Malware Analysis Report

2025-01-18 01:01

Sample ID 240613-lfvnyssgng
Target a4da3bb0f9f25a7d5a420db4f781ba84_JaffaCakes118
SHA256 4ba657eb4438af6391f5e9f3a0a9794e5b1e2687226b1ffaee0ae2398c82ba76
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

4ba657eb4438af6391f5e9f3a0a9794e5b1e2687226b1ffaee0ae2398c82ba76

Threat Level: No (potentially) malicious behavior was detected

The file a4da3bb0f9f25a7d5a420db4f781ba84_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 09:28

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 09:28

Reported

2024-06-13 09:31

Platform

win7-20240221-en

Max time kernel

127s

Max time network

127s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4da3bb0f9f25a7d5a420db4f781ba84_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f1773574bdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dc3018fd7a48349a6ce6b07dc31104b00000000020000000000106600000001000020000000fa9c59e3282bf21cd1bb2b7dfd03712fa7bb6757a9425dafe4a728303636ab83000000000e8000000002000020000000a2253623e1bd40ad300ee48299860b8530e2513624ab6532f1f020b9e3082ea690000000964f16fd2d82ad98af452653bebf016de174e9403f2e06a8d03cd954abfc41e3992ba4db978f2b1030fa320b57e0b6bd6f0dccb5f16edd96f8f515f81d1681a37a2ef1c6f3c0849c291f8ac561338852f1562d5e60cf2d82c7d421820bb26f436b6d9ce7c85749b62522e8b5db18caa01218de46a3bb675a62a489dfcb0ece15b6f377f7efae0b3bc698e6527848f51240000000f775e1e3f352f550f0590f34312e3e37ea699a3adc0dbc1ca33cff75f4ada9668305a0fb64ab3f43a19e03f186249d0f83da34f511b8190b8f5606c9f60958a1 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DBD4C81-2967-11EF-9034-729E5AF85804} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424432808" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dc3018fd7a48349a6ce6b07dc31104b000000000200000000001066000000010000200000000987767446f5676d4ca70e48ba41af71f1cf58195c701e9b5167aa2fcfbada7e000000000e8000000002000020000000d9f32d78012c564175c4d2dcdcb6144d46c6fbce322fcf2b46c1605db8b6b44e20000000b035e80a39d9103f05f56b65e460048825a5d42eb5bb43479c5333a5ef11ae7940000000e2061764c5a50bd41884766a9b07780ea242d787f83254a37a71aa3faf32b559c2427d42180e04ddffb37a7c8d40b85482653a096002b88c141584ed28621c46 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4da3bb0f9f25a7d5a420db4f781ba84_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 static.graddit.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 25.media.tumblr.com udp
US 8.8.8.8:53 assets.pinterest.com udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 151.101.194.137:80 code.jquery.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 151.101.194.137:80 code.jquery.com tcp
US 74.114.154.18:80 25.media.tumblr.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
GB 142.250.187.202:80 fonts.googleapis.com tcp
US 74.114.154.18:80 25.media.tumblr.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
US 13.248.169.48:80 yourjavascript.com tcp
US 165.227.71.229:80 static.graddit.com tcp
GB 142.250.180.1:80 3.bp.blogspot.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 165.227.71.229:80 static.graddit.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.10:443 ajax.googleapis.com tcp
GB 142.250.178.10:443 ajax.googleapis.com tcp
GB 142.250.187.202:80 fonts.googleapis.com tcp
GB 199.232.56.84:80 assets.pinterest.com tcp
GB 199.232.56.84:80 assets.pinterest.com tcp
US 8.8.8.8:53 64.media.tumblr.com udp
US 192.0.77.3:443 64.media.tumblr.com tcp
US 192.0.77.3:443 64.media.tumblr.com tcp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 apis.google.com udp
GB 163.70.151.21:80 connect.facebook.net tcp
GB 163.70.151.21:80 connect.facebook.net tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 172.217.16.238:443 apis.google.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 163.70.151.21:443 connect.facebook.net tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
GB 142.250.180.1:80 4.bp.blogspot.com tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
GB 216.58.201.99:80 fonts.gstatic.com tcp
US 8.8.8.8:53 www.cebr.info udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 142.250.180.1:80 2.bp.blogspot.com tcp
GB 199.232.56.84:443 assets.pinterest.com tcp
GB 172.217.16.238:443 apis.google.com tcp
US 8.8.8.8:53 developers.google.com udp
US 8.8.8.8:53 accounts.google.com udp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 199.232.56.84:443 assets.pinterest.com tcp
US 8.8.8.8:53 www.facebook.com udp
FR 185.60.219.35:443 www.facebook.com tcp
FR 185.60.219.35:443 www.facebook.com tcp
GB 199.232.56.84:443 assets.pinterest.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 216.58.201.110:443 developers.google.com tcp
GB 199.232.56.84:443 assets.pinterest.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
GB 199.232.56.84:443 assets.pinterest.com tcp
GB 199.232.56.84:443 assets.pinterest.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 199.232.56.84:443 assets.pinterest.com tcp
GB 199.232.56.84:443 assets.pinterest.com tcp
GB 216.58.201.110:443 developers.google.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 0d007909185914945469b62d8e6b8c3e
SHA1 e0cd2ec73fa49bd338736422c05e4ec761774dd9
SHA256 60e51a96327bee5da636119b1298aaf9202314121b9a99f87aafe0dc553a94c0
SHA512 8fa220647d60321195dac5875f51e38ad3103e3ed885d4aff0d03992e97eb66a9d095469c639bcbc6f7820bf9889163a8d8f774cb5f4e66f6892a927741e466f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 cb85f3fcf86ef0de7ef258539cae87de
SHA1 c73288fff07885a62f8c7033b348863ed3b8cad1
SHA256 7430a96d94b1faa5363b7656b323ffa416fd262e0405e498bb143dc93443963f
SHA512 dc152f2e8c8f7e316e84f7a1f3996e02c08d582d6d0e40b8bf7171e359ea952a80b7452e56690b30fe98b4655d4744e8529a930449ef1cd853e377f86294b2d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 db88a3b8296edf3c22fac9afb14fe2a8
SHA1 311aecd856e091b5bfd4546a0cd201710a1db49b
SHA256 3dcb47217c8b40f0b7a7a0288d0954c042b2a118c497569df07c2095ebc65188
SHA512 dd87672553016f9e8806232a72693ec67ebab82fb13319de78c0075cfb124cbb585af63185c792dcee250c3c27a08a67bc124dd9def8374423daac04bd75e477

C:\Users\Admin\AppData\Local\Temp\Cab167E.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar16C1.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1782.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25ba7325494e6dcfe85232f5eba49e21
SHA1 a636201cd587299ec6aef37d50bbace40bd2b561
SHA256 6a04e5536dc0e3eb3002e942ad34be90e5b2bbcf446b7396957ccb063cc09775
SHA512 92fe0bb9cecf398bba399ba58fccc0d28006076ec79627752988eb8892c84f88109e11de457675770e2dcc9d59eb65ae55195e3af398e705285ffa88ac6d7ab8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 993e2687638fc9ed9ebcc28979c43696
SHA1 46b08bba236ba8cdc339427806f0ad66a0b2ba42
SHA256 50fdcd5b0ea0fcf286d42d2cf78f74f65e89cd1d97185369fba76a3783e90fa3
SHA512 0d52f74effa8921c0df82f95d5b3b97f719d324da2f3a6c075f07b58d47e638cb834a287e4fbf0cc98fc129e9b41ab4e2f06d849a5af06303b11660eab9cebd3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cde0b85eaaab0df6a7e135821462f855
SHA1 b8295382f0e93431d5ea3e9fbf0387588ff3ece1
SHA256 952b8c8fa173087d8e8787cd879c6ad2d9f457b0b772e7996c23ef7f11c25e8f
SHA512 6e27663f72410304ca5ded0c9534cb07bfa8e578f6175c46c2ea2717f1dce8dcbcc24242670655383d9bcf9872f922544e3962d247838048e27135d05d2a9a67

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c734b23f9e22783a074c5773bc5b9bfd
SHA1 be32d93831a64d8d312acaed3e7f864284cbd956
SHA256 a9105d2292543485f11b46c9a8695e82777d64991ad45cb093d9b877ba1525e6
SHA512 5a2773e0fd2be5a3d25ead32dfb63bb680aac05923f492479a1e31a3a454441117455e72ef0437992143a3a54de1c2fa8bafc867458651a3181f0fb8813cecf8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\cb=gapi[1].js

MD5 0fe383a7ddb9bbaefc3105b3297f5583
SHA1 f80c9d789f251909c7560bd91a9e1b9a10c26362
SHA256 d7ad4aad4e48174c30ef21fc32c9380659d2c99a5c39680e10ed9752139d8683
SHA512 31de1f59377bc76e5d602d02273867ce750bbbccb7edc8f2803c0188002ecae6752ac3ec31c2108e64b0d871b01e6a8a06711969dc68bd9823303def0e7c1ee4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e82b0ba5f4c2537f26d3b95706eca044
SHA1 63f3bd713ae80da884600b7c94c4b4aa62e2320c
SHA256 cdd1f7d573b37ce6d02e0e82404982a29ffd1338b99616e6312f2f6d4ae9fe48
SHA512 375d92419531d31b7d072ce50dbf98c295e818ab0b9a99b7d50c5c2a5bf8a580c9fcea28301918cf90bf82d8b7780167b7fd4decc0463b242efcdf05a663b7d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4b3861089cd9fb15e8f31366e9c32e36
SHA1 6ca2f00f76d70be5245cfe5ac344a905f8ac3f89
SHA256 fcd9f7d9a4f9ae57184325362ab27fafde993a02bafeb9e19ffc2da0559897da
SHA512 982756c622f595ae4e7e6e6d2e235a597f53dd26cc420c73a8cda07c900bcabedd12f95bc3232facf0683e7f83a18ef91080a2d93b9f123fee8d2a0d3f4f2dc7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3966fb876bb0c2956aa5d9dd8a62274f
SHA1 b22155e6d45f6b82c47d4a31e655ccf0a410afd1
SHA256 2b4e14ce14b715a8351d0af40c8841ee5955b6d3c2fb0a9151d10b82c17ea0ee
SHA512 823718884a42b9c07ff37277e55fccb55fab9a18ea36876aa76b5d7e3a78d07ddb70fd6b3a658b33a63015a00c709d73d540979dbc948b4f88db01e5593d98fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46551a504fc8e6a1d773022e9602c9c4
SHA1 e1171c61e33d8c54923795e86c7e7189dd13fffd
SHA256 403072045d50e6170a301e33def7507fbfac3d7325a668abcfe85476c9ab6062
SHA512 06e51976c47e5b8e0409d04791dee34db8f1ca51eecf32f587be1b0e70095601efa0b7ca9cc4a145da06019bdd025a610d883040c8e666164e0bb12d4f5fe181

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8d284e73a9df1b97f997d4eecf09b116
SHA1 33ebfc2968deae14c98af7cd02fa4272cebd7334
SHA256 d45f099c96791def0998d1c9bef42b905fbab0d3b596e758f162273b71989260
SHA512 a5c0c39b9666ac215ed8b6ded5463a1c5198edc7797d132594bb26cbcb5fdc98d247d553aaf879e20bf6b68e47f6130d1eaf690097bcec256a6e1bde46077ca3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb6d7f1dca132e27e8d07a79b0c3be70
SHA1 5f6cb027cdb30e4a295b25e044b5f2678df26adf
SHA256 371439d729695cfaea3dbcf9643cf11a675de35c82534e6b075ec0f10cdf68b1
SHA512 8e76542e01ced915db082ac549465feaf39b3b00d00dc46059744b67e1b004c5c195337f627599ea4303804288f8e1605655e2e51c3e9cf4d3062975b50363c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8d29f4262247cbe832793c32078ae38
SHA1 162e6d2bc9ba080c77eb8b1e9adf2181460a462f
SHA256 17b9f0eca9eeadcf797456c02dd70e897d75814bb88bf38796e5e5f41148b9f9
SHA512 52d7a47e2e3b1fe957baa9ece2bb2ad4deb4c4dbcec5e78bd3efb458e688ff9dffa64ca48bd5ea9f2689e769265e45264644ee1c14592b6e2d2b3646278bced1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59deb3ed7c994963b5c6349b20655fd6
SHA1 b49f2c58446d0e903767653eba09b0f096c8d06d
SHA256 abbb4a3115d06fafd23b595a3e50f77e64de06f7ea8772d0df7ea183ec072fec
SHA512 7ab5fb02a50ef96ed82d9590dae22d1387db1d3ca5db07e4b4f4f7235532f66b79eb409aaecb47b2a723050aef56f36060f4bf9054fb269ae45a043bc119ac2d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9da2379899af8ffc8d646887cdfe1fce
SHA1 ff3bfb6a927b5d4d2f3e8c7143eb831ae6f1eb14
SHA256 dd95b942df67ebdf58e2c5e5b2e94b52dbd84bb654154c2bccbf6c1884c082c9
SHA512 ac3b8b5c84435b9e76c67edbeffa1b7f5de83b9a35477116b4ccc20b8ed33274ec8fcae9bfd298b410ab145071575689488da850fbf0f2d2b0bd68cf9ea5b0e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9a374025124c46f2d59bc0460862733
SHA1 311e3f8e0f0ee738e69164a6176b3def5e0893ec
SHA256 e248c4b9f91b001104743eea8bbdef48c84ce6b59dfc5ae1165eb03a31d22441
SHA512 8a1dc58c0245c8156492f5337358049f99405b8f9c75e2efe893a20265ce725b05f75887cac2d070fb4bf9a7949bc321991cf338ad65fc70417d68e66108670b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\jquery-2.2.3[1].js

MD5 aacc43d6f308fa362ac85e3f4fb2b30c
SHA1 09b2fbec3c6e662be486da501a913d4b93ad39eb
SHA256 95a5d6b46c9da70a89f0903e5fdc769a2c266a22a19fcb5598e5448a044db4fe
SHA512 c535148b1cf98ae0569ea06233ecc7a5fa3253a803a44967286fd0700d52c4bbf2fe3b5f5c406330abca012c50769fde9a9a9f24559ccd0d92f5ca2d94a5d3ee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\css[1].css

MD5 cb39a89917eec0f680f2d31bc9fda9ff
SHA1 c8574e4f5a6be55eaa110fa16c01b4695441628f
SHA256 63b9e7deee11b4ff0dc967aa0c0cdf89b0c9b3094118d1102f7507556e63a08e
SHA512 dc4442a2ff2626988a48e549da8b151d6cec94c813a4b0f6030536f8afde0846b89a49bdad6330649b07c5efe7926544e90f94f7db0bb3b42ecdbb7bff738953

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\css[1].css

MD5 3187b9d4ff2216aa2bd4bae3619088d8
SHA1 ae776868e2c0027c4527022724f5d59b05da6c66
SHA256 a183f0787e54c8fec34bc4fd2a3c41f10c5f45a8f3510cdf6316bdb3e5215034
SHA512 c2eb02ce0a2a40f1c61621dc6b42e7ad7659e829c3a8f12b7bee2f463c31e868d59c6a0e01c30e864080caaec77098efc47b331863f1193bd637c88cfe8c7d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\3414295837-widget_css_bundle[1].css

MD5 bf93898003605919a94113b4ef37f2e5
SHA1 a4d33b80dde5fe7047001f6cd4fd08bd7a00aaf7
SHA256 b283ebd6df675f7ba40a29dcc92e47a59c3913c8237fc10e41b1ae02a94897ab
SHA512 2d97e3de7fba30f5c3fe481e8757e6b56a2b06408d9ae4f25e90c392934c52fa90f155312c093ea8022b6228e51fbe1f6d3efc65a85f71344f6883e7a581bbe5

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\jquery.easing[1].htm

MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\pinit[1].js

MD5 9e724ccab52ce087d92250b1e06ef0ee
SHA1 8000043a1fb8735345f8b27c65b85331099aed8d
SHA256 3faadebc89cdb21d11634a032816f152462d1cb8903eb21d0642501fcad065de
SHA512 ff880120b2087757cf3d0d0333b7a83240d35fe9af7420477f9bc9684ade59f6e3c94bca0f608a12c594282143a2ccf50b33be20b70aa8c1aa818dd499050473

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\jquery.min[1].js

MD5 a1a8cb16a060f6280a767187fd22e037
SHA1 7622c9ac2335be6dcd3ab8b47132e94089cef931
SHA256 d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
SHA512 252476e9f94a6db579e14cdf1197555e856e6b80dbcd78c46b9345ce6605a1cd69da0dab2a4c475b51d2103404d2c61acd18490e005d625eca06afe4d75c8a6c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\plusone[1].js

MD5 53e032294d7b74dc7c3e47b03a045d1a
SHA1 f462da8a8f40b78d570a665668ba8d1a834960c2
SHA256 8076b082eadf0cab4a8823dbd7628a0b44f174c17b3221221c0e31e7c60307a2
SHA512 fe263fe86aea2ba1b86d86305650cdeee45cd1f7b4339f9d4fb81db776b78abedccd0ae77262f45d579751daa26f81385354b3d126fdb5577036e9dd1db33276

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiYw[1].woff

MD5 57a8f14ba2567b39ba4013db835af389
SHA1 101b638945cbb93990c70eac567cbc060c573cc1
SHA256 7210e1fc5e0b71011f6d821fce7aa459b4c2452af3fc4dc0f493abda10fd13a2
SHA512 57ab3b386ad8487341a9767c099dd209523fc4b571efa74cdff4b8ea85a7c452da90e8f10406f17dab5f74dc64750a6cc0dbcea830169ffac37458a7abbab8a8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\BngRUXNadjH0qYEzV7ab-oWlsbCGwRs[1].woff

MD5 eed6edd3682ea4dad7d42e43648b490a
SHA1 3c16df451896fe5f0263d27bb1e44cffbd86ee41
SHA256 fd3b97c19b90a1981c6851327e8289243e44383a4fdd8e45353214867eb5b5e4
SHA512 79e44f268beca9e61506e12fdd1733c6e822e90020e1118a0fa325bf09682a7b41dd9d17533e41c85014e63fcbe8c65225224a6fc63495617e0b14d639c1b973

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\all[1].js

MD5 2ded0f7413d305258574ab0565d4151c
SHA1 d8c08194f1f82b9d7d313dba8dd53acbdf2a2063
SHA256 53a799a91314d4f52c0e786241d68a512e9304e362e3ef79557e6fdf6f5b7ca8
SHA512 22de38b19fc2277b0e4ad96a405134b2995870670b155d69843d32e8c8abc71eaf49fe3f912503565c8ea849453be2eec4a169992f24b5e671163929e90cc144

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\cb=gapi[1].js

MD5 59e7715983f1a5c4cdde2c76b015e21e
SHA1 0c9035da67e550e458c053e562f3781e0520e182
SHA256 85454302a9280ba5160a95772914c07adda5b464d74a354f13540f9ad5127aec
SHA512 449d9ea80695a0c96d501b7d5a98328eabca18576770572b472fac7553723bcc4d55561f980f6bd4abb7d173a8d5525ea1abce92fd794c92ae36edd2aa12e522

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\all[2].js

MD5 921a57834a2dae3d330f3d03b054c361
SHA1 2d43f93105f0161739c5c50830526c733d06a1be
SHA256 aaef8bfec0a6d9b753ce4b40cef017de4d9c18bb319dda3aa3993b280520dcbe
SHA512 52af5966caa32f19d58f7191c0a210f000b82953ef59d416a1780ad7e8b894760cd076863fc18e4b6cc2e5d09fced868b8cefaa4bc77dc768480af40cca5c01a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9abb91979a44a1ff22a45187e83b70f0
SHA1 50ac16f96d3dc189d6b3f44b9bd294b554bcb220
SHA256 68fcb935ed982c315712ba0a18d2e77654a30024dac6148c235ecbb29bf513d6
SHA512 fc692d12cef525ad24600624ca1090e74fd3306c436478b45f5474a96762f4545c4b61e25c3d1d93c47ab22c2bb7fca11f7de316d30879798c631902bbbc013a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\rpc_shindig_random[1].js

MD5 6a90a8e611705b6e5953757cc549ce8c
SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 6a78589bd4d24c25df19f765fa85d9b1
SHA1 cf3700d14f4da9237daa27a44a1baac1fdd9425a
SHA256 ce148f1950b412f62f68e6d4589e71c2e42a6c0398cc87d4c3509d12ff79623c
SHA512 9d4dba5eba65479a75508e2a84a75c3f8df7565147b7c8f4c97c05a9c6c9c7cec48683546fe0a9b5845a10c082be6d55ac022a2fd3eb45fb53e54f986a655e67

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 659c014d9999ee72a12f95521fb10df6
SHA1 2f8dc6030efc80bade54f45fca5736870151e56c
SHA256 722ae04185712ecc05d750e718ca3d9e464943a6a0684a53c1c7bf15749bdd24
SHA512 bf9468a14e500f3f31575e820b02359c297502d43cb821f17981fcd1a7aabfac3829467d6608efd796c14698de9c83c9e2590a0f16e7726b36dc3b12e6f31cde

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 46d905cdd615f257582c2b4cbfda9024
SHA1 acba4d4a8564fc89df3b6bb9113077dd0f942481
SHA256 bed9726d8174e9066c631e6adcaa5725a86eadd94f6f31388977ec653f83e900
SHA512 f2f1a190dfc42986e1801e6a8311d36201fbbc7d467d601daca1690c8c83d6d8fcff8150ab9369f240545248076184d381baeba2fc66a5bab27332c6dc6e79ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f8b3622debc1e1b8efb45c81e75b912d
SHA1 d2093818902c6bfb31021b88eb3dced410c845b5
SHA256 e955ba6adb925ba5c29c71fc39e979086017a1f0586a704762bdfbf56fe247bc
SHA512 b37ad294ace13f7cb1732c6ab477566f886bf6045480fbff98e943134ead9e28d1b72177974acadd5b0d21745ea0c2940bc3adf6c34c107ef10da56c3b1cfad5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c9d2a5aca6d4f5d46e9cf54888837087
SHA1 ce4aa0159412288fd9502362977a4b49034b3791
SHA256 a480bedbbf085acff85017287fa95f4a334cbbf1f00f93f0380a5f6b73d06fab
SHA512 7f8900c63f4011fa2204b518a669e3090b227d5c343180557516d624889bcfed0c2a2526ad285e2af640777e0df7c5445f81ddf835be054a26ddb78c7b7e7958

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75e2338d2f8c81c9f3d604b2039879a4
SHA1 a3749cce7e5a2a2550a4a861fe26808e8dfb7fb4
SHA256 e3674f3d49708bc8cbb3d2f96b084c56b4780773ca480ad2a8d488141d256bc6
SHA512 688f3b56123251bff791aba0cfbb68068466b0d851e9cffb47968f9dff3333b391d95391941227f8d3b741c25745cd29b893d6497795a3e3365e7cad19b71d1c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f7642f94765b3ab61b20058a1ce2a173
SHA1 c08a83347b3aec6711d35adc6b2968918d85f90f
SHA256 c95b5192e4ed05d0961c04fc017c7be0e8a55c6c723a4735aa0304e53b7f93ca
SHA512 3d94ce129e974b67ea082aef50aa0a3b145e228b11ea40e3c01a587f11f7d2de71512b894af9f1cb6b20bb0fb6b121519ddeaa8a89a60984f41ad621d7848572

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0cf91205500160bdf60b7309f2df911e
SHA1 e5125df172a4d36fbde6cb98a4ee02d0df6a1a43
SHA256 5b8f7d74843eac5aa32f16575185facf847c9978f2a3625ddf8a388799413549
SHA512 076ac45a41512c375b4313a29311b54a437462ed2b5359b24c1d452325ffc0f10810a57c57fd1bf74515f1e094d92712c85f280b4f2a287deffbdc53f6008f07

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 923254f9ef5e439e3c565703989264f9
SHA1 9dc69941d45bbd5a8aede6ee1724cf7c360001e0
SHA256 ae2a4ca1d9616749fa02f8dda79cf2106055bc38286528ae25c5f7a62a78b72d
SHA512 a26a28ccba370cea0984baaf5468a924e04b82da44772b228ee9027171cbe19bf5d70e37e3bd5b16dcb9c3742e1c58923331db936d7782c711f6993b2e294f49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 48dac9d33f736bdbf73f777d8b73ec64
SHA1 5bc028393e0ae9e04098a34b73394636da991c14
SHA256 fdc4f6ca03022abb8a0fbfcbb42bc6f8a616d79a95d608d8a5ee2290644bbc50
SHA512 f959390f9620f7ff1d2fdfe78f28c1032db3236937ec986e6183a32171d9dabec0ef5f101e8a01f6ad16a8f5fd4cc7dd520f9ddf53e01c2a85d89e5eed9abbc1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc62a1f3e97e66d78988b8c8cf4005f0
SHA1 21eef029752beb2632200bca3790aac2cbb8e778
SHA256 4724ede34878b2aac7a28ab7c3c2a5221366cddbcb2cfe8a35a3c39e2eb330aa
SHA512 3276c7d43acdaf1064f85b0bd45426c0a879a9fcdb47961f6bb8fda3f3fce2d42c8371b063e5800e2caa1a3219d22e5eeaf8e8cfb2fca0f085ed12e14ce75ba8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 687ec05681f6d4d0dd03ed7c8da5736d
SHA1 2e520b0fb9f771062acdc3fbcd9b59161f5f0625
SHA256 a94869a7b5116eaea735d1fc08f49e763369984c8aa6cef0ddd182d17291695a
SHA512 b9fc24387a63964cdae5412cf2ac97a21ad9bf5583a43acfadd1dc2bed0bb16f8d7125cecdedf070b69456a6a58f3ef54cf22df71017a21a5ce43c7edc7e014a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\tumblr_mynatycCdI1t2iu5ho3_500[1].htm

MD5 3ea1c8d079b38532a6e01a96216ba5e2
SHA1 598d3ff91d3e252f1e13df8cf0348b270ff2da3f
SHA256 87a9323ac85ce28867d5d7ce590c8f29b8d1a999961fca71bb33adef48683691
SHA512 cb4f800a735d5ec435844ac114a81ee6c4a429138119b97f2266edb87cf729f1a64662190d04917ce955b0bd3681610d49be42cd6782989ecd4b0d87ddf8a03a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fcbaddec4cc79987f8483087a07930f3
SHA1 4dabb594ae38ca4bf4364bb7e1ddf1f5b7139793
SHA256 31300d57c6cb07527952577283cbbee4e7fd2d87e209961a0fb192a0c79a688e
SHA512 4ed421c0611fa72b40ccf3b54f206bd22c2efd0f38e316a9b6bbd6fe4a24925c57b52d1b6a38ecb3cfe204c0b1366c2471abbcb07d1c4f714ef8221890c1a69f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\fastbutton[1].htm

MD5 4df07581948280a6e769a24c5d99d775
SHA1 843a2c95362347eb8894a6acb607f139be65ded4
SHA256 3561b93a48d81fac116ccd6e60163bd382abb1d594c81240f5718feb1f197f73
SHA512 bfe455150379d9ec4303659ac16a5082e093ed248fa9d75276bda05287d8bd51c43aab5896826ca55ffee88dce281df359fed6d38395ac3e7cdb7b68c2d35e4a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\P1EYHLNW.htm

MD5 3a7d0408b3d08cf6bd169e4e9cdc6c7b
SHA1 ed4ca5396ca09c8b593bc81e19ce6e0a0868bafa
SHA256 2ffc3515d49ec7dab32664a1e2db8e90aa1bcc1ebc15b6277278f048944f2660
SHA512 9c4391bdd98f17ad204f74be7725cd1c8390fabcca35a3689d36c70fafcb897c090db6c36fea7d32ce37e9e3c950d2e72a128003bb358d97145ce772441544f5

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\errorPageStrings[1]

MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\httpErrorPagesScripts[1]

MD5 3f57b781cb3ef114dd0b665151571b7b
SHA1 ce6a63f996df3a1cccb81720e21204b825e0238c
SHA256 46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA512 8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 09:28

Reported

2024-06-13 09:31

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

130s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4da3bb0f9f25a7d5a420db4f781ba84_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 3220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 3220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 2484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 4536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2916 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4da3bb0f9f25a7d5a420db4f781ba84_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd7e046f8,0x7fffd7e04708,0x7fffd7e04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3669375050647022704,4790759374284372148,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5376 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 static.graddit.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 assets.pinterest.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 assets.pinterest.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 assets.pinterest.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 static.graddit.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 assets.pinterest.com udp
US 8.8.8.8:53 assets.pinterest.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 static.graddit.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 assets.pinterest.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

\??\pipe\LOCAL\crashpad_2916_ERGKOTVIGIHFVNBP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 58eb9a93027b1aa09b681488c8ab3757
SHA1 1069193ca9696c0b33a8ba46711eed9ebaba2bf7
SHA256 d4625d09bba6986a18920ff2b036e8f4b3ffa55f2879d8a39ec3d3f02ce7df51
SHA512 2f8cb01563cd4f8f6690fa629e1120b40a7903a34495f0c763673109754a57c319bb1ac4b1c9c4f8e9928569913f634de2e6706c17df7ab0706cc0936abc11d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7054e65e-3e7a-486f-a933-70d4498799c7.tmp

MD5 fd6d3394e62be025447fbafeb5d21968
SHA1 078d4e8bd9b6fdd70911e21397e402d3a2811835
SHA256 4097074ae39c1890d68a4fcda82dd469c219fdb91c1179e893d8e3cc830c0f49
SHA512 d2ca45dec5f46cc0a7569bb2ac3a028e31c581e33086d8242129bfd676b2f8e7fb524503c1a6add7f41617fab0b67968b1b0651d331e4eb02b03fe9a25e645d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e742f8a03345c525d623e2378aa33720
SHA1 04681b3ea73325298e7cecaf582ab8b142b1f8a0
SHA256 5f38c13e531f1315aeedd7a15a084bc95cc8e14beefe5c84fc2ad236f80eab5d
SHA512 b97f53dc0573af71a9d9e2c86d6b8eb217dd7b0b8cfb5991052abb12848bffb55a9edd6aaadaa76a23e748d3786486a427e26dad8ba17d25765409c257f2f491

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 040f60b7cfb3667d26bb08b95473c791
SHA1 9f25acedaa56b684dcde39f5d563dc3b4b9e2a08
SHA256 9784e92716f47d195c3ccc575229a69591700925258c46ca85bab4c13fb75a21
SHA512 8f941b2f4ccb91f467deb63b002e502b08ac9003e7c5d71e43d5d00f4d6b3a135d6b0ea7f163a831e0d4376dbc48bd1a4d0e6ecdc9765b129d3bbacea6e05365

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 130595bc7361a94f99fce8b53eceb66e
SHA1 4db732fa5cca89780b48d9184399303f1f9b7294
SHA256 806e2be3b8d306fbff00a91e7dff739ffa8c501f134df05167aaabde6e9d78ca
SHA512 41fd1e56872aceb486a5cc0f4675655725502d3e68f3963d5285d637a9a0ddf3f995f2b8a786e971836290ad21b2aeb5bf285b6ac7e3fddb02a1f48894685a97

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0b9a74afa78d8be3e207426d486ee9d4
SHA1 a5de62965a8ca09faff27144d1c2b348657eef68
SHA256 627ce06185fdf9d88808c841ebb59dda86da2701a9af94fe1f84e24a24290cab
SHA512 45b01edcc391c42ca63f1788f2c5b87c26e2cb03e7c4c33f92a253779277cb2afa72ba42bda26cd895d66e79097c36a7e66c3432c178d0cd3c5679036a864b8a