Malware Analysis Report

2025-04-14 03:32

Sample ID 240612-2xam4sxgkm
Target a2cfdff2bc05678857109940cd42a641_JaffaCakes118
SHA256 5b672b2d87a11a4716ced4c14c32bda55d3f0d60dc3d5600dadc7fe835f63941
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

5b672b2d87a11a4716ced4c14c32bda55d3f0d60dc3d5600dadc7fe835f63941

Threat Level: No (potentially) malicious behavior was detected

The file a2cfdff2bc05678857109940cd42a641_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 22:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 22:57

Reported

2024-06-12 22:59

Platform

win7-20240611-en

Max time kernel

131s

Max time network

147s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2cfdff2bc05678857109940cd42a641_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d73bf41bbdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B47CF91-290F-11EF-917B-C299D158824A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000e97e9ff72622ef03abd03d85f0b82fce9534dd8c95a8d6b6fda5647610b78f40000000000e8000000002000020000000e70721f9440a24412a6555feac509a176e3a4f1e16ebc0e92b3e85a598a95f1c20000000f9404cca5fb5e0a8d28673812bd951de5501526a606e55012a79a22a6d02405440000000a5bd9af3c2d4e6778b307193b9c793811e8e16e2038ae26412535d72d23fb32418119f456c6f909c8ad37b2c2bf254e2b6c9c18c197a1e4042fee2bfb99dcfd2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424394902" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c0fbdf229a082ee27506b7d8f276108004d216134972ab3a8ea61a5bf037e0c1000000000e8000000002000020000000b61e2d52623455428b817ace51b1aa839e5b1155db62cd2c42da889f227ff42f90000000ce28e88b5d72395eee7efefdc71e966a47e24a271edce693c3505a98efb15a489c80b48173f4c2681d7ebe6a31e88a691f64bb86e2b556245c28f9dd587f516b7dc137847566b1419b4a4d4b1f52eb59e0298bfd1db91659ccff56f55cee909e6dbd06f59fbbb5cf79428623be0b5aea5e5df2d04ef9eeab4c01ea6de28051fd01559b509be6e0b4847075020ca55e5d400000001e89d619562cbe277897e46a16900361f463c470b93baedf13692bd316473a246c74c2da6d402cddefff7447228d97b1af56f169f20cf6657957d7614816735e C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2cfdff2bc05678857109940cd42a641_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.300mbfilms.co udp
US 8.8.8.8:53 cdn.adf.ly udp
US 8.8.8.8:53 imageshack.us udp
US 8.8.8.8:53 img826.imageshack.us udp
US 8.8.8.8:53 img405.imageshack.us udp
US 8.8.8.8:53 img5.imageshack.us udp
US 8.8.8.8:53 img17.imageshack.us udp
US 8.8.8.8:53 img856.imageshack.us udp
US 8.8.8.8:53 img7.imageshack.us udp
US 38.99.77.17:80 img7.imageshack.us tcp
US 172.66.40.139:443 cdn.adf.ly tcp
US 38.99.77.17:80 img7.imageshack.us tcp
US 38.99.77.17:80 img7.imageshack.us tcp
US 208.94.3.19:80 imageshack.us tcp
US 38.99.77.17:80 img7.imageshack.us tcp
US 38.99.77.17:80 img7.imageshack.us tcp
US 208.94.3.19:80 imageshack.us tcp
US 38.99.77.17:80 img7.imageshack.us tcp
US 38.99.77.17:80 img7.imageshack.us tcp
US 172.66.40.139:443 cdn.adf.ly tcp
US 38.99.77.17:80 img7.imageshack.us tcp
US 38.99.77.16:80 img7.imageshack.us tcp
US 38.99.77.16:80 img7.imageshack.us tcp
US 8.8.8.8:53 img854.imageshack.us udp
US 8.8.8.8:53 1.gravatar.com udp
US 8.8.8.8:53 2.gravatar.com udp
US 8.8.8.8:53 www.300mbfilms.com udp
US 38.99.77.16:80 img854.imageshack.us tcp
US 38.99.77.16:80 img854.imageshack.us tcp
US 8.8.8.8:53 0.gravatar.com udp
US 8.8.8.8:53 feeds.feedburner.com udp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 38.99.77.16:80 img854.imageshack.us tcp
US 38.99.77.16:80 img854.imageshack.us tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 172.67.129.80:80 www.300mbfilms.com tcp
US 34.225.136.145:80 www.300mbfilms.co tcp
US 34.225.136.145:80 www.300mbfilms.co tcp
US 34.225.136.145:80 www.300mbfilms.co tcp
US 34.225.136.145:80 www.300mbfilms.co tcp
US 172.67.129.80:80 www.300mbfilms.com tcp
US 34.225.136.145:80 www.300mbfilms.co tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 192.0.73.2:80 0.gravatar.com tcp
US 34.225.136.145:80 www.300mbfilms.co tcp
GB 216.58.204.78:80 feeds.feedburner.com tcp
GB 216.58.204.78:80 feeds.feedburner.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 172.67.129.80:443 www.300mbfilms.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 172.67.129.80:443 www.300mbfilms.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 8.8.8.8:53 imagizer.imageshack.com udp
BE 23.14.90.83:443 imagizer.imageshack.com tcp
BE 23.14.90.83:443 imagizer.imageshack.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 apps.identrust.com udp
BE 23.14.90.89:80 apps.identrust.com tcp
BE 23.14.90.88:80 apps.identrust.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 8.8.8.8:53 fc-lc.xyz udp
US 104.21.75.152:443 fc-lc.xyz tcp
US 104.21.75.152:443 fc-lc.xyz tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 8.8.8.8:53 s3.amazonaws.com udp
US 52.217.33.38:80 s3.amazonaws.com tcp
US 52.217.33.38:80 s3.amazonaws.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
GB 172.217.169.67:80 c.pki.goog tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 192.0.73.2:443 0.gravatar.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.200.14:443 apis.google.com tcp
US 8.8.8.8:53 s10.histats.com udp
US 104.20.18.71:80 s10.histats.com tcp
US 104.20.18.71:80 s10.histats.com tcp
US 8.8.8.8:53 s4.histats.com udp
CA 149.56.240.131:443 s4.histats.com tcp
CA 149.56.240.131:443 s4.histats.com tcp
GB 172.217.169.67:80 c.pki.goog tcp
US 8.8.8.8:53 developers.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 216.58.213.3:443 ssl.gstatic.com tcp
GB 216.58.213.3:443 ssl.gstatic.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
CA 149.56.240.131:443 s4.histats.com tcp
CA 149.56.240.131:443 s4.histats.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A8DU897P\d02a388791b1666ab0d775a06b8869a6[1].htm

MD5 4f8e702cc244ec5d4de32740c0ecbd97
SHA1 3adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA256 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA512 21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

C:\Users\Admin\AppData\Local\Temp\Cab9C03.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar9C16.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8fe09fdb33bb118beabe98818e18368d
SHA1 d8d457db73d92806a8facd9f8372c70baf002956
SHA256 67048da63654ace8a78c58eabef953d4815532e154c9926a94297e2e41b2451c
SHA512 2effefd5d1a87894f7cd5b6a3b7886166352dd5c516c8e6d5a60433ac8548ca8ae664a572cc11a81dec295b9667aee78f51295451864c59f7cc82cb29751442e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aa03d2d85c926a3c2b0c0e50c0a780c2
SHA1 735261ef9548b2d198a25e23922c14dee9703673
SHA256 deb76a67181c1aa22209a863ade749ee2f3f54e2ad662ac5a1a29aab812c6fbd
SHA512 7fc63e91f28d5da2a30080876a90cdce2fd490d0423e99143c9a053cdc56edfb1956478c3c85dbffafcc0df7f738affd8b6f86902d37938533755ba008e13c34

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20309336565451e00045e856e39cf91c
SHA1 292e3c2f74aaafcb76a823cb47345f3328ee8ca1
SHA256 0e91c4772f23b604b499c42787592565b6833d76fbcfabb9e492a89845f32bb4
SHA512 fedec403ecacf4cab8e3bfffc5e091c1ffa819c3cda7934c63dc9c91b8cb6159dc7ea3342c45919e8b3a0032f4038ddd2e5a0e0d8cdc490d6fcaebe6ac156afc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7875cf6dc380a034a2a07f7b1ddddb5f
SHA1 c290c7d02103ffc4952af3a4b7740c2cbd9ad252
SHA256 6df1f16203783bf8d8f12009b606236fbb14db73942eac63eae1906092448fda
SHA512 b6fb4a65469eb5c85807974b9c18d56222395d78f47bfef359084e462d446f68240c09330cdafcc56784c3115ad932064463f04ab2c8609227116c277c902f68

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5e294f612362fd673f92a39bf498fc3c
SHA1 3bb0129828a7d57e869e0a3404d4f9fceaf7c657
SHA256 3533a50bc05041ef735a004c44fcb4c29cc034d9f31957f951eb74db553c2ce8
SHA512 6e27e1200e13c071e18c229e6fc1d6e7bb921bbec519cc4e7595c1bddf7a553b2481e81c5bd21194da514d93099d816c863225307447e9eaec533cde1114085a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca4b4751aea6189ea296722cad3ae58d
SHA1 ca42ff44a6fdb863901b3288d65247484a25834e
SHA256 845570f9c31103a0ff1e32c4e84ae6bf3ac007267e2324079187e8993ac1a804
SHA512 1deb6fa517dd7c8f89bb4250224cb995c70af817bc3365663983cb73780d53f2afa9bec3a21ebf87abe9c59a087e27930243a3696175da13b6ab1639e0e8dc85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0febb8bfd0d455af3f76b31c127c4acc
SHA1 ab856d5c8d9979306b385894ceb659a584fe6251
SHA256 be84af7a0ba287506c31a11b63be75ea66986fb2149feb308304808aebb94705
SHA512 b905e3f68dc9c595dab9a4285508fce931d88ecfe8740a005b01a110a00301c8a32dd552f8b1fd0f9aa9050ce99ac292f5ff0109db1bcb8bb16114c8cc1299d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8cbb3ea5d654dcad25578e7a9d34ea4a
SHA1 6f199553485aafe35a635d8a37d6ab8abd7c3a84
SHA256 9429549b50d68c71dad2d9fae8bacff9d8a0246024c333c72b6a01b5510c133e
SHA512 78f673f1a38263c0dae54549066d31b6d9790ef3976fae46b54d5192433ffa0521498471eedda23ca1864eabb4b56d71c0df6d0c6827669fea8dcbb762189576

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HWTP8BNA\display[1].htm

MD5 bcd560eba80b849c980a5123047bc8f8
SHA1 cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89
SHA256 5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca
SHA512 1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fdcb6364c65648202f3407f0b1ba7a8b
SHA1 d33e08ee9d714e28b1ecd0baf3be361424e22b2f
SHA256 d4ddac3b26d03c47d36cbe0a136d95128ff073d80c4356982ac0af850768a884
SHA512 b933f98aa705ff9ea898708e22ca4026c11f318e4de25d5d46128d7e3ef2298a86d61cf62048185c92819805035f3008c07255562e69e1092d72010f41e0fac4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3eef13fb521e6c5b72418e31de8fa8bb
SHA1 6691bbaada96fc58b693b60cd58f8e1672779d88
SHA256 5a8ae4e57ec33385066fe19e33ea2d5149e48a2e9bb82761afa3544f432895a5
SHA512 0892ae7642971e57bef73b1b2000b38ec3ba6bc34ecfaabc4932ba3108793813d9892d4d9835fb695bd9d77bd06cb0b7763653d6321486e3fdfa37659fbcbbbf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8017157683468a2b2e7c1902fb81b52f
SHA1 87340cef003d4a38c06042a223a3282afe808f3a
SHA256 5ea5583d7b2ab267aab0f7eb9adfbed46d3fa2d0e8666bd92052bbea4093b075
SHA512 6447c674c2d2fc5c0a588b6e9a7f28e85b28e95697ccfe2419314fa1f7ee90f50207658ea4cff4542e6b8866e644ebfdc6efb2ec004822e30503dc80c1159b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 31eabc25ebf3c740b843e152ce0a39a7
SHA1 84904f64e4ade0fcbd3198b834cc1ecf3e854629
SHA256 747a97649772ec749984a8ff41c656e8b526de62c9b455bd22b6873e8a7ca195
SHA512 0b4afd9e706ea0d7b361bb733aeeeaacf2eba67d354ecd67bde88d55af960771eaa3b320bc13dcc3378ca8881cfd9c01c6a5ceeb8e78c6fe5e327bf9ba11f5c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

MD5 2c7ecdbbb063ea5981f2aabe7fcf9ac2
SHA1 5c92e25fa96ac7eb2d432563ce62be6a11dbd232
SHA256 a6420b0e8db153c246988af7382bb94364fe491631d88ca68f800e83750489c4
SHA512 8d7258ae557ce5f5fb98fa4da2f55036df3ebe308392f656a1bc21cf09f0d335ada0b44503fb523b16e8067bc7803f7e20e5e05bdfcc9b4ef970e763975b8c93

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

MD5 6073f86929bac7eee4df4ba6415c00a5
SHA1 1fddbad879fd2f552705d20f95d620d7428f6294
SHA256 48694a9be6374ba128fe0cc164df3928cc4341e5f9c0cfd7efdbfd2709938ce3
SHA512 39cba9b97437d463114231d143f1ca388a282b8203b0ad6ff3b0ccb11d8400f5d58474859e049bcd3effb52f484ffaff91d2fdf69453987450066227c3b1425d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

MD5 8e7d561b09687f3fa2c04026db79444b
SHA1 19d949cec3ecae0203d977f9dd896c7918c30ef1
SHA256 5b4c57ccf77dad931ffda1cc99e710baa992065bf4fda165e61fc0041bbe9bc4
SHA512 dc8ddad682be736330913e0655df1bb833c7a976c1e8014be2ce6d976d84b489d53d4453085a5e5cb943dd28101e1725e59e9882a6c7ac8e6ca74b0bd69b3f9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

MD5 17e744d2e4b4ecc6701634b55f952390
SHA1 5cb059ec5cf660477cacdd4652d53d1207d59a76
SHA256 22e352ef434856caa535f52203bca2e1dc0a9a5276e2bb65e847b9fa6ebbcd8d
SHA512 7decd7cee376105d2fc4b28ec2be079f5382e2ed63b9220e52ed2d1be9779cbe7280b60201f599087993d0738e8871402815bcc6303fdd01c2177e68583f6c44

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

MD5 8575991c186ac6dda305e9b7adb7dceb
SHA1 4dd782c5779c450ee9f0029bf8c9bd83fe45e85c
SHA256 7a13d74a6c4b3e58ba969206b5d2fe3b65a8452557fe0f4b8982d3753d182d32
SHA512 1e0c4de07423d7717c5e7d655236075f956fbc699476442ed2a81394d6d364817713929985b34007411d4c872b63d0bc40dceee3bce97a6b59dd70654515a1ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

MD5 19b43016376fc77ff8889dac5d30709b
SHA1 21d949eff2dac9e0c336aacc63faa866e6d23216
SHA256 b95a364520fe6f3d4d0c29ed740be8cb70ab6a7c549570aa8e76b56227700cbc
SHA512 90ebf04669751be2fc8743dc3549fa3433ab20c0c76955c858c463e69845da2b49e6f1dafe343daf584531a4c6898895b09b533e9ab783a4a79473964df2f116

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

MD5 8bfd22674b638c4e172ab55a8b10000b
SHA1 ed7b993a564e551b8179b7bbb3f7920fb834bd63
SHA256 72eecde0a2d0c248472ddd0d17c613a7c87ac7a356c4958557ae095a54ae5563
SHA512 8caed1382661344da14ae33c03af22e36874b9c3a481e3b2d262ccfa3d68c58cb9321bbfa2bf8875bf83f5f2d42e12cd1cd86459b38f0ec1cfb40cdc5d5a2643

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

MD5 5fbbd11da1447361d95430e07018c9c3
SHA1 23934454aa9c6076fe25696a8223c63ff258f496
SHA256 9018fa7df4d8c5ac5f77c69f1a33e696bbc91e2d44a64d3b81274c510242b2ff
SHA512 c3d1b0ed8493b07dbb496c8369c34011c9cd46c8020f9a693aa807baa5e375a09c0d633f14f05212d2e6ac7c4802e69bc13c186eb95086e0220a26a5523f4b7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

MD5 19748390e1c415ed271fc28fbda116d2
SHA1 85a0c099467201b8e4a39d9b0e5c1e5a2ae3f37a
SHA256 e5a25f43f39a389db78f465d103f34801e802886319333e2b4e6f7904bcadf49
SHA512 8b3b5bb97991d59e9c8900b65834575a2367cd343c2a81809b07f397575fa7412f5dadeb498283c9f29161017cecdaeec1359b3a3bef403fd0e132b6eea97cff

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HWTP8BNA\c3041e363d9dec93c6b80c758bfc27b4[1].png

MD5 75dfb23da6e6730d066e698773b3fd45
SHA1 3b45961e6fcf7708b89f59d28b18edc96a641016
SHA256 ca775cd8ab837239f9497e8afe90403d78cb37581c0adfe4003012d24bea020e
SHA512 0ed7f81c1cac69ed20470ea03d3f32c5ce8cfe16f9090470c300fb140f9c2ac96b43bbd4c6f229159b6b34fa1891eaf55e151ff602de8837e13059457a15c351

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HWTP8BNA\28ae2373450d5a4f51d6f7d4dc88e842[1].png

MD5 c0e43183a78510581da82893ed758fb4
SHA1 e7908ea4026876eab487c0ee4c411b9f468d5f48
SHA256 dc15ed14c23ce1a976a7306db458305071c0a119026ecff8be8536f28684e391
SHA512 b1b4b9ef5e26164478029b8c88e97b8c0ea511bd42ac3e7e39643c74a320cf0810f7477afb36350634a25b04fda2bae62b43b7d2a5296cd533973808f78e9ef9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HWTP8BNA\cb=gapi[2].js

MD5 0fe383a7ddb9bbaefc3105b3297f5583
SHA1 f80c9d789f251909c7560bd91a9e1b9a10c26362
SHA256 d7ad4aad4e48174c30ef21fc32c9380659d2c99a5c39680e10ed9752139d8683
SHA512 31de1f59377bc76e5d602d02273867ce750bbbccb7edc8f2803c0188002ecae6752ac3ec31c2108e64b0d871b01e6a8a06711969dc68bd9823303def0e7c1ee4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 859746797c9af634370c729df8053907
SHA1 d2fa966e4c7308cf4d72e1de44f9b80f74e676f6
SHA256 3baff9d29023ec9cb281e82cdc2649df8f8986815fd2a6011b736aaeea20d348
SHA512 d224acd110cd2251a92f4859cfa886ed5663ccec9aebe879174da4da2b7a22f50eb92331db3a4975ba189b957fe629e07be9fbdda4179477cee0adcaf3f2a317

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a91409c872e9f3c847d01f651422608a
SHA1 e7854cf536f146a97273d7c94f994a461014d76f
SHA256 3af7fd6b191a230fb08bf0e685c7c3a73bce71d689ef41680a65f2936d21a2a8
SHA512 468606823685778a4876a94d6e6e8c27ddbe93cd3c3e66ea0b7bd78787467355e0c914f57d982f1f3e28d4ef709101a7f516e70bf90760dabe6b2441b80df02c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9d306e6279e8696fd7df50451044626
SHA1 1979697f39a657e5e7c665fc8bc4cef529d1829c
SHA256 a185a298543627cfa26b9a309567c349a4f28e8ef8f6d310c66dbd10d5fe12f2
SHA512 14b53a2d8b053b12af9de552fafbdb7868b7e21ecbf196452b7a1bc1589f8513a14d80593fd2f56547a538db51fc8a383535af87a56c4b14c140b6db7f50474b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20e50331869a5b4542a75848a1fb7a79
SHA1 f53842e266425acd0d34bcdd76cb481da9ef1636
SHA256 7209c8434f9e3f302338e7818bf46f707c65aeee269f809708c1a5cc232f71df
SHA512 70c94b73cb47dc21b13a1f586448266ade4d5bd1870ab515313a3cdc8073b92ad904afc8156af1a9e6d7767b15267d3db3d549d64c7f425d8e287c5da17db3c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 013f9848831dad0d0fc43c71a7f2f2e0
SHA1 54c4b5efcb760272cd8944179bcf2d8d930077d7
SHA256 14f41c8b5b46fa91b1565722f45d3d4187bc537fc444feb8abaa7267ce27b303
SHA512 5c35921a34c3cfd8e51510589e4f639bf23cd81dd25d729bfe29427bc79004ff0ee898bb50a905ac1d8a085abce1af5843c274ea15122c9fe545188721c7ef93

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 38efc36458c9cf195419ec05b182a5f6
SHA1 fa19c271ad26dc59256e2284356a690ed8fa074b
SHA256 03a7e15ec08859f3a31765b6ece714520ce5bec6b85f33790de9d8abb83630f5
SHA512 79d5cacfa6dedf8ada2a18ef96e55e3a368c4d027cf4c29d66f4fd82d55cd1579825f2d35463ad92b1556253bb82b456559f1cc0f86f13f5ec0d0b3fc6fd8484

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 316db851f14dbb0e246b39429681ce39
SHA1 b564e7cb6677dd69c9a629d51af21daea6276abb
SHA256 ce8627e3f3044a4df7fd3449dd816f7590f3be0b85ae7d983e8b11e8683a504c
SHA512 69bec510313b06a75fa9a04731b2d3d17091939dd7b402ec691646d1f42e67c4e92fd15d1cee7ededbb812b5bff830bbd23aa32285b4a8e424a2c8d4e92b9802

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b998e0fa8b305ee301d96cbe9edc31b
SHA1 7fad1a98a712ae213bc25c193b3f2dab8a677160
SHA256 8567cc84aa88af03fe379773505b3be57d9f90ec9ef4b9072a8a87ea9fd8389d
SHA512 6bf7e80fd7c93da097967ecb8000cefd73d5e4e77a27dd9e3a8de6e80a887aadb8077d6f18c3d44a1a7c4d01c76a461164acece72346864599b2aeb2949f6941

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46652bd99d3b48c73b58234fa6370528
SHA1 606b9eabbd000b5a5f4d4e3e93fe4e21a7c05bba
SHA256 ad544fc4fb0f28b95ec79f9c82e9d58c5ae5454c5e9f42bd5f6a2b59ec9f22a9
SHA512 bec3525bd0daa06ab828ff35960e8d5f9c822ae047b74409796118a6065cd4ee1c15f9655422c64ca1ce5cbb9dfe930b33ce8646277c053fe9b46f3417d90fd0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 966efaa37afd1aca4f137d8e430bd901
SHA1 116d5c540f2839c1fa8a2f4b84b79f2824d0e834
SHA256 d4d60db015a22e87f25f1f534b63f795c09cec7179cbd8e4a0e9f8b8e1547cc7
SHA512 761099319b6fc2c7d2bb76523f3729868a4061f808e75c2e1d71484286a8de38db933c896993502981d8986d2bf3b3353c62bbb47cffe14fd8854da5d25fbe14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 62b84c33384e86e71ee913511bc3e824
SHA1 dc63d09a093d098928974e5d32da7b7bdbabcd44
SHA256 e09771f4eceacef4ed4d46ecd37a358c4bfed1dc5181e7a633e5613765f0c95e
SHA512 8f37da41d7373da405fa3d722430e9ee36e25863399d27666edb1b0a3fccb64ff6417d3d8a0f44e22db725ca5abce1039136a92fe2244194cffffd646a68a931

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7f0c6ee272b5d4d4a32e9c675c15b641
SHA1 ea754ec37b4e98595eefee6be8286870b9453d34
SHA256 a161f323519d0032b82d8dc193821d3e27e6b14c43d48953a6c9804179267454
SHA512 318fe9d16d5a9249e3ed2d4e569c068862300b00b0191611c13b1185aca2f6464b73a12603959c7d03e14ecc061739fcd36463e474a3675d8a506f6fa59a2329

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 348ccbcb83f156109cbd3e04a535e9d6
SHA1 b04e3e0d3c57555a1133d44bc3718c07fb611f20
SHA256 183223aea1541703d4c5f648736aec70c13457203ceadd32ef6fbb65a3935d6f
SHA512 d423e3b5dcce6211fc5e9763b17c850c4b708e827b07c6aace77114d69c2c2d001cd64819d634b863f1d4ffda4eb08d7390ec58ee44d771711b5edf81a008a31

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7238b991a5d6f3410c400ab032e18ae2
SHA1 554d02603c0998d01957d1ac5053ed8edf366687
SHA256 2adf9421305e2508dc5777702076eef81a020b2fda8312be0f74257492fc0d60
SHA512 514cfb25e249f67c9f5bce07e42e5084436e4fc270c81ed4de8f8411f89c5762cae4908522550b16c5dca238897dbcd74f0a23a5425c24f6e68a9439a81fac39

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 90b6ad2a203bdec87e144257b1a77180
SHA1 024c1288f85ccd892ed8ae71c20e261467ee8fdc
SHA256 dd9518f429e255b9091a4cd2e3bd79e919978c77cb29e9a219a0ddd947e4fe65
SHA512 15bb0f5ebea4301614734f0bbbe4ddcded915a8acb23832e4ac4f02a3f294a8dc3eebe35ac350b3ef5660561ff7d30f8c1ca891a8cf7feca89481dda05a8fabe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5e6442e5dbf8431212615522ddc2d594
SHA1 6a334255d1d65120e4909dfa1f99eda9e7ad9e09
SHA256 2753a6cfed124956eda638cebbfb996453c7dea46e232b6391cf12a1638bca4a
SHA512 66bfc15982797b059bb224becf2e9ed23e39b4480150fe0b4d21f38fa8d15ef3e5dfc29f1a917edb712af30b40cfc3a73917ad1add8a7a8301f275b439996064

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e63b98d1d11e78ddd706ba05ba277a9e
SHA1 f3727a5db3403eaa0b99d5ebde747b4e5e48678f
SHA256 cdb5edf02ad7236b048b51bdbbd99ca3062cfbae6e9f8daccd6598cf34c7f01d
SHA512 50597a8662af13ac9e1e26b30ea8f5fbb0fde043544428538e25d49128c37406d997307adf6027a989903dbc98b7e7f081a672d4f31db85870a66edebc7ae964

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2085fec33a39ebfb800c1e1cbe992c3b
SHA1 1d3e3d5ba15223d0ff7eff32497ade90c0b43b42
SHA256 b2552b0a7b210fbf1d0fc376460deb8a4d1aa3d0e6b8a2cad31e84f6b1716747
SHA512 4529a2b48c712fc52fc2485623a4a3719dc121b27680e856d43e79f2ac609456955911c4f3d344ce1deb49e43494849bff6d83532b7c2370adbbbaa86bf7b864

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 24971a283e880379a03217fe6c9d30e4
SHA1 f155ba08829aa4b9d954b619d22d9a5067349ed5
SHA256 69ebb28c8dd114f4abaed321197c3bf52705a897fff4c5e467bbad6ea90e06d1
SHA512 080fc2e6749711e296c1c359d00de1e3ff3b355742950b630a6bda6b711fdb5d71f82180b4d5e003351958567f7e9b7ab0085d529114fba55788af28490af8a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 64b39ec302dee708de8a930b7d2ea345
SHA1 e08d8591ccfd114964f1a3feee6aabb986570fdc
SHA256 77440e78a0b676b305049b4da28f6ecb2436598d79df01ea9ccefdd737855b84
SHA512 dea98e24b09f4a446011e21c44c0991d646f4e478c122b7bc62373d6c550ac5d36246c785151952d8e8806a1d36e2dcced4fef83301464aeab92271f239503f1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R3JK00ZJ\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z5LT06Y3\rpc_shindig_random[1].js

MD5 6a90a8e611705b6e5953757cc549ce8c
SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 22:57

Reported

2024-06-12 22:59

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

124s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2cfdff2bc05678857109940cd42a641_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2300 wrote to memory of 1732 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 1732 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 4504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 1860 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 1860 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2300 wrote to memory of 720 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2cfdff2bc05678857109940cd42a641_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2416 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10731478955443780670,14394856589302026929,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4356 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 s.w.org udp
US 8.8.8.8:53 cdn.adf.ly udp
US 8.8.8.8:53 www.300mbfilms.co udp
US 8.8.8.8:53 s7.addthis.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.300mbfilms.co udp
US 8.8.8.8:53 imageshack.us udp
US 8.8.8.8:53 img826.imageshack.us udp
US 8.8.8.8:53 img405.imageshack.us udp
US 8.8.8.8:53 img5.imageshack.us udp
US 8.8.8.8:53 img17.imageshack.us udp
US 8.8.8.8:53 img856.imageshack.us udp
US 8.8.8.8:53 s3.amazonaws.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 img7.imageshack.us udp
US 8.8.8.8:53 www.ubxtoqsqusyx.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

\??\pipe\LOCAL\crashpad_2300_PODKZZSTCVVHTSJC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e681a62b466eb25b4a4c9acfcb525f31
SHA1 5366e3fd4d866bc5ec2b6c2c2a18293cd8414f23
SHA256 ce46a88328ee5f2560db800e6518991ae11b9fb5a7324d307fba879d57158f84
SHA512 1d0d66382c955220c429f6379e61462223777514e26079865abac1aa6709b229c9023e6223c732c55f8d0a4f8a7342029f7918d1cb3f7308ed49eadd1c71c2fc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 74c7cb675d7e953fe1d7e027efa97d38
SHA1 b3d689f88e2dd890efb2fe6f4b71714d7537f118
SHA256 56c072b32abb655c9b8697f117b0731b8de95878cd016c4219c0adfb0a6f4e2d
SHA512 b364e335b0365baa4436acc9528c97563d8969be82e961d5b042e37c6b076db8d943f5a35501d88fb9c87a5bf8a3337dbc3da706885655188a0d823343611586

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 eacefab8aa4ab0db453810f4ec33fca6
SHA1 2096bcf903ac387e9a397a204c4ea3a3d28c7ae7
SHA256 eb089dc31131693cdaa53892411c8914638ceb3279dd3974ae4ee862eb6a09e0
SHA512 b2a621b57b3f4a316ed790141d2cdc6e4840da4664a82bc6e8768c93c7f09bf598cced2db735712a40ad06327aff8b9d64667f7b1b0a85cd10ccafb570d71832