Malware Analysis Report

2025-04-14 03:22

Sample ID 240612-t2vvvavhmm
Target a1591061c038b5d87da079c03a27084c_JaffaCakes118
SHA256 863542507669d5460e2da151dc6e0ed69914c58f1107a3f83c269cc1f6dfe595
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

863542507669d5460e2da151dc6e0ed69914c58f1107a3f83c269cc1f6dfe595

Threat Level: No (potentially) malicious behavior was detected

The file a1591061c038b5d87da079c03a27084c_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 16:33

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 16:33

Reported

2024-06-12 16:36

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1591061c038b5d87da079c03a27084c_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1591061c038b5d87da079c03a27084c_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4840 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=2828 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1720 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5424 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5752 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 13.107.6.158:443 business.bing.com tcp
GB 13.87.96.169:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 my.rtmark.net udp
US 8.8.8.8:53 my.rtmark.net udp
NL 96.16.53.162:443 bzib.nelreports.net tcp
BE 104.90.25.175:443 www.microsoft.com tcp
NL 139.45.195.8:443 my.rtmark.net tcp
US 8.8.8.8:53 loadus.exelator.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 158.6.107.13.in-addr.arpa udp
US 8.8.8.8:53 162.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 175.25.90.104.in-addr.arpa udp
US 8.8.8.8:53 8.195.45.139.in-addr.arpa udp
IE 34.254.143.3:445 loadus.exelator.com tcp
US 8.8.8.8:53 loadus.exelator.com udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
IE 34.254.143.3:139 loadus.exelator.com tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.189.173.21:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 21.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.212.234:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 234.212.58.216.in-addr.arpa udp
NL 23.62.61.57:443 www.bing.com tcp
US 8.8.8.8:53 57.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 16:33

Reported

2024-06-12 16:36

Platform

win7-20240221-en

Max time kernel

134s

Max time network

128s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1591061c038b5d87da079c03a27084c_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87443071-28D9-11EF-9DC0-D20227E6D795} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424371889" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a9820ad4987544ca8dd9549ffefe94500000000020000000000106600000001000020000000e0cbd97c9cba41f68a03249867bebb6c9f2068bb387e25bddf590437af9b8982000000000e800000000200002000000065283e7ff9f6681cc4922b93aa1e9b84589ec46cea4c8d2008f37e682b2dcebe20000000f97621148b81ba42d1b32def0085d927350d939b942187e0de1f74e563bb06fb400000000be63ab1f53f3ccf0b0db7f486faabc7d90fccc55f10e3a960f1243cb493bb76d7d1b304ec4095451aa1c2a82950837e7844911de1db0fa32357386fa583d0c6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a9820ad4987544ca8dd9549ffefe94500000000020000000000106600000001000020000000583e3aa6d6e7a410ef589a478587a073becc7adb4b261b0d7cea97b70587b119000000000e8000000002000020000000215f29ea3361854055a494a4c721ad354485b8b97905c33ea4ddffaef33edcc99000000097db55e6b41cdcb71b33a57c39c5bf06f715aaa38535e9c1830dc5a10ccc81f53ee5cbbc43964c57558a7792335c32dc4518406097c71bbabfbd8ab978d8f30ed69c4ba89f533fc750940d419a2aab174229abaf7f38d5747035c1acefc3bb9d5ca49661665f9662fa710268c6d6f92c47b4748d028eda16c4f180341118a4e3400ce12d0d5d563af1e24c75261eaf5940000000d51202c47ff3fc3e36b122b9c69222c498da38a18dcd0b1ccfcf4e493f437ef516dd6881c5f750e7e391a02014b7723af2b298e1829e50bd19fdd1aa2c9f8d06 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0988e5ce6bcda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1591061c038b5d87da079c03a27084c_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 my.rtmark.net udp
NL 139.45.195.8:443 my.rtmark.net tcp
NL 139.45.195.8:443 my.rtmark.net tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e9a45921cf0f788c795d94421139ff98
SHA1 7306053d3c9ddd10adb50fafc498332ca0084cb5
SHA256 703b8c9c80ac8599fc241acdf181e214cc3cfb0ca27b27f436a19e6f5767e690
SHA512 1a434f4d24956b6041db80589d2bd6666b7defc99405d6a4368a568d22e87d3798fc93cc11b7b27c423ab06334b947c3b0a8ede0e363df9d8f50ce57c658edb6

C:\Users\Admin\AppData\Local\Temp\Tar4C60.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\Cab4C5D.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar4D50.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7e737493327ba913e2eeead4f4f35d0
SHA1 1d6dd3f60ba45e59f5a0aa844d23b5049ea424b4
SHA256 cd90d282ff863edd020e65559d74e9beb52ca40caf8a53dda20a7899abe549c4
SHA512 c93629f615aa84303b341d5aba6fadf870b41cf61b35c27c0054eae746c6ace25a736345f02fbd32c80c7c26cf38c59501989aed70ebeb373c9d8129861c18c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b818d22750022272557180da853b883
SHA1 c5e75513c667db722463c7880a90b6f55e0bcbe7
SHA256 d3111252db5b907996c2ba5d787a48f21d7a55c936307cea843fb91906b7f719
SHA512 f2e2c1a52958d18cb52f7a16aae4cc07a54264fbd66e5fb5067a3444ffa20bee670695f5bae04555f29eeab41c0028589635e78b41548adff25ef49c2c150f97

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6108d0301be062a80995f62bd76a24a1
SHA1 b0287cbc72ddc45d2c218b0e7b755f9b2cba770f
SHA256 a22b9980af08f79559ec6ca912cc1323c4294cc36eba4066a2fc2221a641b93a
SHA512 5ca6947dcaa768bb3a42226dda677a002af538aadc1e5c32bc361862284506c23b684719384e8ad58337ea4143cdf60ce4589ff4a603565313421b4e49adf6ad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e758fab9d28351bc94659b42e5d2f6f
SHA1 2fcab0a18d20ee37891bcabdd9d407e20875a24f
SHA256 ef616f23ad362a2af19cb1be871751a070b9a13da5e4657b9b95acd02e0966f0
SHA512 5ef0024653d851580699803e20b9149b07aeb6ad3ba0c458317dace4f1ea41439cda8a7e8bcbc3351edd75210ff0b60bc792cc71fa42cbf6ae654756c37a47b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2473e7996c7bf846402070b33728388e
SHA1 612b491bc21ea361379252a0f0a1aec9981f672a
SHA256 890eb218f2476dc67c0d6991209bcef5e405f2dc435d901b4d3d37ea327d894b
SHA512 1db50a5cc632cf43c7388b27ad92cb00652732c871819b2f7ffe73dde77f06d402e04798310f42aa6c2ca637f539d99bae499c921427b9a8ec7d48d44c1c4cfc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c52af4488dbfec57b1ec62fe04568cbf
SHA1 a520350aa884bfdeb2181d27fe0611f5f36929fb
SHA256 71d1f60a743315b1217cdb5ce9bec92b9c3383fac4dcc81f8e144138cd568b78
SHA512 b471b29da0e0471094eee411451494ea92a300c515a15c1452f41670a5064ebbeeaed406102e3517decdaed7f74a860dd0da93bda09b3592e64bd7384e8bcc92

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fb833bd463f62f1751b2023eda2f3a18
SHA1 8a2cce83bbcb5e41750aa732139b21b763ac713c
SHA256 b1a2b410c4f3b95fcf16d0555a593b706a5f414619855ce972b1475245e5da65
SHA512 8bdd9c442e6d7cbfb32732760b6c6b1e3d50b88b87aea616d1c7a586f12e06ff6e5fead95ef42fac519a3331c59254210f81c64cb3c2cd2997a9fa6c423607ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd184dc265741560052e467f67c93942
SHA1 cffdca6510406fef09319ae35327104c898c8fed
SHA256 8f4f353005a450023306e325781890d858976b407c9362056f2fd3f25f67b767
SHA512 1586f97ac5531af4f490e16217159246fc1b41b6fbc930bc7ee66652464b1f49e2e02eaaad676133ead5d00e3a7dd9b72de739eb96606be58a479abff1ce885d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e1d552cdff5249a7549d1dc4eb855865
SHA1 d91f1f4ebec5d5e0f5adc1c831644a37c570b2c3
SHA256 98c234948c6b2ca4f982c3a8192a045e72ca27745a60660601c996c28742dcc4
SHA512 47c10a21e3a6ac4e7148d397291c0937a0e782d59a00bba7dcead199ec2e745f787cbf679051c48054e475fd10d6640017c000e324bcef014094a11242fb4dd4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 522c4b4fdacfaad8223ffa0bd86f2a9b
SHA1 09fd78b01dab0771051052d49b865c604e933c3a
SHA256 ff65239dc28fc6143f01be8f284cd2d9857ab92c31849e9d5c53381ee106835b
SHA512 3b718893fac97ed2baec36c855c81de85c24faaab3789094b9ca83c272d8c33aca926f9480bb4dfe457c79acb18f1d1c1ba290fa4605181591c231a4a404c6d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 26c91fa74ffef817e23343d497a5192f
SHA1 c90c83f4deeae06d08668f1d7b1c66664556953e
SHA256 b100733277bfc638afc35be5aba6edd8fc644f0907bf06c6de3e231cde7108c1
SHA512 2740b21368289dd6743f50895b52742976dfbe5ea91f47c41431e05b665d75e40ab65b335cf7ec615efbb9eda532cf5accab68b35b13da02906b887884817b91

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 33e03d1499b7bee1736a10a1fc2c0a76
SHA1 e59a12229f472cb5d5883d5a4e0a0b4df0fa08ce
SHA256 7f9fdf20c630c7d404dd9707f1da9eee4e5ec871a9d7b44903ed8c242ae49712
SHA512 68efcb897625abab5b83a4ab20872c2816a3d3bc438319a4116005847063853331d44645271c917b88e94c431875ba830e99a1ee1ac59b3d368eeefe31b055d9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46068c644af9fc6793bf3cfd7089d8ad
SHA1 9b08fd9c4f8be3dfd7a54abb75cfb87e40206451
SHA256 3db263926142d283395be7e55231dddeea9fb3779bc41750e99b530747d67dc7
SHA512 d7ea794b0efc7c7f9f90e7ba40b4fa3baba88acb396f1d5f4cbbc38d0a1eb1520acc2bf282dba045c89442a642f2e0deebb4c6e653aa7d29a47dcd2cdf971d35

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 86287641dd5669cf5eae73846d160c6d
SHA1 045cdbfa60c8417a2d24324557a522c24313440f
SHA256 a64a1f9eb047855d359b5e576edf3ac437ac92ad2c50b0389bfa5d8f2c9c234b
SHA512 b958eac1d5d6b58bcf4ca20102ee68ec0ae262865b3f22ac64099ea80d8317a114e15f444298681752dfd756c996e49334f380786095ce69d654d0fe2248263e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2fa26cfe14f0844d65aa750557dfc3b0
SHA1 d7fc968f769b36b4a532dbd64cdb7f2de998d443
SHA256 3fb86ce2f67282e1dd39fe2f357819e1d8a2a26c0eaed5041e82e4f3e840bafe
SHA512 893d23788ee1f165231d2cfe10b2f3798c0b09bfe168de29bb550a0f9c63ffec83bd246e58a302b7b53ba75382beb5705df7f49b5e1c938f5bcd753f5ebb7610

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 31c8743631a7ae86eb24065b5e4a8976
SHA1 7fb131f6342c8e8d110ad0570c3b7ddd4fe0b028
SHA256 f8c9a5d4e9bef87d32cdae7400b3db9c102fb1fbd34fbd8dd12292ce2e188954
SHA512 b08bd7cd5b0b18d1c54388cbb496247dc5aaa88d197388684f39677894936f1ba7f7986f79ee951410556fb00c07ed4d5cb22a200c583abe6c5bd30eb8d74fba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c52e0e2a2063da5206dc6b99fd8da621
SHA1 f0dbb5cc0d9cb2b7d3490718c51d6c2bae0985a6
SHA256 f950b8499158a92be6020ef4f75bab246cc44b8341fba17626a2cfc4d63db401
SHA512 6cc87040a26899b7a96c635c9aa46a6630423c6d8b155178fffce8906cb98e70f8b00b9c87e909fe016671c2aadd74ca9ba37e613be306e52a13f94d4f512df2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 213240bb33b9682e9e3d2f16aa2cb99d
SHA1 95bb8527cb2c9d907aea0cc41a7de77b71ff0289
SHA256 25d937ee4df08f8496242e19b32a9134c170b2fcc0fdce22f00f1914661dec83
SHA512 221c79190d9d2957f81d4847fd8ef5135567b78ad03b9d3eae774b9e569ecd34f2ea1578b9f5e80570db267dfd6f48e3504b689d6fab0d8e37d2057293efd423

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3be410ca7b4857435753baac0c21d49f
SHA1 c92ca130fb14cb0a11c37ca7ebb1f4ff24cbdfbc
SHA256 ad0ec9e2a88469db95ff1e82bfadbea055569521308a3e8f56ef0ed244a5eda7
SHA512 9b7a2782d7193aff01ebb69ebb84acceb161489e1b57b5756661189ea92dbae642670459145719c25d84396f90e48c1b7ecde253fd330175c9e169065c6ce493

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7be353661c087697390f680624e572a6
SHA1 24ad36749112af29cba60f6d8de11fcd7a57ee58
SHA256 9087d165e9b920b9b8462df3d68107db80a43d9072d48f485d7f9dce91c23de9
SHA512 b6ebad6ff8658ddeb1890ab9c209a66525d26ca80f73e1a4a3170323eee1fd6985e4ef44e45eddcedf34407d8cd7cf781da51e108e1acc8b13bd9b1b187cf855

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d5ef69e21b07258fcb76e9ebde74ea47
SHA1 f83400a2da4b8dbd5fa7e6670d6652819c194809
SHA256 896dc56cb2fa0972b5e470a77a5c8d5b5b042c9803fea5c075d2e7fb92a94974
SHA512 e9a9a251a3488095ed55992ed8a08086d819ef6d798491400b0e05186bbff6d63e6eb777a7cefc2a866e2261e77eac4153d2a0acaa16bf5b4d5eab33ac814fac