Malware Analysis Report

2025-01-18 00:22

Sample ID 240613-lne88stbjg
Target a4e52075f0b3286492d6b4d22306b7b8_JaffaCakes118
SHA256 bbc4507406b9454b8777a3763fe47d5ca8130a14f3e727dad40bc5b003cccd67
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

bbc4507406b9454b8777a3763fe47d5ca8130a14f3e727dad40bc5b003cccd67

Threat Level: No (potentially) malicious behavior was detected

The file a4e52075f0b3286492d6b4d22306b7b8_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 09:40

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 09:40

Reported

2024-06-13 09:43

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

127s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4e52075f0b3286492d6b4d22306b7b8_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4168 wrote to memory of 2100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 2100 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 2700 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 2700 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4168 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4e52075f0b3286492d6b4d22306b7b8_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbaf3846f8,0x7ffbaf384708,0x7ffbaf384718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4178718849692797367,2226206015061728802,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 lostwebtracker.com udp
US 8.8.8.8:53 green-tracker.com udp
US 8.8.8.8:53 hdfreewallpapers.files.wordpress.com udp
US 8.8.8.8:53 images.automodifiedesign.com udp
US 8.8.8.8:53 www.cartype.com udp
US 8.8.8.8:53 www.ultimatecarpage.com udp
US 8.8.8.8:53 www.auto-power-girl.com udp
US 8.8.8.8:53 www.wordplop.com udp
US 8.8.8.8:53 www.fotosdecarros.com udp
US 8.8.8.8:53 www.dragoart.com udp
US 8.8.8.8:53 www.decodir.com udp
US 8.8.8.8:53 www.belovedcars.com udp
US 8.8.8.8:53 www.jpegwallpapers.com udp
US 8.8.8.8:53 www.smcars.net udp
US 8.8.8.8:53 www.fordmustang.in udp
US 8.8.8.8:53 img230.imageshack.us udp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 informacyde.com udp
US 8.8.8.8:53 apis.google.com udp
IE 52.111.236.23:443 tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

\??\pipe\LOCAL\crashpad_4168_CMUFGKUUTFMQVQYY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 232e6d7fa94a9b241840e3e169f521fa
SHA1 3c9c37bade8fcf399f4561d14a771b4d6fcac1db
SHA256 de2532628bffe483f49aa326724f31f8965a302f5b1790e701c7f6727b0e837c
SHA512 6f541bb72e1937befeff352a59b187aefeb94b605f66b86c9d136a8e33712b11752bca061c2d5e6de03f5c485cead3f7d037d4fb50b1f6062d21436a0dc02c05

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8c4c7799af389b1ca6113b7c08f05d34
SHA1 e0b119bc92df939c30b3bf340df47c34a97cfbb1
SHA256 c7c5eb8e64dac568e443de4a9ec9633e67addf0914fde5e3a46063fa16ed4b08
SHA512 9df0eca6c3c391311f9e370ae0453cd38c6e5e1b7d917342bf8fb8e3c0dab501f78f410c3db713510c286f5f234b2b51effc79a79943c0bf012058748ee90303

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 40f1bb455b38bcbf7472f2bb4c71c574
SHA1 8778401ec7c64e4b931a5f2a5ff034e1608c59ad
SHA256 0996df7d0903fd8bbba4d313256d8ecf58d5cf01e17ed3935343405ed05813f3
SHA512 7149e3a406a81d9f8c2a56e9eeb3efeab3ac4ca57f930b670a5ec40c1776313758dced1431b8ab2c04e817b5380a24e02107e7fc76569f3ea562231d783ee5ff

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 09:40

Reported

2024-06-13 09:43

Platform

win7-20240221-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4e52075f0b3286492d6b4d22306b7b8_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F91262A1-2968-11EF-8F9A-6A55B5C6A64E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046e115599e40634c9d1149ae75523540000000000200000000001066000000010000200000002868f987151970aac395248bed662a6042935c76517065570a54f41e89688940000000000e80000000020000200000007b3a04f1f785d0e2f3c3f75c3ba5d78850d966ecfca5a15c3d590363d7bc9bb52000000070a14ae0924917520d3c897fb5c9adb5e8fd32ec0fb8016730431b079ea09bb740000000b619cbec627182a6c28c1cb9c2525cde2cbc7bc1ccebdf4ce5dd026880fcc4feb1a3f1eccd0b9814631695367c0110059c209b6026585cc630846443cc0c9c38 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d88de675bdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046e115599e40634c9d1149ae7552354000000000020000000000106600000001000020000000616b297aedce879778cd83e7edf1b6317837a69993798476aa0e1b7b88873c28000000000e8000000002000020000000ef5474a91575d6f591671cce4927cc28b396b86c022207e5670bdbdefd67b38690000000bfbb3b575f9ba7803526ce6c100cb3b687b71e0d330c90d36396dabb0fe3915f61b81c5ea2d634d7c7a42d76fb8433cda7a156e416687817e0ac9213a17752a631492f599f7e4b3cbc6dfe89d6633e37590d069a2399164cf69d6a485116f96a9e4c00c43db26ce044ed806bee816bed3f9431566d0b6ca1690a3f5ef8646fe6763b262dfaf691745ddb592e1f32e06140000000ff2232c26b72895f4115d6734064b5a3f9c3649f473fc4c079a7e628eb27926887bce65f922dce663caa63df89eadb11f8f923314e24e484bf5de2d2ea33de09 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424433498" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4e52075f0b3286492d6b4d22306b7b8_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 hdfreewallpapers.files.wordpress.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 www.cartype.com udp
US 8.8.8.8:53 images.automodifiedesign.com udp
US 8.8.8.8:53 www.auto-power-girl.com udp
US 8.8.8.8:53 www.ultimatecarpage.com udp
US 8.8.8.8:53 www.wordplop.com udp
US 8.8.8.8:53 www.fotosdecarros.com udp
US 8.8.8.8:53 www.dragoart.com udp
US 8.8.8.8:53 www.decodir.com udp
US 8.8.8.8:53 www.belovedcars.com udp
US 8.8.8.8:53 informacyde.com udp
US 8.8.8.8:53 www.jpegwallpapers.com udp
US 8.8.8.8:53 www.fordmustang.in udp
US 8.8.8.8:53 www.smcars.net udp
US 8.8.8.8:53 img230.imageshack.us udp
US 8.8.8.8:53 resources.blogblog.com udp
GB 172.217.16.238:443 apis.google.com tcp
US 192.0.72.19:80 hdfreewallpapers.files.wordpress.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 192.0.72.19:80 hdfreewallpapers.files.wordpress.com tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
GB 142.250.178.9:443 resources.blogblog.com tcp
US 188.114.96.2:80 www.ultimatecarpage.com tcp
US 188.114.96.2:80 www.ultimatecarpage.com tcp
IN 46.28.45.167:80 www.auto-power-girl.com tcp
IN 46.28.45.167:80 www.auto-power-girl.com tcp
US 45.79.0.147:80 www.cartype.com tcp
US 45.79.0.147:80 www.cartype.com tcp
GB 139.162.231.11:80 www.smcars.net tcp
GB 139.162.231.11:80 www.smcars.net tcp
US 72.14.178.174:80 www.decodir.com tcp
US 72.14.178.174:80 www.decodir.com tcp
LT 194.135.87.146:80 www.fordmustang.in tcp
LT 194.135.87.146:80 www.fordmustang.in tcp
DE 77.37.53.85:80 www.wordplop.com tcp
DE 77.37.53.85:80 www.wordplop.com tcp
CH 83.166.138.83:80 informacyde.com tcp
CH 83.166.138.83:80 informacyde.com tcp
US 66.81.203.196:80 www.belovedcars.com tcp
US 66.81.203.196:80 www.belovedcars.com tcp
US 3.19.116.195:80 www.fotosdecarros.com tcp
US 3.19.116.195:80 www.fotosdecarros.com tcp
US 192.0.72.19:443 hdfreewallpapers.files.wordpress.com tcp
SK 109.74.156.2:80 www.jpegwallpapers.com tcp
SK 109.74.156.2:80 www.jpegwallpapers.com tcp
US 51.81.245.42:80 www.dragoart.com tcp
US 51.81.245.42:80 www.dragoart.com tcp
US 188.114.96.2:443 www.ultimatecarpage.com tcp
US 38.99.77.17:80 img230.imageshack.us tcp
US 38.99.77.17:80 img230.imageshack.us tcp
SK 109.74.156.2:443 www.jpegwallpapers.com tcp
US 8.8.8.8:53 cartype.com udp
US 8.8.8.8:53 d39f23jfph0ylk.cloudfront.net udp
US 45.79.0.147:443 cartype.com tcp
US 45.79.0.147:443 cartype.com tcp
FR 13.32.158.193:443 d39f23jfph0ylk.cloudfront.net tcp
FR 13.32.158.193:443 d39f23jfph0ylk.cloudfront.net tcp
SK 109.74.156.2:443 www.jpegwallpapers.com tcp
DE 77.37.53.85:443 www.wordplop.com tcp
SK 109.74.156.2:443 www.jpegwallpapers.com tcp
DE 77.37.53.85:443 www.wordplop.com tcp
US 8.8.8.8:53 dragoart.com udp
US 51.81.245.42:443 dragoart.com tcp
US 51.81.245.42:443 dragoart.com tcp
US 8.8.8.8:53 lostwebtracker.com udp
US 8.8.8.8:53 green-tracker.com udp
FR 52.47.133.116:80 green-tracker.com tcp
FR 52.47.133.116:80 green-tracker.com tcp
DE 77.37.53.85:443 www.wordplop.com tcp
SK 109.74.156.2:443 www.jpegwallpapers.com tcp
NL 95.211.75.25:80 lostwebtracker.com tcp
NL 95.211.75.25:80 lostwebtracker.com tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 172.217.16.238:443 apis.google.com tcp
US 8.8.8.8:53 developers.google.com udp
US 51.81.245.42:443 dragoart.com tcp
US 51.81.245.42:443 dragoart.com tcp
GB 216.58.201.110:80 developers.google.com tcp
GB 216.58.201.110:80 developers.google.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 51.81.245.42:443 dragoart.com tcp
US 51.81.245.42:443 dragoart.com tcp
US 8.8.8.8:53 hdfreewallpapers.wordpress.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 192.0.78.13:443 hdfreewallpapers.wordpress.com tcp
US 192.0.78.13:443 hdfreewallpapers.wordpress.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 www.informacyde.com udp
CH 83.166.138.83:80 www.informacyde.com tcp
CH 83.166.138.83:80 www.informacyde.com tcp
US 51.81.245.42:443 dragoart.com tcp
US 51.81.245.42:443 dragoart.com tcp
FR 35.181.141.150:80 green-tracker.com tcp
FR 35.181.141.150:80 green-tracker.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
GB 216.58.201.110:443 developers.google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
FR 52.47.133.116:80 green-tracker.com tcp
FR 35.181.141.150:80 green-tracker.com tcp
US 45.79.0.147:443 cartype.com tcp
US 45.79.0.147:443 cartype.com tcp
GB 139.162.231.11:80 www.smcars.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 e471f13890743208337c31bc66c52abc
SHA1 82ecda411860550f02fd327f9fb5f77fdf40c573
SHA256 349599d714990908824596ee7ce58f8568610b0320a68bf7f59aa99b0b542b10
SHA512 a88ab645e178aebd5d31bd1e600c8ae4bec8c74bd7d9ade64e785ffa9c3d325446011794d050c0e41d3ecb6e2a477c6a96f417788032a7c3449510a6ee294551

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 cb85f3fcf86ef0de7ef258539cae87de
SHA1 c73288fff07885a62f8c7033b348863ed3b8cad1
SHA256 7430a96d94b1faa5363b7656b323ffa416fd262e0405e498bb143dc93443963f
SHA512 dc152f2e8c8f7e316e84f7a1f3996e02c08d582d6d0e40b8bf7171e359ea952a80b7452e56690b30fe98b4655d4744e8529a930449ef1cd853e377f86294b2d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 c11fd5b6418c86dc022394eb0cab8e4a
SHA1 8be45830eb6a3dd712234c3b88171bf4482df31e
SHA256 23f343521e9166c50b66d59fe30767c021dbc19b6acc48a9e19dd40eb62df7fd
SHA512 64bf3abe8fdda8306b40c22123eddb323b05335131d97db76e6fcc8dbc64f2a53da86076e0e12b9a1bdd8c1920a6a6e8cdb65ee1ffd9764e2cbea1807529eede

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 f907528e20bd032660cabadb373b5e63
SHA1 bb73174d66bdaeedc2ab08534712846143ab0ef7
SHA256 126a14115a3b63d536b41508af5360c47420395f4ee4faa1ae2413414adfdf26
SHA512 626318a20b0b0224675222b003c52af5db82769a19010d6fe86b2d16c5db4084f8f3a8533f5937a2599101c24b83db2d18363b0cd20b08e601de8e2dfb48f269

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\Local\Temp\Cab279F.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_DACC52A1882A05AED14688828CFAE295

MD5 e2d2e9a137554e83ad7e4e2ba2975fe9
SHA1 63ad930fffdd2c63de58d4f3d104b7e3a609b3df
SHA256 ca64ee3b58ed83d8eccc90f0e6165a6d43bcc6adbd4d22d1e01e3ca2efef50b6
SHA512 73238228170e36867d2f6ac8651528749fa734a5852425ca1b572d86f986bfcc7bbfda6c6f6e7687d60555697029046988e5dccd8d726ffc95482fafd23154bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_DACC52A1882A05AED14688828CFAE295

MD5 a4c3e4b3f212ccf9719236eaa8f728be
SHA1 e017a18974a9969ca60ca2499ac54b464d91a2ef
SHA256 0641546fbe6a6bf201d918796cf5efa992632208053037f369a6173cc2afd39a
SHA512 c4c229eec604f4022ab0d439eb8b95bbdbb554d809d4571745957f0da5dc740e4ecb13757273b9dcf9f431a5b1ca40d53a539e2ccfaadbf7c161dba6b8b2734f

C:\Users\Admin\AppData\Local\Temp\Tar2832.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7dc480ff57a95398709401af4b7e6b9e
SHA1 dfb4899625a3e46b38c1de0c40b1ec2ccf1e9cab
SHA256 14ae4b9f7e3fe9421de0363e92eed3df3fe86fb37ac71acc058835d044f4b73d
SHA512 f8efb3c02145dcda39245f9f4bdca6fce2bf1022b3a5644e1083d5f08610f0692cc7bd57c31703d94a1f418bc0f29a8544dd567618d8fcc2239a324489899433

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\plusone[1].js

MD5 53e032294d7b74dc7c3e47b03a045d1a
SHA1 f462da8a8f40b78d570a665668ba8d1a834960c2
SHA256 8076b082eadf0cab4a8823dbd7628a0b44f174c17b3221221c0e31e7c60307a2
SHA512 fe263fe86aea2ba1b86d86305650cdeee45cd1f7b4339f9d4fb81db776b78abedccd0ae77262f45d579751daa26f81385354b3d126fdb5577036e9dd1db33276

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f7e543c3c7940f688f1e660d0b28ca68
SHA1 64b3e59fc1af562744d1df837bf79036f13610fc
SHA256 dd6604af1d389d1287d40608f918f7859a98cb95e31a0accc8877f9e5016b220
SHA512 c0601494ef51062eeb82ee0b0dcd149b45250002a7b978e6da19ec97895e12d1a52746fc7b475f59bcfda34df9ce22caa75c787096752f41558f55d256b4351e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0a1e110a538534ff2420fc0a08e41099
SHA1 35bad93aa64103c91d4c5d6b9cff8e8c11cf5bea
SHA256 b187368a66557869fb25494aa2a61ff17fc5d6cb9e2702d0dce3d6eb90b06ca5
SHA512 ee01ac6723a0bdb8faced263038e7c220e4b8f4df547863bae4e5dbfd47b51fcbda5a94aaa21667002f5777185d75d55719d1c436fd31b130b828ce5717ee63d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f7e51775874d392f07f880d5817de3f7
SHA1 928418cb4ff316e9f7ca1e66dad8fc03bec22980
SHA256 36e40bdb4a0c662b9350fa52e733c9608eeef5714f6c999302d130818b19fa84
SHA512 1ad4a97ae699e3809a28c539b959c53259a9f53d96f3d2dc04dbdaafa36b82b1a44c06d09b6578a9dccb3d1483e74d394fcac975114cc8f414f1f4ac07be9503

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 0fc93f9cd5a308d2437d1d27508b6d7d
SHA1 5a33053c6e35ee75d2b99b6bf83f8aebf4407845
SHA256 cd3dc37471a3ecfb7aff37c59c2ef4d548016d276af3f136b1a77a5ac2cb1a58
SHA512 e4006fcc52554952ed1b30fb60e78b4c3b0fcb2d173ac7a0fd750dac18def6b7baa3bb048a269db54b21324fee572c9c4e005e023a360dfe318b3fd99c0d7b55

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 01f84985422745164345135b62e2b071
SHA1 e2f331423e5bb4b4e639e13ca516e9ad33297b30
SHA256 a897a58b5aa3277a012c90a7aee8de9fbc720c92d04d03e41c1fa33a2831597c
SHA512 fe59030ace91fbb62a1432f24e24b7990f6b897d3fda5a351be4557d69ab5c4e9501e005e2f2e69522958ca87f0a340c9fa8c18ef278b6364db5e0655e8af03e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bfcea6d67c2e55b34eef52a64698e00f
SHA1 53e2ea9b40e24eb3efcfd5403f962950a8d42b0f
SHA256 9657063688925404fc9966f6656faa5a660a076324cd5587fbe574d54ca47802
SHA512 6e88811dc78f5e4b321bd124f46f5d78af0d09ea11493dbab47652e82737bde575c971e91705d192d4199add999aec4cd1ffd25fa577a4a0739d066085115115

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 05568f70359e57d8e4639ec82c5a3d97
SHA1 eebc26199a9d18e51c32b0ef3a1e7c2ca37e6c48
SHA256 bdfe1e2e224d67c35cd519faacf77964057f60a79374c1d4e8240ab7c4e6f971
SHA512 228250fb1d4748159fd4b1700b2dc173bd9514acc68c03d84067085bd56ebcf13d9248555f69a6dac5cdb3aab82ee176fa85ef8d1eecab1023be662a1b953ae1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92e892da4bed5c1f34b294215b55d64e
SHA1 8b72ebd1d0adfdc4f5c0d4400f585bb8d90c27af
SHA256 6d4de027fba2f0758113595919e8257c860cc4150d3cf95d67c5bfcc1fdef4a7
SHA512 8d52d20da8349fb7728831de80c84976394e608867bed681ef2460bc49cc02e3d77dee8ae2e077f525a3b2968822fde5ad2361502a2145aaac15daf50a0522c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e0475119f957a4f6f2cc285b831f3268
SHA1 7854f7acfdfac931343518d3e06c54457f424d6b
SHA256 7a7458359a571a47217c5c8579bc051a84cb81e00adfc78055cdcc59f11f6410
SHA512 e1e3be4a6e068b5bd771739fac04250b765ad2e58a2b7e712dab2684c2f06a57c56b37a9358334bbe1c05d57706281e7ce6f6f6a5ae929f7ba1b8083453a17bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e32d3b042fa323a3c95d931478d9b28b
SHA1 1fe3a0db571f8afe2f1e5c1eaf49653ddc6b058f
SHA256 f8ce62575fe44bdb3edaa255da01deeabbf16996a2848ac3053f1073d2726302
SHA512 e2f04292157fe9d7e7b810dad487dcdaf2fdb2884fab8d44e8dd23957fc4ac9fdf94a47b46cbe4dbc6b8d94f959966b2a425deb98288edbbc069e86687b35014

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\cb=gapi[4].js

MD5 f9255a0dec7524a9a3e867a9f878a68b
SHA1 813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b
SHA256 d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d
SHA512 d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce3b34359ad52077cec267a7609f7169
SHA1 1a382565583657e780891110a1d906da573dbf9b
SHA256 4ffe0d74d7b90a929e98a5dba2bcd8ec6d94d5dc42667edf2411e342c4c4759a
SHA512 135ec5089096ce8a0cddaf2f2c36d47775b13c8cca476a72deb4073ef06bbfdf771e68c1f7f0a94b7547b50b2985e11de4a5a4baffdbb25fd5232a81d5b439b2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f07f547762bebb311cd977b7e14ad1a7
SHA1 fb2117628a766eae085dafcb62f262eeed250c7e
SHA256 d7afedd2d7ffca022c2316080ae7e447b0b88daca3a94f5fb0c8b283ab622eb9
SHA512 3d03bdd6ebfc13d5e237cf812f6e672055495d1fe5110c5bd92b1a60cc978a18c66c218c810f85b22bb73d20c573786793e92a5a1c7c490c27e82646d1947d19

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 db219bbedf0c4a6be4c4941c5c9b8e6b
SHA1 2c0fa8611b7ed0525e027eb3ab57eb43e14df927
SHA256 b5d593a87bfca29e359f11db92106b38231dc4974de990afcc2a0b1ac6d79325
SHA512 533cbfe6cb938826404587050cf4d48812df7b64c5b62a06f263966aeb0551978b85a3c92cdda4512fa4f20d861a99fb746ce98296f00b381690d6e656f1709b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51811e604db7fd36ee5af076a710c42d
SHA1 e0857ba223450787233cdb888202da2bd572c532
SHA256 66dcbffeddb650a5f18c8aa3d7a69717abd6ccb573df668bdf65709d98826095
SHA512 87a55c67d1d250759eae24f307da85ccc32b0b80d5c2084a326ccaefa521552bbe0ecd69ab999ef4d53356b46e56cfc0330c9a0e3992baf3cf45d7614a547840

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4bc7e91470c76e83879d6aa33f222326
SHA1 925e1a2221a6c311a426a104226d816678bc5f60
SHA256 5a0557cc59d9361381c59e8cfdcc3a2554994567e6a4f93e5614cba7cff2610b
SHA512 bfdb776d970fd3ca946a8f47bcea94c63ec8be40f18bb127eacb6224cc61558ca33299004b5152c7b4f38d0e137a4ae4d23cfde7c0433c19a04f147acd6453ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 769296fb0280fc705d6d74ca13cb4bf9
SHA1 f1864e19402b16be3cec8935253473aa81eb525d
SHA256 f7eb4b904d2ff028875145f051f86d79e66498f6d7a3742696ea511bec9a1036
SHA512 d649b27a3c4925b080fbdf4dac601e183381fa30a7f18f5f9a0d74314bdef78ff159d1b937aee0495ef76b89ea4e35f82d696384ff314cf2e319e4854dd0e4bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fcb6db93702c6a2deb717cec2375f592
SHA1 9ea04e73c75a8f6a7d1ddddd35d1a3d51bcea5bf
SHA256 842548808113479c7ccb733e7c15b07d86abb923ce80b34a7df4cce24dc3f6c4
SHA512 61c34e6fd3bfa45ea2f7d4c257ccdc7bc350796c1e5e4274006c6dc6b1763020fd7045418dfd20a6a652081d7323268acf6c3e3fcec3bd4b53c9f0cb327736ad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0bd9e9169d555ed47d5829e0735329ef
SHA1 86574b155299007b03a38e972afa3f86871cc891
SHA256 2efa850deb4f8b97fa85a9f16248c1eea034d24aac71cb570029370c8bf606fd
SHA512 8915828f04c49596a446f7bd5936b41f848020ba9992ecab47545c00d9ddb110156d1fd3ac294cd55d8acadbfd67df8cbd4363405af19a344f462617f2ffeea0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 585e8341de8452361b66da97b06ebf9d
SHA1 4a06c25e8dc36c8c777e8d34928c41d88ed98e0d
SHA256 f32382eefa8173d3f6851585a5ac1f05d6c1eca6b4fa8011fdff9a2330941f5e
SHA512 c5e318aeb33f572616485c98112c7fcc53b82ca897a4c4cec731bac40491b9d4a5dd60f59c8611f4291931da92c28cd29205d026b730b20121e198acc82dc77d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63245bcf4407f29da556fc987e22f3d9
SHA1 701a81a948122934a453b1da33731dd60e1c6fc6
SHA256 4bdfac0a7f20beb692aa0603538864c6400d27644af35e1ec89a2b294151a657
SHA512 d1ae1cbb61420f17716e8a0c16a189c71ef1200ce7d71be1b365e8714369b265f3603d184bd98d50d126b4d009eed5b0f91f88aaaa96dc1208db501dac9689fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91c357dc510d7644589b213fc751d911
SHA1 3d3350b67bc346105229d718e942b9bace72a667
SHA256 ca154bac3faae9ea69e58f96dd94697c60a5295408c0ff875c3b80d359d6d432
SHA512 86f9122f76773b2b6fad5c13403a0c21f30c93fb54dd0166470b8e50bcfddef8fd480e2ad701aa531a4a4dc6de0c66efbf0baab506797b17a98d3f2e509feb9f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a81d884459022b87583f27419985bff
SHA1 f3995973b6bee2a44ae6db14335963a93a2fd606
SHA256 e9b31f8a953f82a6c747fc0bbb727cc00c7dde244e091893cd58ab5f20bac71d
SHA512 0151a4433d6684d46305f098ba13872dcc404c15117177102b468baaf720e00bf0db97eac9cb41cced4e782c8469618ad73615c30e26d08cc1dd47fde25d0fd0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\3604799710-postmessagerelay[1].js

MD5 40aaadf2a7451d276b940cddefb2d0ed
SHA1 b2fc8129a4f5e5a0c8cb631218f40a4230444d9e
SHA256 4b515a19e688085b55f51f1eda7bc3e51404e8f59b64652e094994baf7be28f2
SHA512 6f66544481257ff36cda85da81960a848ebcf86c2eb7bbe685c9b6a0e91bca9fc9879c4844315c90afd9158f1d54398f0f1d650d50204e77692e48b39a038d50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\rpc_shindig_random[1].js

MD5 6a90a8e611705b6e5953757cc549ce8c
SHA1 3e7416db7afe4cfdf3980daba308df560b4bede6
SHA256 51fdd911dc05b1208911b0123aed6b542e9d9f04c94d7504c63d89ca259ef679
SHA512 583636571c015af525cddd5b8dc2ac9964aba5a7a9b0acd3908e4aeb4c2ee74cdfaabe49b0aa13d7b142748542426864e91e88e90d7f73bc647f0bfecb0ff7bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d723627042e55260a6a6012e66c4e56d
SHA1 130dfa64b1f0074ef1242f970a496da71356bb33
SHA256 19ada036f9d4226903e0db60e614ef7e9c2247b2b286ff6818d24d055f43609d
SHA512 3ad6c331c142e1a893549fa1d76d7261bfe8ae085f2d96446e32e560fc5cdc7e06c4203bede9d412cc42e5f40fcb07405e6156c48b3eeb4244f5c59f14f3dbea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9d01c4609aec0d9955e6a346deed7c97
SHA1 12c756d356090a6608e1946d164a75b2dacf16da
SHA256 1c9a3dbe8f9181aedbea55208ab276702c7895e39a48c8ae0b7eaf5ff12287fd
SHA512 4e1d9fb22016d994421a5f52bc49e9d13b0926f1d019467eee0eb657e16bf0eb91e3a1a1eee8fbb09291e6ac32d538fb39b4c45757c2e5d7ad59396d1d81c4e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 556e7a47102646d8f8eb98dc0e986181
SHA1 35f49cbe23f9e61f3b61ff3dc0f8a08f4a56d254
SHA256 d3c8b29328a8e630e8cbd3e2c2c2f3dc9dd13a40eb0b28e75189a22572d09994
SHA512 e6b43ff85addce65ad625e9c5f406cf5f7b07ed46f142afbb0430b7cb7c41095eb4366ac9e4c595bf0c49bd8b6dd36c91ad680ae4d9397a090d69202c444bb06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a8ffe9cb2a3dfb8de23cc100c2574a5b
SHA1 b69c6e41a03a7940b12e18abbbe6290a72eba3dd
SHA256 c9117e68943b4a429efdfa6a1cb3e88d7cf2384c91112f47daf0661c43950e9d
SHA512 523378810f80daab7e45d2cab0ebc1f4340ce11a5e9b8f5189699d47182c69621be8e834227aebb29b8fba408d99f141d72616fbb075c75f5c83e5b739380f14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7383d34e560b859eeb0e1543f58981f7
SHA1 d175db4c9435bd0aaab48f90bfaaa5ed6767808e
SHA256 d3ce3319e6edf2b5bfd9b20b111daa709eb8b4cd65679e600fb26d4505a3dbb8
SHA512 8385cdccbc433551ba82d9cd8b1268ac1db0c5f719caa6bae63502332c3ef18c3768e3e64fa65f86b8b4d618de89b44256388a936a62427d9d6f5c183252dc14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92f6c6ac14cfc4135ba48762907c29a9
SHA1 ff6a8c3d7701589d1662b2553093714c6d622640
SHA256 5f359679a46fa4a53d7cf03a8f6f7160a390d9c0d4886501f770d6fbdaf46c51
SHA512 d79e6541ef4d788a98a62fdec4470a32df04129f23a98c0f7a1d6720363980ebab05a52423edcb8abe3a198746bb4c2820fa17a93463b28b128a2316320f2907

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6b65945783820b8b6a7df3922da11f2
SHA1 91c55fbed2e35740b7a589904e97a87b04fb706f
SHA256 7ff0e2954210f01cccd57805b76180137109d61bb2715737196ccd8ab335993f
SHA512 d4beeb6571731485c2ed27e246d289426997cd9dd22ea5023f8155ad2844a08464a02c68b236da3cc98ca7b55a39f530f63df6831c59667725c92af2c893c655

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2888dceee103ad23d39ad82edb72233e
SHA1 e2a4503c63168fe47cb39f0d8e169b795473a267
SHA256 2b67e4dfc6e9901ae8a991979055a4c5db564813d57cf576031937d42d592723
SHA512 f68e3edbbb6e1156e7dca517e19496d8d3ac68f0d9b28793f8b180de8254e14e12ff37aa7483ec9a311aa552bba696387ae7c326b69775aac47b3a358a3608cf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 55c9819adba5961127c80166724f5565
SHA1 c3cd1d6f4b53dfdbd6e5e19d3d6385bd5b6d3176
SHA256 1a8c3b6cea78d7b8dad7b04f7b0df2c1cbe0807df0a2398749b5579d1cbf0e09
SHA512 d52656f05967a293bbe2fef5933a96f0b0b2846b8fe003a6b4bff369c072c4b7d610394e6f19d4b4958ad6dead4cc1b209c6dda868fd7033c5e2d9da398660e0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 614f97dbc939211d270d83b558a7faa7
SHA1 404393b455fddc3204b6d504d7419d850dccf6c8
SHA256 35f101392c5c970b5280a829d2f2c48d640c33d4673bad98a4244506165a9dbc
SHA512 7eedc6a5a03845201d52944b30190e1bd143b40c5848ac6a70da51648bb295d9bf800b4f39233a08864e426b1fb7b8fabe1cda70a78c2565583324e0895f64f3