Analysis Overview
SHA256
f2f9d6d275d904a8aa77c87de27d31725f06b6c63b020efe58c47a727528dbb8
Threat Level: No (potentially) malicious behavior was detected
The file a42e6928479472fefd198383dac58a78_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 06:22
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 06:22
Reported
2024-06-13 06:25
Platform
win10v2004-20240508-en
Max time kernel
145s
Max time network
124s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a42e6928479472fefd198383dac58a78_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb53374718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,5868334584126314109,16185099086224716739,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2888 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | adspaces.ero-advertising.com | udp |
| US | 8.8.8.8:53 | www.sexgeschichtenfick.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | s7.addthis.com | udp |
| US | 8.8.8.8:53 | www.sexgeschichtenfick.com | udp |
| US | 8.8.8.8:53 | i.clk5.com | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 87f7abeb82600e1e640b843ad50fe0a1 |
| SHA1 | 045bbada3f23fc59941bf7d0210fb160cb78ae87 |
| SHA256 | b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262 |
| SHA512 | ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618 |
\??\pipe\LOCAL\crashpad_4352_LMJINNFEPJHCDWUQ
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f61fa5143fe872d1d8f1e9f8dc6544f9 |
| SHA1 | df44bab94d7388fb38c63085ec4db80cfc5eb009 |
| SHA256 | 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64 |
| SHA512 | 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a91425b0ba5c8119d24d9a3162ef2a82 |
| SHA1 | 9aadd187456a25eb7601dcef478559aa4b96f9cc |
| SHA256 | 77eda14ed6800f7c037020efc2b2129abfc759d782c5af1df2eb148049c5ab3b |
| SHA512 | 74573d14accd1d3d9d06f098b3952c36a996590c473de30b49ef8c0efff61778705b159568bfe816d1259cc9c6244197d6dacd2d9bdb6b0434959d3a4b3cacbc |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 897538609c6de9647ad156feab24075a |
| SHA1 | bd35d8eb8c20a46b2cfbaf2af24295a3870ca02e |
| SHA256 | 1324d5fdff0d9a0c7ae11d8b6407328b30b7a3b1ec460397cd20cc3ee700edb7 |
| SHA512 | fb453554eb9e33d9f789431222eacd5825bdefac522fb97db3ea418c1338f0f720ae102781747710e3cf98a043a0cf2ffcaec3e9ca615ac956a83724bd15ee89 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f3a8ac0957afc63199b1f8ea0d7567dc |
| SHA1 | 4e91e8302560cadd1cb09a63666cb4d1f73746a5 |
| SHA256 | 6ed4235f483cac1615be0416d2633fabda4ebb8086657815575f5da7aa6a210e |
| SHA512 | 40f3ed04c49976b201f193a8a35eef03c3a897f60338b7e2f0c84382ec6219e642200fe94272eafa2d1684c81d2981e59f4fd6193352b61ac4a511fd09703cfc |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 06:22
Reported
2024-06-13 06:25
Platform
win7-20240611-en
Max time kernel
143s
Max time network
144s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e9e6245abdda01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000809120f967fba9ac563c5be6f71ca5cc1a5997a3afa2ddb1b689d2d5c85287eb000000000e80000000020000200000009f43217b1258b41b91f1fadb18da502776ae59aed400a47ac95206fb36e40e9f90000000c64ca9b72404142d46fc4c4c9c5cd67e7c1b0d2d52183132313e57edf886d35fb432a4546c269f27402cb3e4d72470869e04b9f278332c5e64c9c51c225bec9b17cef8b9a09ee1706bc6a1157bd77d1c9a245d77098b295a229a37b33f2d1ce86ab7eb102fc07952e596fa0cf9825485edcb672083394383ecb865cafce13a22bd5be35b7d8bde3d924e373729bd3220400000006ff0841091d81d9a95c178a72a24a8f75105a0af482994cba33958116fbca46091c49acd9820f60fdd4b3661de3c8259d61f9f3aa90844a329d8ecca32af2d58 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4ED187F1-294D-11EF-8132-FE0070C7CB2B} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000068f7c57e1d8c668f0eb18194e1d094a71ab74af9a365fc479414c3cde4c420a7000000000e8000000002000020000000671044d50323ef8bb292ac7dc6bf5659e870c9daa4702c87aa74ad85ae260c562000000085b4a78cab0092c0f7eea9f65c2a3b7d3c47a6ec74ce23516c3b0611458087734000000034f85128af6ed10972a019aa799cfdeb01a00d525d6636eec35b6bcf64cc52656e69715d4f4f214f57df3dd64d5fe797d69000fd9a231a763cc19a3a0393a100 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424421616" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1760 wrote to memory of 2700 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1760 wrote to memory of 2700 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1760 wrote to memory of 2700 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1760 wrote to memory of 2700 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a42e6928479472fefd198383dac58a78_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | b.yu0123456.com | udp |
| US | 8.8.8.8:53 | www.sexgeschichtenfick.com | udp |
| GB | 94.229.72.116:80 | b.yu0123456.com | tcp |
| GB | 94.229.72.116:80 | b.yu0123456.com | tcp |
| US | 104.21.85.123:80 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:80 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:80 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:80 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:80 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:80 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:443 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:443 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:443 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:443 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:443 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:443 | www.sexgeschichtenfick.com | tcp |
| US | 104.21.85.123:80 | www.sexgeschichtenfick.com | tcp |
| US | 8.8.8.8:53 | www.statcounter.com | udp |
| US | 104.20.95.138:80 | www.statcounter.com | tcp |
| US | 104.20.95.138:80 | www.statcounter.com | tcp |
| US | 8.8.8.8:53 | c.statcounter.com | udp |
| US | 8.8.8.8:53 | mc.yandex.ru | udp |
| US | 8.8.8.8:53 | widgets.amung.us | udp |
| RU | 87.250.250.119:80 | mc.yandex.ru | tcp |
| RU | 87.250.250.119:80 | mc.yandex.ru | tcp |
| US | 104.20.95.138:443 | c.statcounter.com | tcp |
| US | 104.20.95.138:443 | c.statcounter.com | tcp |
| US | 104.22.75.171:80 | widgets.amung.us | tcp |
| US | 104.22.75.171:80 | widgets.amung.us | tcp |
| RU | 87.250.250.119:443 | mc.yandex.ru | tcp |
| US | 104.20.95.138:443 | c.statcounter.com | tcp |
| US | 8.8.8.8:53 | mc.yandex.com | udp |
| RU | 87.250.250.119:443 | mc.yandex.com | tcp |
| RU | 87.250.250.119:443 | mc.yandex.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PJARS8CM\main.min[1].htm
| MD5 | 0104c301c5e02bd6148b8703d19b3a73 |
| SHA1 | 7436e0b4b1f8c222c38069890b75fa2baf9ca620 |
| SHA256 | 446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f |
| SHA512 | 84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | be6dfe37e1c35f221c18202e0d8ee4ac |
| SHA1 | c661df755b1cbf284f083f506982426f0a860d74 |
| SHA256 | f1ddd2990fb48c7292b5fbc469b4925b80f81881744eef9b1bd3eb505f6495e6 |
| SHA512 | fd0d24cb22d8e2923e9f1650e04c5a49ccc228e6ee3c749a0aac8635dc8f4ff98066cecbc2362dbdb893d1c3de71832d5e0ec6e00d24be30233b60612685dd35 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | cb85f3fcf86ef0de7ef258539cae87de |
| SHA1 | c73288fff07885a62f8c7033b348863ed3b8cad1 |
| SHA256 | 7430a96d94b1faa5363b7656b323ffa416fd262e0405e498bb143dc93443963f |
| SHA512 | dc152f2e8c8f7e316e84f7a1f3996e02c08d582d6d0e40b8bf7171e359ea952a80b7452e56690b30fe98b4655d4744e8529a930449ef1cd853e377f86294b2d2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
| MD5 | 8202a1cd02e7d69597995cabbe881a12 |
| SHA1 | 8858d9d934b7aa9330ee73de6c476acf19929ff6 |
| SHA256 | 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5 |
| SHA512 | 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
| MD5 | 48b8ecc685e44d791cc4a6ad6deecfb3 |
| SHA1 | 1b098898206ab63f2f391d6ecc9cbe1984aa5878 |
| SHA256 | 189be372b731bbe5f96a08c4fc1cd173da45598dca5dc9943eddb719bd733239 |
| SHA512 | 525971b85c135dd1f18227bb2225380d5561f512c598ce6eb543e33ffbb2c4e1251a438fd55dc3586ed194f742014437c71b5e904a14b5fe0a42696703676159 |
C:\Users\Admin\AppData\Local\Temp\Tar35C5.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\Local\Temp\Cab35C4.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 02ac5d366545664aed0b89091ce22dd6 |
| SHA1 | 334ec89dad61b06d7f4e819c9334ffa9696c7b10 |
| SHA256 | 3efada778a17da573fbae17a7cba0da2452ee153aca8d3fe9fa730216042708e |
| SHA512 | ebf77c8d53eea22978fed9680e0d7dda9e9e4d9a2b80982a2a3289c800f3d8fadd059fb7dc54dc70f9bc154a2402abaddfbfb4acf71eb085d43fd543bf2f1d29 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7cec502973dce421dd7c2994aa792e25 |
| SHA1 | ef97c7cfaca8f04a07543e3b27c09c48ccaff0a3 |
| SHA256 | d35a9db1a4b9c253470240d88cb2483d4260ce1379e56265c74336c9e9f82cfe |
| SHA512 | eb4e53d2d4dcb3b95438a7457814bfd9f430c59b9968a2413e560898445a17f9dddd0a5bd2291d257d4a8e7b130fb899a8bdf4cf7b3ab62f8b4946b11bdc6bc2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 54cd9a74cfd0b8e43848d5bfa0645d0a |
| SHA1 | 4c0b0ded53e833b4bf6c0e46e3b668f170d51e21 |
| SHA256 | f610066d15c52c72787d7eabc83eef1c79de0561f80367a82a5c2e9c80ccd390 |
| SHA512 | 87838d33002b1f7cf47436543d8f17ff27691ace0211b8b44e4bdeb9c68870aa53ca753750a7b2f08f82b5daffea6efacf836da1687b6e2b44f2ebbb85667d2c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 96460cc762f3c09407c5d34bda010e3a |
| SHA1 | 447c0a19db1a8bea37ae543551eb1e8c82fd5260 |
| SHA256 | 31f055046130083ec50002757db49acd5e630ebf66011958b2b2c0c29915e49f |
| SHA512 | 74e83634b7202a0a3f4e6898c12c1967ca0fb25c51fce35f39cddd40ce9f924944855205144683525bb6ba6de8648058a7db0c6434c514e4300e83a14c0d6525 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c27a738c2c31a17b157e2f14dfc94585 |
| SHA1 | 800f09020c682c4355f677dd5a0c93fff7b54e22 |
| SHA256 | 03ff0587c223f92e6464a58baf91b46cc314b1ef3015ce1c4cfd3f3e88707f33 |
| SHA512 | a4f73944a8561ef1cec4d8902829aad6e3f0767fa832859bda1addf8f65cc34f61c0a359d1a9d003a41f254e6fa94d4107ce27cb1efc4ca70ed4d5c80cc217b3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 680252d41dc9798f2227fa3d997224dc |
| SHA1 | 4ddf8a234d8f109ebac6bae2b0a6a1c325f36e4d |
| SHA256 | 2fdde0fd8df4c9427d491d68c8c829d3c0ab41c36742566c89dce7e7b59e5086 |
| SHA512 | 50aceabb70f49021f7bbda85086d1e6378a60b65855ba5ed96289937e54b9a34b83eaabfd50e22376cb72148cf2ee1077de74ac4559ef9af43311cb121da8460 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2b02b40b5542e49e53059bcb435c6c04 |
| SHA1 | 1abeac1972b9e5acaf290b1b619c5eb56cf6f01a |
| SHA256 | b67f9810b2a7aab88a3dc4db76d7bdcdd4892455fb9514f20f69380ac91a2d9a |
| SHA512 | fb224492e78993db21feb8e1fcb76ecfcf36990576bdd13235a856b0d5f970af827f61259f45a511dda5043cab4444e8cac05ff991b351613a402798b3194fc9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f6fb3e728c97725d381b43db79a36098 |
| SHA1 | 8238d21a198bb2e6551af5422670a5d0df810e06 |
| SHA256 | bcb33faac645d8d8aeb54830e4572d5aacbbebab379be2d5aa24d1c071548256 |
| SHA512 | d19badf9f241ad68d24b535c8dbbde0a23d74e79536c6299d47f56bcf61cf2b6cead55cc4aa4a090884171b28d7fec92d04a0a4c7cff8b406674c33cc0b1e72d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ee31ff47447125bfa1057de130991253 |
| SHA1 | 54e6d23f2deae75fb4029b9b948ce66ee921698f |
| SHA256 | f9ddbdc49e94071853bc76c7076ce2c2b8be292fe0f16434caa3e0ddb0b22e97 |
| SHA512 | 88c43f74b93f8c53f158dca5d62d37567dbb1c330fd1de7caf4c4c821d8d794455419b6423f1d6c208f50434f944d140320fbac2d00d00eab9576720bbbd39ca |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | adcde66927fdf1f45c489228d158c24c |
| SHA1 | b2ea77ab15c85550bd962be93999c7e83edb3a4f |
| SHA256 | 7b3bb67cc6a36fbc014daa4b59980a430bcc67c4951051a821484c7ea8810eb3 |
| SHA512 | 44624991adce2781530453d490e414616eb0090eac01cd34dc335f8d7eb4684444c27d04143224eddd5660754934e8c3cc0dbe420f1a9c163077de9742d902f3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 218b8a3738e7c8ff205d8c1b4054ca95 |
| SHA1 | fd0669c5717d7e0bd2e53db648c0ffb8b8291cc5 |
| SHA256 | fb0265723d0d418ce67ce8a8e75b673020e2fe84c6887ea09915834a72c3e13a |
| SHA512 | 7300c1f6946c4ce5e2e469690a0d9fcaabbe216c19eb31a08b94afa8611427ef93fba45f07e1524531295311872c36960b5b2cbfd918ec448238191354acf203 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d6b9bf0efef61a806b2f61e19d2528e1 |
| SHA1 | 6e490fb99dfeae330efa2484708e86c815df30b9 |
| SHA256 | 1cb4f5f1202a95d09fbeb742347420c6ff914f18d4ca2b3098d0436749b67ebb |
| SHA512 | 7d3e83e049deb97a974d3f226c56c6e5d344f5a4084ca3231fbeaf1fc28565217188143952fe77bbcf6564406785e738fc7f8f83664adfe5bbf6424adcf7713a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 67994c8a6ee0a5050125dde7076402c3 |
| SHA1 | eaf8c5fe5e61217412114aae07ec98a2f30d7b25 |
| SHA256 | b8bd28a471547d53f778c005b88a4bd486ce93c772fca99a983196f4e901bf2d |
| SHA512 | 9e811a62e2f2ba48681f6651b215123d89d414b612d7a2be1925274dbf1de402c3bf2de7cf6f5eeef9919f418cf6f038faaa27921f2d996339ef2d4c06c003d0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ee8ee3d1318b3e6417923c8f0d3442d7 |
| SHA1 | 1b2248440f576484f02231d24c42f317e63f97e2 |
| SHA256 | 8afd8651495907bab3cd8aa64738f659c3e0f9d8bcaf00f6583f1aa452aa383f |
| SHA512 | 19ff345cfef99b5225be74e8a7d3715e8758883a8bc0f9e487b2cf1df22ede85474698c163087c4e67af5b5a61293eae052184b445cb15c500eea10e35b683f9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ebd2a99524fa0fd4adde1e3a29786b19 |
| SHA1 | 75ad8167a4752313b4ca98f72dbc7f78d0d576bd |
| SHA256 | c5ed0d7a3e77f20c8f1833c01db704358d04f972fb2f04e0ce2456a4992e2c6b |
| SHA512 | 63ca94109ad96a769d1cb1a839ac11f96b05749a7e07531e20a38f8f351075d72800d68005a12e10553d66208978ada819b6be1559e33d28042485f600591c43 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 81b4ced59548973494ec83c36dc9d1dd |
| SHA1 | fa5c15aa06b5085a7f36d3ce200d76d4afa437fb |
| SHA256 | 01cafbeb10dad6e37bc9e31c49ba15fc5f0208c575137169d5c48da99cbd1920 |
| SHA512 | 4f525d8979d85a3290b19b494ccfb5c3bb5bdd81cd484803ea5984f4e31414d95cf7af08807a7f59da96b764a377fcfc9730652416362fadcc2c7a79928c0b34 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 29fdfc7c7d26f4725df6da6cff4605eb |
| SHA1 | 7b699d16e4a546ed64f69323df9ef9c838113a79 |
| SHA256 | 7a40183de166b0d4d38e0a5dbef9217b9e1e20b12f07f7ae9d9646b3b4b2b437 |
| SHA512 | c71f626ec7cea3c398f1b7744dd422efdc826ff0bc6ec6a7f8b30b1ce4131bd45e3f714160c570daa74d1740bf482ec36719766d84aeceb5258e9339f1bc991b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3a4ce895aa75e4209ef1614d2eef4be8 |
| SHA1 | 463c5a347d04e1d1e8c945d2742de4bec7bff0da |
| SHA256 | 1cb72c36fc74ef0cfd65bd068926bb3bb9697d36f99004113c3350d4e8f43935 |
| SHA512 | ccf8274fb02a2c249ef43235b5a3d51623704bbf856a6effb7f2db617a44111d4e9458e359339bceef8a684872b99679f599d151bf7d98b201d26ca78e14c46c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 736e71d77526f33fbb6cabeee1cbbd58 |
| SHA1 | 3c1fd6807c8348865db323c674f377d3a348d8ab |
| SHA256 | ccbf0047ab20735c48bcef1fddb4e14093183933b1b63e9e36339353df999d9f |
| SHA512 | 11fc4750bdb23ff8add7ff08bf15144d539546dfcdc61e764c4d997b15719469620e26c0d5301aeb9b5676044eb69bdd79fd04e3916116154b54c82d7fcaad0b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 58cbc5d449c389798479ae45ecc37f61 |
| SHA1 | 5580b90786b7aeba15cee65ff5435258d8edd838 |
| SHA256 | 9aaf2191b0dc5f83bd4241f0411ad809d2ed9591fe0177527bdb82328739df96 |
| SHA512 | f28d9a49accd86d82797cc86e292cde649f1bbf26ca3305402582716067c4bfbc91d1d4e5cc48a99e7a154a77efd12a4b3480ae1fee29c31e8c0c61689df31f5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 25db82b65f85b184dbaed4ef2f99869a |
| SHA1 | 6071696d3f068078987ec628c2f13b8af1ea9999 |
| SHA256 | 5e7ad9fd10df0fd9b78acbff5ab42069ebeb0056e0192229f43a694120bbd85d |
| SHA512 | 39d8b2fd66d37d30557d1df11d63189ddf493cfbbb035a89c298a5318dde5e2d004d8aee4aab5e1ea21cb734b948d2a6c991843fb82e5d40fef92fb8e3b0748a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ae30c65227db6cd707e7d40cdb97f006 |
| SHA1 | e7c6f600b2a24d6372ec865ddeb036c6de1b88f9 |
| SHA256 | 4840b71de3de28fb6a156b103bdbb9535400958aed502406c0e40734980b504f |
| SHA512 | b6a2a0784bfc9ac9d335a9298a44e9da7fe89cc1e4c26566a5fbb410e2ce1573568bbba16e973d7e44993a659d9976049b7e50f449a0a2744ee83bc1bd11d73d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 464481157bd5129cd124db1f468836c5 |
| SHA1 | 1bf4b2f2df53c52d6732c9ff413f0b4a213f6c06 |
| SHA256 | 988b1b3ed90b2f6086d6c1798325c75a506ed83aa6e328cc13b00ec6002be141 |
| SHA512 | c4ed570507e79e0003ed8095949760b949b93bccb3944f2b159266e9f842dca3a1217384b288a7097ca8175cc70d266d22d45f0e4e475f7a25c3034681bc7005 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 16730bb2ee776d5b37fb2465b4dc780f |
| SHA1 | 7aa20ae30ac055e7602b0518c751fe8a5266c319 |
| SHA256 | 9a122487b5d4ea7ab0ced235b2f02f707849d7257aec44242c00d6b6ed689c7e |
| SHA512 | 72c1457150c9cc636e49025b64dc765a09d81999827e50dbe414b9bc8ed19f6cbce74722fac44eb76ccafb66f060871f0c37a60c516f32da18aa0ef2098b2f8a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d32cc7c39202d4f77f61a25743501cab |
| SHA1 | a832f20afd10d5483efaa3d381d77f97bd0e5919 |
| SHA256 | c39798a77db251ceb42a4cf0401161e91cdc6144c2e6aaddad5f901096f072ff |
| SHA512 | 3e50038ef93355a43d9abeaccc3f5b22bc4c5bd326f6a1a0282dcfcf7bda3bb98ea3a000009ad7eef37102125c0f2b87bcc7e17c47be9d7bcfa2f7c0264f6361 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 72d8b33b9ff9f940ddbb3f138538455f |
| SHA1 | 1d494f1abc99cbe18c12185ea8a1e343df6c303f |
| SHA256 | b1a96a2b445641a7034d1fe90d6bc2ba5cbf85aca622028b709b606e5abc2eaa |
| SHA512 | b926b2f12b98062295ae74f1c3fd4ca4e5b1c399ac90ecf35a8cde84dc62d35cb1fdb690e55b1363b15fc49481c5a8f04a49cd81cf836c9effcd32f6529c63ff |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9a4d7dcf2b592f7ccb887700a564e3d7 |
| SHA1 | c810aabd343ede3fcd4dbf319fdd2a6b7abfae96 |
| SHA256 | 32f575491a80f31889e59bbdeaeee85f8b01741ef10551d238f470b8e17022c4 |
| SHA512 | de3ca80a676d9f62d9d94a2c5e2bfc30fc1fd730da1a0574396fb110d9d29eb877dfd0489622c487baa52c9628b89117d88ae900eae501de698f109693ee7b3c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 40931acc469bd25acdea938ad834a673 |
| SHA1 | 3a54b95be474abfee67a350c10bc728aee95e7f9 |
| SHA256 | c578a7e357a267b78ceb835ee1642d36e94b2183e5362155d7ed6c9a71208895 |
| SHA512 | 81e6e2f18a0b2e0285f95a8cca783e4d841bff9c79778f8b4852c76aa4928fbd1dfe9e2799b2f5521c532e048a84006a671338221c2b9982653424411d3967d3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c217e0f0e14bad2d737399bb92d8d65a |
| SHA1 | 9373ba9c951400efea253cdd115b160b84756842 |
| SHA256 | f30e5fff79c312cec5691370cbd0ea4e149319b29737465cd9e5902a577899c4 |
| SHA512 | 59e54e41369c4fc8a1e5ee1b2d427e09946a052e5d748b90f9d7b1c730fd5d913465b4c41e35f6572c56fd692d984c1b6051b5b3df4dfa78870a87d1bd3f52d0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 20c478609f12a36a310f2715a3c100c3 |
| SHA1 | abeebbd194176cde076b7407d08e31c81abc3b11 |
| SHA256 | 1e412b2d5bda6516e975b512773a5eed33b375a96d569fcf36a560d7a11bc4ab |
| SHA512 | 0c2be5c0c1151931c954b651489f3aa373c2ee9fec0d42091c4a2aebbc436e4d15f8b54999eeddd56e8d9e3dcc9d6e54007628f5b0d6df458270b452d02f6bd2 |