b58ba5b4e8f30b5dc49d000000000e80000000020000200000005dac040a9acfbfe73e849817b24e227ebf0dc21a895518667496bc3ec3ddf67e200000002df8e454e2b27122d95f1553f828ca0004020447ed78baeb63f837b0926ca49840000000c5430619faf3a563c7be18a1661371a12997aac6c878c8e47787ed4ef6276cfae5191500773616431fa47dfe824ad4a0ae717597803027ed809dfb171a1773e3 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423582906" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89573CB1-21AC-11EF-8E9F-FAB46556C0ED} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91f0d0beb1f1c34ff7819e07ab199e8e_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 ecs7.tokopedia.net udp
US 8.8.8.8:53 zhafiraword.files.wordpress.com udp
US 8.8.8.8:53 richardtakemura.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
BE 23.14.90.88:443 ecs7.tokopedia.net tcp
GB 216.58.201.106:443 ajax.googleapis.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.200.14:443 apis.google.com tcp
BE 23.14.90.88:443 ecs7.tokopedia.net tcp
GB 216.58.201.106:443 ajax.googleapis.com tcp
BE 23.14.90.88:443 ecs7.tokopedia.net tcp
GB 142.250.180.1:443 3.bp.blogspot.com tcp
GB 142.250.180.1:443 3.bp.blogspot.com tcp
US 192.0.72.24:443 zhafiraword.files.wordpress.com tcp
US 192.0.72.24:443 zhafiraword.files.wordpress.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
GB 172.217.16.225:443 lh3.googleusercontent.com tcp
US 162.255.119.27:443 richardtakemura.com tcp
US 162.255.119.27:443 richardtakemura.com tcp
US 8.8.8.8:53 jqueryapi.info udp
US 8.8.8.8:53 zhafiraword.wordpress.com udp
US 192.0.78.12:443 zhafiraword.wordpress.com tcp
US 192.0.78.12:443 zhafiraword.wordpress.com tcp
US 45.56.79.23:80 jqueryapi.info tcp
US 45.56.79.23:80 jqueryapi.info tcp
US 8.8.8.8:53 mylibrary2012.blogspot.com udp
GB 142.250.200.1:443 mylibrary2012.blogspot.com tcp
GB 142.250.200.1:443 mylibrary2012.blogspot.com tcp
US 8.8.8.8:53 kumpulblogger.com udp
US 69.195.73.201:80 kumpulblogger.com tcp
US 69.195.73.201:80 kumpulblogger.com tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
GB 172.217.16.225:443 lh4.googleusercontent.com tcp
US 8.8.8.8:53 developers.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
BE 23.14.90.88:443 ecs7.tokopedia.net tcp
BE 23.14.90.88:443 ecs7.tokopedia.net tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
BE 23.14.90.88:443 ecs7.tokopedia.net tcp
US 162.255.119.27:443 richardtakemura.com tcp
US 162.255.119.27:443 richardtakemura.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab1C49.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 ecf93fa38108f483294357c96afeb491
SHA1 22bb5e8458f4d288f5113b40005747bf2dd2ece1
SHA256 76d117e699da1d23217270eaf5eda0e7efacc3333db9e40f1cf0abd95b82ca8e
SHA512 50ed6b9916ad0f49d07568dcb4e524cf156f70c204c9757e1f9d6e126d1879602da58df3b5390814911d44c40921df0f54d7cedb5fd8f70adeeb453decd6c65d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 13ed5e0369cedc64c8437eb9a493a981
SHA1 880053c91809fef7b2a3d688143f554d5a05c0bd
SHA256 3560614f2f62c19498d2ad6c3b9fa8f232883167479de05e924a5a3ab19a8454
SHA512 18b3c940a3b722b58c476af4141ab987ed9f7557c1e52f3f20548b2c209abd67c943761d22e20ed59c36d69f8cd911285aff7efdf2d20f51c35cad62932aefa0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7d227a8ec0c5ca5720d70a3e9fd4b22c
SHA1 cad681779f11548071c2406937971c4b45f9ede6
SHA256 8554848e1e280985adc5b5afcdebd2764253be71e311c6383600f2ca769dbbd9
SHA512 82e31519f90d68910adbe0854a5a573e8bee7d6e5420118da79357f22250a8749b59b4531683537dadbbed69d17ae0146772fdc1417e6dc97ffd4b0b3d8fdf98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 35b4e8930391b049d14529afa57eaa92
SHA1 075da36a6422f25f1a05df414f45fa008b8776e0
SHA256 7b22a11458a39ae788151465c7b20918724602fc6c537828157abc16dea65001
SHA512 bfdd17eff73b9860d0a9df07ce69b616803f2ebd20de4fa5910a9a559d0f21549fd5d96d92eeff98fae4c09b2e4eaaf7d281309b41aa28cecf3420abceb226e6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 5ec8a14f80f9493361c58ee7a73c1504
SHA1 a72cbc92f41ccd4bf433e7ba0dd12569c949c583
SHA256 c1e30bf8a5de2bcc174aa8ff1dd51b876c40c803e5f0bba3d1d09c3f8f9846e4
SHA512 282ba6e4a1252e49539762d31126e59ee6e69ee71d22292b17f2e11ef51904f2fc7435e69a348cdf9dca1cf6dcff6fd5637ba5b1d2f95529837971c671a265d9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\Local\Temp\Tar1D2B.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 00b17c9ecfb2c9e8bb3101d165cb5e74
SHA1 9b39924cd6e4f4da7ceacf03288b58ba6958d4a9
SHA256 9486b04642bddacfd23496c3a29cbe6a2dfff55082323e397d64718577c72a87
SHA512 4a8d704e752a5846c5b0bdb8fa4a902671cec2b20ec6ea4ae77e76a4f11682f891f941976753de470dd0efc889b11e3ffd4f7aeaa2c1ac959d6cb04b24cde6d7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 d89e8eec7e91d942d8cc87e075f3aeb1
SHA1 cdc862799ee5242f942f08096c8871a4adbf0f88
SHA256 1d84205cb423ff7102b2cce3ac8549cad255e2f64026b51c984618ba72413462
SHA512 d7cd99250484e6b320985c08fc4802cd462066d3167b5f09397838862f774495b52fac644327c6153852160ab8e41a3d4c10f266da81d8ee0f5178c8be86ed06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 490f79da1e4d9ba86262eaec87bfd763
SHA1 86ce819ad66bba8907cd0e72f9ed0780b1326f0b
SHA256 4922fdba5a7729ad703aebbc3654a0bb191e825305ba13632a8e6e76279be76e
SHA512 33d60d091d278920cfe0f751d58d337de0098d3ed5b35ebe6da31116ab438e709205c5e226a1aa570f95b4d892d1c0c4086a28162f9ccc3bc5cf1cfa00226139

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e048311dc9493554f08ef68f1a265c09
SHA1 e7020bf7db18296ef153aa18277d20daf5e6f75b
SHA256 28fd3d9c2008706f257adee2f10fabf30fe50f483927e057b5ded7ee97200d36
SHA512 856a584abd12ed100367d66630a5a8b96f4604c91c32eb067304e9534dfaeec3d0cb2752b476ecf83b2dc91a013552ca72b2f79f0f570a8b6fcd11f7043825ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f0c5249ea5cf9e0fe40a8ea7d55364b
SHA1 1a8423b94961d5d580b92bf4b52e79554118570b
SHA256 4e64e4e1468b0dc15f7d2de7dc20b5daf4ab6d500de03c4460b93e9f25e88aaa
SHA512 d759f02d052bb66f2abd9390cb3bbe8379996a78058b3a3b9f5b74e187641f51334c7630be9386fc1d4c140c3be5a27ce147d76036d18b2df08836823acac8ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b52babf1b32232b95bd9bbd7c3def44
SHA1 6b631e10ea746fe3e8f300ec4d92baa94981f85b
SHA256 ab919d782af3278fb9df22cbf4bf25d9ae4e38bc13da9a58a05cf28f3124f5b5
SHA512 db788722bb9ea1ddf337fcacaceb3dd9ca6ee2bdf550c438bf6e05e3925a982e4dcd37de1cca3f9b5e8c40f248937658b221a6653ae1fb02021e0e1683a0f46c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 764514facb214ade251b4071f08cc489
SHA1 a67cd9f69b6fe76947a9307a78ef90dff87dd9d7
SHA256 363a07bebd0e0bd6433d94ad30aaf0a51d1770306d37a11c1c6223a847bd6138
SHA512 fa9cb9b23b61ad5a914bf3b27bf507742f41aa7832dd43a1c57fa4c616d7b23f90a7b20af4e50fcb6bf0937b2c12a4b8214e4cfd021d74f1d5b1b8726b4a4b3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 493fc7df2ed8988500db026b5c8419a6
SHA1 7bd94de8860449003852111064a1f958b427238c
SHA256 02d2867ddf59ddd676dbbf2fe596e2aa2476d09117194b712b901b58ac610363
SHA512 479437660f873d12caf88f3eef8f2db5e2dc67b31ad48363e7f612d351fd6729f4c0925cc3c58e0334111c8b180b3709253edd671c90ed4218e7daee474cf6be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7aa50c0ff3b1ac8255007e76ec1d4453
SHA1 483fba652b50a87ab9a91e9fa195246cff2709f4
SHA256 cbe3462a68928639a52aedb33f60d4d293b474f3b2c5121eb0d5080628e97092
SHA512 8cfe97b7baffb87273fe4371f4398ce6c02bbfa0b300d217e5758111a3d331cfb27a3ec046bdee33bed75b180477f6d409d9408a747a6574995100f3f8519ae3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e6d9c19519901f80f93dae1f371efb8
SHA1 40fe24471fb8c826ba014ecb35e395613a4cfeef
SHA256 cce494beeb2fb213bb040906650c0fb9bed4f3c01fb6999b235c17d747637a53
SHA512 d47a43323357e943de639a396a5e5d21bea94b44775b33b40f834b66fcfe2583a96e155b074d20732e6ee16c715388eaf48a81d87fe152f55a9ec61f112feeca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c0bfe483f1a308de03a33f43e6762c47
SHA1 a926a2836acaacd5f86a5b3557589b98ab54ee01
SHA256 6d6d676fd1427c9c1dc40043f4f1e2c8c6e64207e89fd43729a2233c0fb4184d
SHA512 a391e0273142292e9154eacd07cb0aee9445999eca13bbe2a80ced52210ccc6a530fe79a692161391d644443f7d216ef5a7a71f06b4dad7f5a36199904181e53

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f98ef7dabb19646e137da9e7f60e48b8
SHA1 d7687b1ca6c2610cbd9ef993cebcff799e1aa240
SHA256 2d338f59dc0756c6bb131af2fab6a625e46493f581561b9a3f013373d441b0c5
SHA512 5a308f8c88b7387cc02719067b31cb3acbae53937ec287d51f66a02ddeea77c705319bce2b8d9debafa5562be7656254c1971a1c93469ee7ab914c2fa893d77c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 70e2c8dd596d14b12f028c87154b8ac3
SHA1 412da062655bb6ad039c537b5ca9901a2608ba32
SHA256 94e98090efcbbff04650e78ba479cf10c2940408515366419e2ac761cef18162
SHA512 c5819733159bc9c45bedcadb0612d51bbc2691f800460b6b4991fbd5359aad758c7b16567d7b1e4b77120ba97ac82ff52bfe22f597c3101be1902439073624d8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\AS9JEVFR.js

MD5 67e216a27dda24bdcb086c2385b0cb99
SHA1 17141c80f5d32bec3691c5ab24741d8b7dd5f0c6
SHA256 9dc433b2142d3ba0803fcffa53f19d34da26996d20c829df6d694bc887325dd7
SHA512 802319543dc64cb011bc2684004e878a842b73aa55e4da1141ccb8650cbf42fabbf2b46c730760bbfcc7a140e11700244b9f5da78bafe9fca7ec7825c12b4255

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28e79bb030c723fff044664f2efd680f
SHA1 0ce49f9f66054e077b63275416bd717d5d99e8a4
SHA256 d05ed986c833485fcd4a952e8705ecc7e404551d765ad3a28e6b7bf729996090
SHA512 839f8a20bedd24431c98166f49111e3bdefb44c4358263128f64e08449defb2e65ab12e8515fa3bcfb14ca6ab80f8d452e26faa3723f79954a2ff282642592fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8f5afa349f2fb36c0b4bb9e8c294f584
SHA1 56884ed25208abbe423f73b9a6d9ade678df2341
SHA256 db732ca5e7b67f1e686bf738e70660ba2b7c776917dfd526a296e802f41d7964
SHA512 ea98469908e0afd38ffd139602ef136e8b6ac125b7dfebfacae5f26e31ba95a56cc1f6396d030f7e5d110f44d18dce2054fa856afb71716015f7f0d2e2293ecd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NVDR4C1U\plusone[1].js

MD5 53e032294d7b74dc7c3e47b03a045d1a
SHA1 f462da8a8f40b78d570a665668ba8d1a834960c2
SHA256 8076b082eadf0cab4a8823dbd7628a0b44f174c17b3221221c0e31e7c60307a2
SHA512 fe263fe86aea2ba1b86d86305650cdeee45cd1f7b4339f9d4fb81db776b78abedccd0ae77262f45d579751daa26f81385354b3d126fdb5577036e9dd1db33276

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8de89c1c6278e7de14294236b585450b
SHA1 3c0ef1cb2959f3f8a8636a153f41e335a0d4c337
SHA256 44013ee9b3dc622ded6ab396e541e49e5dbf8e9129ac30f97b60e4267236fce8
SHA512 49cbe707ebe0b051b60d1281659fe0e43858624656c56dc7c398c2853d1830490228afab1425e97e403ca7c2a72028ec0646f6ceba55f304f5c841eabe6b8e3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dfddcf13787a7c880862f38a08c12ea8
SHA1 053a6973df69b0177ac200bda182d843e9f4b21a
SHA256 2d93cb83cd296c78864022b1e833d6e2956fd7f212d507819d3e91c063a05d85
SHA512 2fb81675fdf2c79f01fce74463692d141077c72b5604040d20526aa62c4d8d00e2519d3c99963fcb4e0a605c10d79e6d5f7855534dfd17dc7fb0a1d1b82ac9a1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\cb=gapi[2].js

MD5 f9255a0dec7524a9a3e867a9f878a68b
SHA1 813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b
SHA256 d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d
SHA512 d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 41c4db49064eaab356caf34213f356cf
SHA1 16fe927cf6ed2b5f33a8528fba7afb087ba60829
SHA256 b12549872130344f69b23d19c34174312ead6f9cf712e32e0b289206ca30a6fc
SHA512 a48f78e3e34a6ea6ea6d3660f4b47c8f1cbf3891c973c54dc210852e54df8ef729f215fec66801f8194cdf45544276e3e1f6bfb715f3c16e6d03120cb054bda3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 277db918432b181f57ec71f2595e5e00
SHA1 7d2120f79f9ef15db0b957e9e7d44cca6de93621
SHA256 48eb596997d3036620a5be8465d6d4ac16329bb2aee5aebd391a23590ebe0f41
SHA512 6fb3172f40954503ea906173b8a505bdcad7763351c129f85c06fb83f7bd7edb79f40f176b7062dc41bf967cc8537a6b19b8048e1906a804585c02ba0883be8e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 23de14306b73336baa30ff5812c640b0
SHA1 6ba2eb64833561a95b52396eff3555353236c0a8
SHA256 b4891f1d2c5cd0ebdd07225df8179fa8cdd29cb86e2c229ccb7be424c13bfdb6
SHA512 cb8e3035442681bb08f8543357944a03e8717bde8204713879c1f12a2fe30c8e311764f4f45c2a21ed46fbaed8b7444244047d6e7c51458006b958aa06520f10

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4b7fb415f45a9023ef6bd8e935c8d559
SHA1 f834b0be6a831bee57a66ef2ea9cfc0dfb4bceeb
SHA256 84c7b39895417ff1af34e8c3b85e584866ed0f0021c36284c154e439f025b75d
SHA512 b17d8aa202bba4bd57d532ac613793d1c8cc20212a051fc1afe965dde716f0c038019305501a21a52e64665ce5936bb3f274a5beef267de8d54ef788d3ec5d6a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5ff9a5a7410e31b6aa089f375dbd6d25
SHA1 1acca15889fe06b3bea3f75f5b64753e100f70df
SHA256 fbaf92b5e9f7736895014cbf2432bd1db11e7d91438ab94e98e687f73a9a4523
SHA512 a6e3f2ca375b6fa02bfc0a9898da4dafa5e74b3a48ab466ef2386a2414510b6c2b5ef7c58b5cfd3ec016de3579568679c53e5572f9fcd32a75f86b5704256d0e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5fce0047d817f08122c200fa52617143
SHA1 8e7650035cf4da84c110537ea4251a46528eb1bf
SHA256 4af0d4cd68e9a7662fee430b4b1d95e8ca3ae51e0591ca2ae627d3459ddd7f8a
SHA512 487e5bafb938700c0ab84f3dbcc9a0d9135afa7aacb13e9dd1cccbded9303b0f2a5d44b161ce3da85854b0f92833ef1bfefc15187d69d7c4141636fed5e4d706

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ea0fb2d26d5136e57946d66693b970d2
SHA1 03d173ff634c0a2d2dfdb951e97b5c1fdb3850ce
SHA256 5ef163bae76b4d62092ac8ef38a2c9909b5e654e3f918335bcfbbbb7dcd898f2
SHA512 2410ac4fca9cdd96f05f65195fe5d5068487ec53ba3bec02aa91bb65d230ef6dabab32331b975266159e732635f265a4cd93f801966eace10e9e500275209679

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b6f44958cc25a78d70d3d17c4545b42
SHA1 b8d7670a372acfebaf336b918727281e9f32a887
SHA256 289a6a559e213d11fe879bc047a4d7ab109c62cfa02e7d2859e9efcd77056155
SHA512 186e47426ef0a087c3539b56d06dc9d8b8c7fd266edfc7087bf4d535f8c792f19bfb82ec94ea9ab1522555faed6ea91c768d5cab287bce9d0f13cdafb04d1581

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 af109b7d3724483d69e0d11a39c34f5e
SHA1 aa5440f250076f0bfe68bce34fb26a2e732f5644
SHA256 01ae1c6676a77126dbb43072f5d64f3e7d0a492053f32658aaf4e34e92ed7246
SHA512 31259651f5d56f1af1134da4a80bb60ec789415da58458b076740734f3570956e4a068585231e874ead6b1f2173a2da7ac89167ec2b046c6fc5fa3ab207a09fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 06dd689fc3a7e4991b2882a6f470772b
SHA1 edbf313526eba9ac62de53edd845908526f2f4c3
SHA256 8f6bfeb84a552d5b94f8cced15013e98bc540b52be62df05c7a1d877e3c390b6
SHA512 88c1ec92cf0e7f3fce856d802990971db2cac4694c3b9a17b841af0aa9c72dd8e6a3074b23feacf6c3799e0d990b6c58c870cdcee1b646d32acc313594ba056b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2c95f46b6a81db90e06ff4d78f55de7
SHA1 5ac7aec00ee9a82ec821a491c9db5d65fc08e4e8
SHA256 34b2ff36d2e77795b80afa9e68d5210c37972760aff19d8ce18bbdce4d041ca6
SHA512 8764928f0e1b186e97abea7e2a162ed3da28e467fd26c8116955b2aa5972c9bb7a97c278d9bc1c55b5eb0d56b59afc0793ba72c95f67f66bc71d4b009e7d42ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c1380c5698c1564567f49c5e1e8154a7
SHA1 f197d143038f171fbfc251613bb44b8d99d6d0af
SHA256 00ede807a7f31fb20843dfd7bbb3a9e0b5583f09bf1848454e209691a58095ac
SHA512 bb9eea7a2a81d12226f584bca4402add31a45f44f4e6217c94658b235f27d0f4fc520f25e55ee9a39588f48c2d67bdbc5354145a9f5b359da0e42fea6223014b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71b4d60f44c2ff17f14b9cd338f53459
SHA1 f86e6ab5862dad71176579b834afbe25e952a123
SHA256 fd565c5e2620e108c84b8e6a710edcc84f6aa134aa965990c442d4c90d3969a9
SHA512 02cdd927463f5f28e3c5acc3ed41e2d0189da7b34fc7e065e230350bec66f6cec34155a6371e2d6c709a5649f1c80551a9b879cb46c2b9d41498fd85cb4417da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 efc5cf8f2c35536852b494f29f96eb87
SHA1 0dde38e15a7d7d05a26564767576ffcc77f36656
SHA256 ff4b70b65bb7479b6d74ce2090265d32f9bb791403eaeb6bcb707a416901c58b
SHA512 dfbf6f12e36cf367e556dc1e31988af75c8faa6de3fda91547b7f7fb4a2ed338ee6ddc96f73dcbe93e4f100ae868073a7b119031b3ead24e146b694cbe0b8682

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3873d5931c2553102f5197ca66d43e41
SHA1 a847129390fd2b0f82fb71e1f77f30a05e7b17a9
SHA256 b3825d02af08b35712aa90bfbcd8430ce86f1dec47ddb1f5a68ee44032adce0b
SHA512 c84d2c0dc4b38124e39914a0afa1687fa21ff650a0ef69e1271ad4de6b34d11b8732a4c8e9e4b8a47495ddd0e658cea4a4806521f7f93b8faa86249e9d5638bf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e03c56eed9a699a10107d48928f9e6a1
SHA1 18a232e8dec007f9d723188a5cf6a3e32bbf10f7
SHA256 dae899d8ead24ecf8e5fa075e705e7f3c65e471e63ef830e544b67a365650c96
SHA512 87690afd04fc933ae6213b4d7a1becf5122c72e9268e2b3c434818329e18e5a9471191cd369c45a6d671eba4b64a89f03806d0d26db2f12946b55934b4453d05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 80a2050d50067ba4533f78ce8afadc70
SHA1 4b8a57359ec5c5d53421fc713548b9c4df2acdcd
SHA256 a4d6f88f7e8141081441dd4fd7fb22228b4056f8a36c5f3a5188205cd4121bd3
SHA512 26858d5a929e080ac033363116f4af050e3b0fafac89e552902e71a48d24316e4dc5b684d3505700cd86810ff8049afd3b97ed9926044ab08fcde98d6e6ab1c2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NVDR4C1U\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\rpc_shindig_random[1].js

MD5 6a90a8e611705b6e5953757cc549ce8c
SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d28eaf61af040763d8ffad8f31dcb9d2
SHA1 17c95df03dee519f89e813b71e905e0bf28eb2b9
SHA256 6213fb24e0c86ed5dd0a7894f589ceed5f0f70a70f36654804dd77e025074738
SHA512 be95ce9f32e8461becb34c9f27701000d177d9c95dd1531b343f8e1e3b3ed0cd6ae3ea8960a68a70c100d57d7d9e017d47296a9478d524a1e66cfc6758f550cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4759ba053ca72bd3920fde74118d750b
SHA1 fee8cc39835395451f0dbb9495e966885f25a4d0
SHA256 2c3ff66ea3718eba14bab044b10e9cb16322354f6ecfc92e79901d12648111be
SHA512 7bda4e2ee3923980de97f4b61b5bbdafffb1c3fbc87cdc7f09c8ef073b5808e259ed9a79444066be0bf36bc5cac9b4b01232571205d19273083568493be36149

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ababc7a56b2f000519e0a090d521cf35
SHA1 87d63c326731cda994a8c90c1da7385885c54511
SHA256 5a62c8cfcd99b37ef89de2133891cf02d48d774587b08284552e691afc3032fa
SHA512 f35f1791b1e8a2af1c69316aead3273bf45d9b873d6f878d3043214f255c393cd047b4435e4da66210731e32fcc5d5425c1365fb3e3318ebbabd5b8b673702fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3df8d9fe5865f2cce25ee5b9efc84a7
SHA1 6a98fe054dcd559c2616710c6ae3caba3e55710f
SHA256 c01c98dc57ead14ff973c505266fe6fece46431432f8ce5c87adb04b01156283
SHA512 5e5e9fded974b667c28dec6298c8ed38bfc46b52361a8df8c3573840a86acb7494c7852fc9fbbb900958a682cbdd15a3d97db2ea97c2b6a4ee55e16db0b16dbe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0fc18912601e10319de475149277bf8c
SHA1 91b8f153ea44b8f29120c4ce2c01f402d7bef3b6
SHA256 fa344e7b7a4b423afc642d804329c5654347879df20a2ca5bdea587417f03fe6
SHA512 c089e12a8a6e320d5b41c96be079e90c8c6a02705b925f249b29d55eb6e0ff4508f94dfea4fb63dfc90a1eee2776977b0899e615a69a99b0586b83dfe081b6d7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a8cc8a480e42914a1ad6b78ec4cf9d91
SHA1 32d630fa22ce490104f1bb8acb64f5942c3f8a96
SHA256 fd6dfd863ead829efadd141bc2ea78a214616adf4e962c2be19f5bb58a6d7476
SHA512 970bce6e36a8c4d631ad2edf932ae42227079e8c44f43ef9e3af9179bec6213d5970bb4fe6b915a0b76202948701d711ffe0359f8525e76422b69dbcd9e04d7e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 042442c9957bc5dc6f6f1b1c3b87de4e
SHA1 ac66903f81973b8c68d4bb247ec0b3b31ff2deae
SHA256 8c8f5a830d6a83052757cfb42421f79b4f73c9be3d8765a16fdb5fec9e8e84f8
SHA512 aabfdc983f482e4d9bf460c34d34dbb9a02c7efcf90761e705e16fdb29ad513cfc75bff84fea75e701f1e507bea3a2da4592eb8f67ae77dcf6de27ed14e46f5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 af0f1ebab3b72ef3c69c368730d2010a
SHA1 02dbc94e7e96fa871ef14508eb19dc61aa8fae27
SHA256 13a8265b1452ccdcd3b188642367bbb23e1f058561cdace64ef07781249a3637
SHA512 23e578cd50622c0f0e0eb5eacbcc3e18f6d1b681081faa10ab27b077a71c5aa415971193e3ae6fc67d309f27f092163481406cebf2fb3ae1e84f853c7cd6f643

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7d916bfc741b38b832d53b75aad4091d
SHA1 5a0d422fb520bb1c635da1bef9eb5f6c9e6e1958
SHA256 8fd379e9bf9f8116526222d0cd362cba65291d3a55397e66e028aff8bbec0451
SHA512 4ef62f7cfbacb9902934612760681e371ed996910204954ad2d55d130d1c2337fbd4f5437e74e8dab39bf22043984d0a9b184a7f1433c094c36b5071d218a702

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6d9ea4536da6cd250ff491183cabd43
SHA1 75007a09ab2c347ad40be93db13af60cd520215b
SHA256 22768253030814e98a38a82ee47c5067deacd21184333e205eb29b8b74c0d6d0
SHA512 3537190e05e8943e21f079bc9cf5f2febdcde359e1b54212e2ada273e7c0ea8e5271cc5b3c4c94655ea6fc851b1ff36fc0f61374025f89e000e4eac048e6e6b8

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 13:23

Reported

2024-06-03 13:26

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91f0d0beb1f1c34ff7819e07ab199e8e_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 312 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 2976 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 312 wrote to memory of 1208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91f0d0beb1f1c34ff7819e07ab199e8e_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8517946f8,0x7ff851794708,0x7ff851794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,13652571909241650543,10159648256349095205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,13652571909241650543,10159648256349095205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,13652571909241650543,10159648256349095205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,13652571909241650543,10159648256349095205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,13652571909241650543,10159648256349095205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,13652571909241650543,10159648256349095205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,13652571909241650543,10159648256349095205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,13652571909241650543,10159648256349095205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,13652571909241650543,10159648256349095205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5276 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 app.involve.asia udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.179.234:443 ajax.googleapis.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 8.8.8.8:53 ecs7.tokopedia.net udp
US 104.21.55.153:445 app.involve.asia tcp
BE 23.14.90.75:443 ecs7.tokopedia.net tcp
BE 23.14.90.75:443 ecs7.tokopedia.net tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 75.90.14.23.in-addr.arpa udp
US 172.67.149.47:445 app.involve.asia tcp
US 8.8.8.8:53 zhafiraword.files.wordpress.com udp
US 192.0.72.25:443 zhafiraword.files.wordpress.com tcp
US 8.8.8.8:53 richardtakemura.com udp
US 162.255.119.27:443 richardtakemura.com tcp
US 162.255.119.27:443 richardtakemura.com tcp
US 8.8.8.8:53 25.72.0.192.in-addr.arpa udp
US 8.8.8.8:53 zhafiraword.wordpress.com udp
US 192.0.78.12:443 zhafiraword.wordpress.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
GB 142.250.180.1:443 3.bp.blogspot.com tcp
US 8.8.8.8:53 12.78.0.192.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 app.involve.asia udp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
GB 172.217.16.225:443 lh5.googleusercontent.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 172.217.16.225:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 translate.google.com udp
GB 142.250.200.14:443 apis.google.com udp
US 8.8.8.8:53 jqueryapi.info udp
US 45.56.79.23:80 jqueryapi.info tcp
GB 142.250.187.238:445 translate.google.com tcp
US 8.8.8.8:53 23.79.56.45.in-addr.arpa udp
US 8.8.8.8:53 translate.google.com udp
GB 142.250.187.238:139 translate.google.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 31.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 platform.twitter.com udp
GB 172.217.16.225:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
NL 192.229.233.25:445 platform.twitter.com tcp
US 45.56.79.23:80 jqueryapi.info tcp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 kumpulblogger.com udp
US 8.8.8.8:53 mylibrary2012.blogspot.com udp
GB 142.250.178.9:445 www.blogger.com tcp
GB 142.250.200.1:443 mylibrary2012.blogspot.com tcp
US 69.195.73.201:80 kumpulblogger.com tcp
GB 142.250.200.1:443 mylibrary2012.blogspot.com udp
US 8.8.8.8:53 1.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 201.73.195.69.in-addr.arpa udp
US 8.8.8.8:53 platform.twitter.com udp
FR 199.232.168.157:139 platform.twitter.com tcp
US 8.8.8.8:53 152.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 static.addtoany.com udp
US 172.67.39.148:445 static.addtoany.com tcp
US 104.22.70.197:445 static.addtoany.com tcp
US 104.22.71.197:445 static.addtoany.com tcp
US 8.8.8.8:53 static.addtoany.com udp
US 104.22.70.197:139 static.addtoany.com tcp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 ppcblogger.com udp
US 204.11.56.48:445 ppcblogger.com tcp
US 8.8.8.8:53 ppcblogger.com udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.200.14:443 apis.google.com udp
GB 142.250.178.9:443 www.blogger.com udp
US 8.8.8.8:53 developers.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
GB 142.250.180.1:445 2.bp.blogspot.com tcp
GB 142.250.178.9:443 www.blogger.com udp
GB 172.217.16.225:443 lh4.googleusercontent.com udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.180.1:139 2.bp.blogspot.com tcp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 1.bp.blogspot.com udp
GB 142.250.180.1:445 1.bp.blogspot.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
GB 142.250.180.1:139 1.bp.blogspot.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_312_BDKBDJUWHHIXTPUC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 720364484056727b1b63cfb8ac51ce46
SHA1 4900bff5d6e3ec36579d0e6b737cf9443a3b26ca
SHA256 379ee5b20d7393f0bf93dd050e3884b0d6d235ca56a10925998ebdf3ac0020c0
SHA512 a88c53b27753f67b780976856e7ace8f9b375c68b889181ae687e1c4d672f8244eef195bf082323994b36eb87c10781a78fef00069f9c8cc21f149c0d050a93a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 44d422bea7cd8620850f9c8f564bc763
SHA1 47a7d4af7ae1129b7d792c69bf31953ea49c9c5d
SHA256 7166cb46d3d4f2614350aac791558c74e7a6f5ef9045b1f84ab2f1b6bf35aadf
SHA512 6acc39d6ce80d35b4f13f0ef74ca07d7099e2ef88691c1e96ca4f0db994429ea088456ec844078a88c1f1c3031bcffeacf4bc92d9b15d7947dfd63db954084ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8f03e1c3e7236321082a41555a1bcc1a
SHA1 ee3d177fde0580c4f389887564f10a7ce5d5967a
SHA256 4daf6e88cb81997cacb99ccaea755fb51551db438f4224d798bb632e62abc474
SHA512 023d1739212e699deb4adfadd09ea303354cbeb890bbd0ac9114aad501eeb315b6a76e83a8fbc15a6966cfdf8f52c589a7e8fa63e3953b08571d08f1a0b74e71

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 1759fcbc7c36618ecc5fc60f05bdf294
SHA1 d618d3d64c317ac971b52b8396cf5355c1592bdd
SHA256 cc23fa67310b06d021a6673159c0757a431d2cacd6b7ee52ffd534b5e1d27227
SHA512 c286ce0c5c2ba26c2242b149773bedf01d8075e9073f9d88671042960e477983a629740f3606affff996cb2df8cb9ff85a1228c9affd77cda58121fa064e6949

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 c8593678129db69e670f4cb0382627e9
SHA1 10d7d82c6fc6f652018904c0810a76a64c70a03a
SHA256 a960a93aaa78ae69a65e887fc228461688bc777515756260d47fae6f89003fec
SHA512 434f878d11c3b7995d0da64845d3208cff868fcfe8c276cfcdf7926175ae0058fc32e0d5025d143e3e73acf106eaeac449ab9b07d0340591731ca2f8317707c6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe592ddc.TMP

MD5 ef93f0e53f41a00a297bb1b0b707543c
SHA1 57570d975edbcaab3d6d88a13d895283194ffd84
SHA256 970cece9211579b1dbf4fdbede232c45800e4565ff44f8af12c92db2c411fd0b
SHA512 1466428109cdc2cf2765f5f2674d02616b0bfb2338acb99f51ac710f12d776fabf8b9e08dd34283bf582174158383268bcec7f7da8fbc150f2831757805a67ba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d2bf4f2954d53225b5263ba15c88ab25
SHA1 32845c5eba1e980511c2a384115738ce7605ba82
SHA256 9a5cb90610ecc9b2347e451eb749e5898c4b1baf4168fce5f6e10ef9932794ff
SHA512 034b40cbf07a6a92d58cbb67e07f5dc59cc7c621e7730f4441c94bbc74e242bb6750c096dce229d32861e54f3c901963187957702c2c6150de95901cb4fba74a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 374f577c8745503e4fc9d7ec0103dd78
SHA1 ca9de154331951e05cc38108262243839752d520
SHA256 3a20eca82916ef7ce045609d2ba7d2d799991b4318a337dee48f191604d82b54
SHA512 49fff6848310335a5bc452b36c9cd78752641037d752b4cb49bf53330650c97e87ffcd60c29fc350c959cf5c411fa7eeb607a94accf0e62a4ae43a7cebb8b3bb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 3252f97d0b36a6b9400a47d032fd277e
SHA1 169cb92930078d68b4331f6727503723de3b4965
SHA256 f09dac91ab3fc6d8d668123166298c960d95a0f9807b0b1e65ad3cef155e7c82
SHA512 74123bebd901efab38dbde2c4e8f65bec39684dde27f9e56878c40d3d5c80368be2fc073c0a362a868fc43038cbaa54f7aaa0bc7b642faad213be51f8543ec80