Analysis Overview
SHA256
976828f1f7ceb436fc5f46be94a2778dd8f1e0a9976f62e94ef26d0d67276f9d
Threat Level: No (potentially) malicious behavior was detected
The file a6c68b90e1c3c2432b3b7e3ce29b6c29_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 22:00
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 22:00
Reported
2024-06-13 22:02
Platform
win7-20231129-en
Max time kernel
127s
Max time network
144s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b92d2db5555ab04cb5e7c82991e8e746000000000200000000001066000000010000200000008236c2b0bc1fc649676968072ed157f0b1274371ac23575f5ba096d76536fc71000000000e80000000020000200000008a6fcd0e75eaef89e79c9b7c3ea7a3fa709529a54799141d64f1174d0b7f20c890000000f767a4ac1a7d35d3adb51fd00ab0c2991fc4c30582e5bff468c45b765852e565a4636934a88a15493f17bc6ab72ad8fc225448256de64a3815aa238741dfb450d99742c4463e2077689c6e4c6057bddbf031282cbe410f7bbc9d6231de79418ed3ffd7ba0251fae89e99f2b1f4488f56598b2e4ba1113c10324b7a57f407ac59055cf6cdc1360558f713bec22fb448c7400000006fc221b38dc95893c71ddd0e258c1a2ffaf9d1f4aef19837a0f571b11c2725c7e7896634a77df95953c328e114c51c857ede0953fc0db3a1825cdf076c42e177 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b92d2db5555ab04cb5e7c82991e8e74600000000020000000000106600000001000020000000fe8ec64fc8c141dc00b9fefbc55ee3ec869af3300d1bfe6e5028d502b75d8775000000000e800000000200002000000062c628671bc3e644b8ba46422c1a0b34f5335a2a4031b4ae38ec180438ae45b720000000e6bfae6c2e6f68936d5ced6cefda2385d3f4e86c93a6e8a0798a150bbf4218854000000090ee170e3f8c64da3872e7eee5861b2b0ee5b7b7fc07a1d4eb6b1e22e73250eee2b737b3591cada22dcc6ab8e8113d3fab6d6f1d01df57c8418b5ab81203c481 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5010d723ddbdda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B3D36B1-29D0-11EF-910D-CE7E212FECBD} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424477874" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2044 wrote to memory of 2388 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2044 wrote to memory of 2388 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2044 wrote to memory of 2388 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2044 wrote to memory of 2388 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6c68b90e1c3c2432b3b7e3ce29b6c29_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | dl.dropbox.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | bloggercomment.com | udp |
| US | 8.8.8.8:53 | twittercounter.com | udp |
| US | 8.8.8.8:53 | img838.imageshack.us | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| GB | 162.125.64.15:80 | dl.dropbox.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 162.125.64.15:80 | dl.dropbox.com | tcp |
| GB | 162.125.64.15:80 | dl.dropbox.com | tcp |
| GB | 142.250.180.10:443 | ajax.googleapis.com | tcp |
| GB | 142.250.180.10:443 | ajax.googleapis.com | tcp |
| GB | 142.250.180.1:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| GB | 142.250.178.9:443 | resources.blogblog.com | tcp |
| US | 38.99.77.17:80 | img838.imageshack.us | tcp |
| US | 38.99.77.17:80 | img838.imageshack.us | tcp |
| US | 34.193.97.35:80 | twittercounter.com | tcp |
| US | 34.193.97.35:80 | twittercounter.com | tcp |
| GB | 142.250.180.1:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 1.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 1.bp.blogspot.com | tcp |
| GB | 162.125.64.15:443 | dl.dropbox.com | tcp |
| GB | 162.125.64.15:443 | dl.dropbox.com | tcp |
| GB | 162.125.64.15:443 | dl.dropbox.com | tcp |
| BR | 45.152.44.151:80 | bloggercomment.com | tcp |
| BR | 45.152.44.151:80 | bloggercomment.com | tcp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 8.8.8.8:53 | pki.goog | udp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 216.239.32.29:80 | pki.goog | tcp |
| US | 34.193.97.35:80 | twittercounter.com | tcp |
| US | 34.193.97.35:80 | twittercounter.com | tcp |
| BR | 45.152.44.151:443 | bloggercomment.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 34.193.97.35:80 | twittercounter.com | tcp |
| US | 34.193.97.35:80 | twittercounter.com | tcp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | widgets.amung.us | udp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | usuarionovo.com | udp |
| US | 104.22.75.171:80 | widgets.amung.us | tcp |
| US | 104.22.75.171:80 | widgets.amung.us | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 216.239.34.21:80 | usuarionovo.com | tcp |
| US | 216.239.34.21:80 | usuarionovo.com | tcp |
| US | 8.8.8.8:53 | i43.tinypic.com | udp |
| GB | 142.250.180.1:80 | 4.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | lh3.ggpht.com | udp |
| GB | 142.250.180.1:80 | lh3.ggpht.com | tcp |
| GB | 142.250.180.1:80 | lh3.ggpht.com | tcp |
| US | 8.8.8.8:53 | www.usuarionovo.com | udp |
| US | 8.8.8.8:53 | developers.google.com | udp |
| GB | 142.250.200.51:80 | www.usuarionovo.com | tcp |
| GB | 142.250.200.51:80 | www.usuarionovo.com | tcp |
| US | 8.8.8.8:53 | i41.tinypic.com | udp |
| GB | 216.58.201.110:80 | developers.google.com | tcp |
| GB | 216.58.201.110:80 | developers.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | ssl.gstatic.com | udp |
| GB | 216.58.213.3:443 | ssl.gstatic.com | tcp |
| GB | 216.58.213.3:443 | ssl.gstatic.com | tcp |
| GB | 142.250.200.51:443 | www.usuarionovo.com | tcp |
| GB | 216.58.201.110:443 | developers.google.com | tcp |
| GB | 142.250.200.51:443 | www.usuarionovo.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 172.217.169.67:80 | c.pki.goog | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.180.1:443 | lh3.ggpht.com | tcp |
| GB | 142.250.180.1:443 | lh3.ggpht.com | tcp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| GB | 172.217.169.67:80 | o.pki.goog | tcp |
| GB | 172.217.169.67:80 | o.pki.goog | tcp |
| GB | 172.217.16.225:443 | lh3.googleusercontent.com | tcp |
| GB | 172.217.16.225:443 | lh3.googleusercontent.com | tcp |
| GB | 172.217.16.225:443 | lh3.googleusercontent.com | tcp |
| GB | 172.217.16.225:443 | lh3.googleusercontent.com | tcp |
| GB | 172.217.16.225:443 | lh3.googleusercontent.com | tcp |
| GB | 172.217.16.225:443 | lh3.googleusercontent.com | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| GB | 216.58.201.110:443 | developers.google.com | tcp |
| US | 8.8.8.8:53 | themes.googleusercontent.com | udp |
| GB | 172.217.16.225:443 | themes.googleusercontent.com | tcp |
| GB | 172.217.16.225:443 | themes.googleusercontent.com | tcp |
| NL | 23.62.61.194:80 | www.bing.com | tcp |
| NL | 23.62.61.194:80 | www.bing.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24
| MD5 | 3e455215095192e1b75d379fb187298a |
| SHA1 | b1bc968bd4f49d622aa89a81f2150152a41d829c |
| SHA256 | ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99 |
| SHA512 | 54ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar1183.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5f62adf5f5281504f00706e591a90996 |
| SHA1 | 5c5c649c00c1cf7c845f231c6badec841ddd9708 |
| SHA256 | cf2341f62a9c420338b493c1a374677662070fc595b9ef53cee314bd528d5d5c |
| SHA512 | c170b64a58291e8d93e474e34b44f20f358f8953ad52195694ea70b6c51f872b1a4a1d479513c7fbdcbd4cbcefe4b39a640750367311fc295168d4617edc7bc0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 6c7844764202e4fd0ceda314b25cd97e |
| SHA1 | abde642c7d09c05193ea4978977ec1935c106f8a |
| SHA256 | 1828538d866e6211bd6e41b05e05c09f1f544b22868b65c70fec815ff7aad003 |
| SHA512 | 9fdc8d6c50110c7ca08b2dd86af3ca2972dc43b77ff9c56cdbf94ad68ab41c322db38b132c5f88170921974a1aa09673d556c830a89230f90fb253fd565dc0ee |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | c2db54e9bdd9aea59824d5768a15bdcf |
| SHA1 | 328dc6d61838fa53aa703e61127fc3c38b56c84e |
| SHA256 | 0e2bb4be0eebdf36e984d0c3a042d868cee5f6df2522caa511d4c212e7147975 |
| SHA512 | 47031b11a4d2d64d6c5f05dd274801d6f58031aa5b7993f728574fa211073b84bda6d8cfc28a11f9d58b429bfd49930a89cd9d50dc69fc4d06f570188dd328ae |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | b49e0db1b30c0159d4b4e67dfb0778ce |
| SHA1 | 77536e8aa06b24e12d77996ba5dbd1672c316d62 |
| SHA256 | e6058d29b6182cec7ce72bc596bc2c789ee9d73e999848f9191e8ee7ad04a107 |
| SHA512 | e5ae9ec8856539e2a529d42e9f1c41ef586f39594fe013a486ce945838d5f3c5546180c22a9e8ccadeffc284e00b4aed8c25bd817a2b635d14e2fb7756ab4a70 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | a08991b3b3149042115bebb75a76ccc0 |
| SHA1 | 4f1a11c57b43422713fcb9c7af450a3a547ad11d |
| SHA256 | 827224a17beecdd911e49e0f09ab9665246f781744d1241545d6aefe2e67c788 |
| SHA512 | dc3f8319b0a7ab3e3a37447cdd60b3772bbb5e73cd44e9e58c2ad979dcd68f48f675c8a0a2626e9d3af5d4c664a9dcc52b786b69946236d8f89d12371d987fac |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | c19a55366744ccc2342f9ea2474f5cd3 |
| SHA1 | 2140b7203da8797506711c9157078437da6b3f71 |
| SHA256 | 548939bd4cf7db1d67dcbb8bda0658c0de659accb3bfa16ef968ecb7ff5c2d30 |
| SHA512 | f6892cea5f11aa92a9c1839b2161a6ff0fff46e057079780ae7d3b63b46ddd61882319569a461d4d164de63d17abcc856c1667b056d7d8ef00c2347bb7b1683e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
| MD5 | 9dd859c30dc8c5ea16c4d99e6f4d7966 |
| SHA1 | eac369e5c43ff8c15deb6f26dee625b0ee7ac72e |
| SHA256 | cd5aea16087d8f2ab8186b3b56e26c5f306e28e37bc40cb798ab58096d9abd07 |
| SHA512 | 7fd8aa44bc8f96015da360d6da8616865c7550a5c4e1e5a379d5326f952767618dc7d8572acdb0d83c48d18c1ed92aaf4d0141828010bb5daee5ee15cd405694 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | ac89a852c2aaa3d389b2d2dd312ad367 |
| SHA1 | 8f421dd6493c61dbda6b839e2debb7b50a20c930 |
| SHA256 | 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45 |
| SHA512 | c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | 0cb52e135e0a3868559b600a34ecbab4 |
| SHA1 | a539a1e1ae99328ee73a5bd36e5cb7ec1e88a731 |
| SHA256 | 931d5b927430f41dff44ea2811605cca9d7068b5ecb009ca377d619452dd4c19 |
| SHA512 | c87a9b288d966c30552e7eb60d2dc4ff817754cb02a694a69fabe8b10d0dacd5722dd68c54af95beb2ea7c3bfa1bb3bba84748de841bed0f74848c8396626644 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | 04336ee46233af4b8bd0c23aa0d713ce |
| SHA1 | 5fab1a58376a88cb449620aa78bf0b65a33ee73a |
| SHA256 | f2aecfb1884c3cd882166c689cc19b8b6dc7e9b7915f9516c2e81b04fd2d93dc |
| SHA512 | 3bd10b1434ab1ca39cf8338c89fe4ec671f25342d6dbcfe1e19686aa5425286f5166715cda342b2b7a72abb076956c056023f73a11a7ea970688ae2b83911d11 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_DACC52A1882A05AED14688828CFAE295
| MD5 | 7b1741c1b825eb84417708afe78f926a |
| SHA1 | 038bff19848caada3c89c839eb0772e666e87092 |
| SHA256 | 1e645ef6cde8e774d2958f4e2988ff3470be621f24ce874c929426fdde8a22bf |
| SHA512 | aef01e0fb5a52894b90bba998a9033e14edf4ad2dac1a329a5a13709a9157fde4e6c56cc5504bda373ee2efd1191ede0c4529072910dd8a7550ee16069094da8 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSZXTOLW\platform_gapi.iframes.style.common[1].js
| MD5 | 682c26af19b240f98d2cb951721fa54d |
| SHA1 | 18e58b652c7f82a55ab4b1910693686049e25d62 |
| SHA256 | 96428f0f585a874c185d560538ad83ebfad0365d760fcf9fcefe80add9e3c980 |
| SHA512 | 078aeef086271b7f9cf0f6e3a1e7908d7e38465a1a7a4de6f2a785147e9130551a2995e80600824da9341d58e5425d4505518e90eea9ffe1c64f4f41825a9660 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YSZH7GO7\cb=gapi[2].js
| MD5 | 0fe383a7ddb9bbaefc3105b3297f5583 |
| SHA1 | f80c9d789f251909c7560bd91a9e1b9a10c26362 |
| SHA256 | d7ad4aad4e48174c30ef21fc32c9380659d2c99a5c39680e10ed9752139d8683 |
| SHA512 | 31de1f59377bc76e5d602d02273867ce750bbbccb7edc8f2803c0188002ecae6752ac3ec31c2108e64b0d871b01e6a8a06711969dc68bd9823303def0e7c1ee4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47
| MD5 | c11998debb9189e75caade0cce6ebd06 |
| SHA1 | 214fa8987aa04b220f45d9796bd872bcc0eb0b7f |
| SHA256 | 9a594009fae58af4beacdda8a922ec047294f2f3e0639d920edc2d40b0c2725e |
| SHA512 | dee49af76c69ebc95407a1f6b635ee27b04b0a715365dcd45fff08018b03bc741299278b2a9704440a24f9d39e84a613a47056ba9943a56109dc31a1af5dd36a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_95776108E5303B05527E9B63C6628F47
| MD5 | bba0ea2199807771c2d51fb7b981bc1a |
| SHA1 | 5a29f6249112e1a7a17bfa2cfb33b3a16dffd7c8 |
| SHA256 | 5e2ff16c3fe77d281ae415b50fb55ee47b11c82f62285bf336f623099a4f980a |
| SHA512 | 87307920e0df5f4e548a091270dd49e1694f59ad68d4808839ab18c24840676c1792990124e38e313c8257a9eab176b6d2fd5733d4add12a8e2f0658965450a9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3ff628a8f74580cffac9d11837604e41 |
| SHA1 | c4f0a453c8df03d79f782940038b9f8ed398072c |
| SHA256 | 55b568c3e9925870a9cf7e5f38e37efb727b72ff9ffaf37aaa7036c5e5cb2ca0 |
| SHA512 | 90e3e72510561c216ca0ed544b244f6f42991b9a78c560da6671c73a2a07bf4d17c40a8f4998ef79d740af5f1f7b4257db60bea119268b683caa3dbf138778df |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a5672b1ddf2c86417d6a51ce315361e6 |
| SHA1 | 9276da2ce4586bdecdb97d582e66df80253ad078 |
| SHA256 | 80914d899ed6f68e4838956a85023972b4b851c9fc28263582b4814696ee9b20 |
| SHA512 | ecb78d1c512b4d8b033998f37201c224272c67c3c7d3bca1e6ba9e74db3e4c0e74941b78d8ba0c0cb14579b4cc1be190362fc4af7ddab79b0db54b3753d94151 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9bd1d3419d0321f68bb76cf5cfc960c5 |
| SHA1 | 07e7cc0fd498ef1cc9855bdf6b30387874d1479a |
| SHA256 | 5de38a34b92fce886f5e229ef08044acd15cbc9214fe8375e769c6b3f3ca59ca |
| SHA512 | 782413a89d29e5f86dd4476cd8892d5f81caa32781eb53431eeb46cc33731c092e1e12143a7a829c7d14632cb97c59c10ee88d35b4972a680f3a44763083de9f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0155fd9eb7e62d6816d46a185eab4a45 |
| SHA1 | cd3f22c4c79e2309b4c9562c0c323e37f1486668 |
| SHA256 | 95e054538c43dcac832377d9c28db8c81a6ca02a23b8cc610f731bc820e24398 |
| SHA512 | cd30403e3c7e47e04eff440e09aa7e49c6a64567bb8a01ca525d21f0f45e5170682577ec974f17a871f8d8db719351c80f8464c635a5de88b717e721e45a55be |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 54d27d5cc0a9d3818be29ff52019b9fc |
| SHA1 | 03e8a7135680bdc965f03e7a63c224f7db8d64ca |
| SHA256 | 83eef7599c62686f5a5e81b7df2187889bd00a478af313fe6c8b197e3ccc130b |
| SHA512 | 96d747256a251e582b307e4fd157002526eee46048ba463cedc8dfcca20f50159002e84f93ffe4876e17e886659d33f99a79163fffb820c289f72c75a25ae557 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f8951ae057831e88e01a2b1c9d2dc36b |
| SHA1 | c8f28b95cb77e623effb5af3cffb1231acbebff1 |
| SHA256 | 28e43812a93dae3aac34ed8252b731ad0614d89eb03ee60bb4b1e2dbc3e345e8 |
| SHA512 | 2b1c8246434aa8f323f965c98685db12432019c60196efccc7291f843db249996e24a222ffc0f6bf9160c94a03e3bfab864ff989ab2f7866e30ec7aab2fafb06 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b7c049fc3da9ddbc6a6acae70b8278a2 |
| SHA1 | 700345db4ae48fc997ae7948b87c545f290ec8c7 |
| SHA256 | 006a246dd904cc345819659b959e87b840bfe988741bde758a1a4ab195c4a0ee |
| SHA512 | 264b381e97d7f192bda4e16853ce8c13bdf1d2cc80e07d60fd1fa29af4988340f170254c64f22331b2b455701a9e928c7b455dd8136da809d0d999769d0c5add |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 00b7f789e43210a53203b0ad2b03805a |
| SHA1 | f84ed0872654a6a6b79652763326ef54ae080224 |
| SHA256 | a89fffda681b3a2bdb4b647d94c8e476799e9011ecd097e7c1bb1a70475647f4 |
| SHA512 | 260dc9b5ff612cf60178a99dfd159c2abf51c50ac714d270f3d8f277f52991295370d2a97c2963f187e6c889d4a2e482fb74aba55b3c1ae315d47cb9bc01d259 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7e1e84888ccdea37c244c4e511a28de7 |
| SHA1 | 2c2634e32af2c4dc9627c4cbc65e410ef07d82d2 |
| SHA256 | bccc58f52f56d9fbae198263cefd817d1a2ed4e26927f2056585733366e3c724 |
| SHA512 | 5a7e6c0e26776f8667958a85129f22b900231e617765ef02eaa4e60ffd59bb2b4a221a4769b4ca4bc00afb7130c2594b88bf4b383c21527213b15b40757d664a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 98d4529ffcba53d63d27b8ced2239372 |
| SHA1 | 4140cb4eafbf7d73453feffb4fbb3e2e51a42e70 |
| SHA256 | efc0bef8879f945a22b70c3814276e8e16504097689194beb6b0d3c9694314e0 |
| SHA512 | 19ec4f25a375e6685912ccced2a3d29fc4b148986cbc88c12c082642c54441ce47e3a1892c2b5effaa52f2a2806cad9832ba60bc0c3cbc9bc4aba8142d6330a5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e0262074232a80cc701e67bb75a441dd |
| SHA1 | 93fad103da1ad87f6b8b270a862d6c5d46c4da47 |
| SHA256 | c208cb0ebbc36ed05b5a7de777ca23060ac86b528d320f9d19d9225bc4e9982e |
| SHA512 | a72b093e837855c1445043c2c3a431326d981d1d5b3d3e5f3f116ab9582bbac192bb673a54ba37f4930231b306d93bf46ebeff9a3bb9ec5f86cd2f19c892b773 |
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
| MD5 | da597791be3b6e732f0bc8b20e38ee62 |
| SHA1 | 1125c45d285c360542027d7554a5c442288974de |
| SHA256 | 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07 |
| SHA512 | d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XITZME7G\3604799710-postmessagerelay[1].js
| MD5 | 40aaadf2a7451d276b940cddefb2d0ed |
| SHA1 | b2fc8129a4f5e5a0c8cb631218f40a4230444d9e |
| SHA256 | 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2 |
| SHA512 | 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSZXTOLW\rpc_shindig_random[1].js
| MD5 | 6a90a8e611705b6e5953757cc549ce8c |
| SHA1 | 3e7416db7afe4cfdf3980daba308df560b4bede6 |
| SHA256 | 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679 |
| SHA512 | 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 90053d87e39ad5df29b5899208e25a07 |
| SHA1 | 0c6249647d70f14bd273627f60b9fc4f61544c9e |
| SHA256 | 143ab2e42468168fd890df493af269e97e679f10aa2c75f36c253b37c3cf3580 |
| SHA512 | c20c268f06965d4c8521d18e93b1611327c330865f14a203f47f2d64d9985e81bd3b08a5d07de6a7db86ce839f588c4ac182f702ce430e35943b7160f14c7f94 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dec338587aba646bb8fc61e2fdffc40b |
| SHA1 | e495c90e39ac4f5c9ac8aef963c6102e66fceac0 |
| SHA256 | ff5baf060f0b13b56e0e6b0555c361a6f313d81957ea8807b736881a6495f2f0 |
| SHA512 | b192e96321514daa4430e855f991a025b22f7036e63fb4d5c8def62b54408043d36c5c6b74409548006c0782a3868ec1b04c7e5f44eab9570edb7be3a1bc5fd2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9030cc05948b13a14293336df4d8573c |
| SHA1 | b48dd3b178d178cd21b672a3485c89faa43b0798 |
| SHA256 | 941599b1aa6a2ab6afe9f121271b8a506cc6f9a54479434173673c631a4fd58f |
| SHA512 | a3144af25b1abc2ad844a3c31e2650768c1688e3b70405606e159d5bdc8b71210b5cd1675ca78515d601ac64f6fdd440e99a2122b0c2ef1d35ab303b3b0599ea |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ba162015a126dbf7742cfdaaffbec51b |
| SHA1 | c459803f4e15272f7a8ef2f9f082c11176304ba8 |
| SHA256 | 2918b87b4388ab93caed383e0b54b957f887ebc7bdb94f9331e7cd2bb87588e1 |
| SHA512 | 84b39679201477501a27d180ae747ad2d13c80df3a44f1ac431b99636d26ffaa358f866706ecd14dea7013bcaa6eac0d3a24121567aa676e6ee9cfd9b0254fdb |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 978fff366c084d8f6418d913dc4bf98e |
| SHA1 | 330ceacc432f4c48f5229ccec855ad5e00b54571 |
| SHA256 | 4ae45d8861316abd1e1aa35fc6c62b4bc397d2cd44a0c60ebf8da938b030b0f3 |
| SHA512 | c439f6f639f56332502248ca6ec31549430d33415456e1801ebf508a6ce661b9ace131ea21847e437534027cb59061cdf3d94ac37eb1493cc16abfa2a2124bf0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 371d152a743994d2aec13feb616c9247 |
| SHA1 | 42b95113f60ce8c4e1c13174a54b52ab7c296a16 |
| SHA256 | d4a45f58b82f17e51995eb430600602b34eff84bf6591c6609168fd05e44b14b |
| SHA512 | a5eaba5409b3fd6bea557a301db59d256c867e8aa13e1818068e4fbddfb4024bd3f51d89a5b0bca3e822f321172f9afdea6d83d1d3d6ffc95af1c3f8398957c0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ba3771017fd133640421e8d692931d4a |
| SHA1 | 2b92086d8715d3be38ba4c2e9039aad9964fdb13 |
| SHA256 | 54e6ee41a59f31088cf497386c7182efb17e3ad9820b29d601c7cb1bbdca5992 |
| SHA512 | cb669d78496c26da4f29077495236e34952368d0fb7448606e0029bfdb6b434574b029df85f1e3b69d3ed8a7931bf943a662bb9e9d784883aa982fb76401809c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 664c3a9183bd0ac08f9cf7959422e505 |
| SHA1 | 3c7b56fe4b53adf8051d3d7b98219f4df9ef80bd |
| SHA256 | ee04e6c1f0b7a8d550325cc6841536d2453f37f8514d832f065f951815b8e64e |
| SHA512 | 8d712bbeb4887b48f7bd8208046d50f3906bf0029069d14dabcb028335a526bb4d69a70d984f409e194559a84e7e219d93e76ebf1152395390e906b19b628b74 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | eb09dc8f6dd0f40c4a11aa1facf3efa4 |
| SHA1 | 913c42cdfd579339a1c5f0ced2682092a6f7692e |
| SHA256 | ada2e8358d55fcc121f4965ce4f0a204a5b5746b9442243a09df84f0991e849a |
| SHA512 | 93aa7cf574afcea64c5662061f7e2836ab2a8994d558e01d7295b53b3bd6dbc23ab0e56e54dc2f220d0aa13210012a4b40e1f3624e19f395fe748c98661f658e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2cb3e39c107cc78a779cb781db6fdac1 |
| SHA1 | a24f35d85c66bebb10a3d4784fc686facc23d494 |
| SHA256 | e8680f641b3da7019cdd542f0b8acc36f5dfc48ce279978e127357e90dd54771 |
| SHA512 | a8e674e6d8e7deda8e24fcaf894382a1b8fb134be01f3764dfd1b8e2aed5abf4c7858a1e102b4f9d51cd6009d2a9a50358f733c09ba71ed1346c31a3995656d6 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 22:00
Reported
2024-06-13 22:02
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
124s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6c68b90e1c3c2432b3b7e3ce29b6c29_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc199446f8,0x7ffc19944708,0x7ffc19944718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,4226594631290915604,8488883743009376833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4228 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | dl.dropbox.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | bloggercomment.com | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | dl.dropbox.com | udp |
| US | 8.8.8.8:53 | usuarionovo.com | udp |
| US | 8.8.8.8:53 | twittercounter.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | img838.imageshack.us | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | widgets.amung.us | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | i43.tinypic.com | udp |
| US | 8.8.8.8:53 | lh3.ggpht.com | udp |
| US | 8.8.8.8:53 | usuarionovo.com | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4158365912175436289496136e7912c2 |
| SHA1 | 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59 |
| SHA256 | 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1 |
| SHA512 | 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b |
\??\pipe\LOCAL\crashpad_2436_BUBXFCECKPFVZKON
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ce4c898f8fc7601e2fbc252fdadb5115 |
| SHA1 | 01bf06badc5da353e539c7c07527d30dccc55a91 |
| SHA256 | bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa |
| SHA512 | 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8013d42fda5ea4547d8a70c39c06a7be |
| SHA1 | 49fc2561162b723ff9d9e72fbe5d5d627b807bc4 |
| SHA256 | be11881e0a16835765a903f6c6496802d4d8efb668ff9f758050e9b580051529 |
| SHA512 | 440e6230655dca72bde93bea6d402829687194f3036db009cf44aeaacbd883f4f4224132bcdd1af3631c3c26dea18e51c922abe6426b4666c3d82f7a424148c0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2434341d-a179-4fb5-ad53-ef014c5c69ba.tmp
| MD5 | 87fc096518b2b462da341a0561a4a8b2 |
| SHA1 | fb9b4283fd2e6c76301fe0cfe8be23838e991b59 |
| SHA256 | 093aba1356810be0dec845b63dd186f1b59135176c12b80196f475d61c074c3f |
| SHA512 | 02d5d2ed89156f4814d08958ecef322023d8df9db287eba3e3d4b11a137e298a5f2711d1d4b50cedacd83a5baea31c9d74b148965690fdb77770a3ce40d9ca5d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 640e579152c508ac8ad65534504562cf |
| SHA1 | 2b6c58f39662fee6215f2576adfba9a58535d39f |
| SHA256 | 41d439d9d5b167082e3a84314bebd259679b456734783a1f74f6415c6d1ea288 |
| SHA512 | 8f93f15c05ad2a1b83ec315a1464a9199efd04d83ff1659e49429290f63ead273a620c511e70d1d2af9850459cd58bf900f1ed76dd9ef83dfc81d9a6cbe41579 |