Malware Analysis Report

2024-07-28 10:40

Sample ID 240616-cpawgavgrb
Target b14811b2b6c5648a6a3566069907a29d_JaffaCakes118
SHA256 edffb83aa9feb7ba300f2987d395a42217089a37f2623fa129058f38307c28a1
Tags
microsoft phishing
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

SHA256

edffb83aa9feb7ba300f2987d395a42217089a37f2623fa129058f38307c28a1

Threat Level: Likely benign

The file b14811b2b6c5648a6a3566069907a29d_JaffaCakes118 was found to be: Likely benign.

Malicious Activity Summary

microsoft phishing

Detected potential entity reuse from brand microsoft.

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 02:14

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 02:14

Reported

2024-06-16 02:17

Platform

win7-20240221-en

Max time kernel

120s

Max time network

128s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b14811b2b6c5648a6a3566069907a29d_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009f3d6897a1bc2d4ea4c913d363dc1a1b00000000020000000000106600000001000020000000fb246c8aacd30acf5636c80544ea214076d6efecb9d641711517770cedc8fb56000000000e80000000020000200000009e5ed4e72a3eff800b52ff532ce4d3b22e4dc81717f0e7a43df71f6057a6980520000000026f2a5d523fa2f6f4eb155201157fc32a4672f034ad484313870b0d689e060f400000009f4e27ce0bcffc67a4ede48425157db6aa885671aa5e0c892b6fd4077d2693ffc8ec9dd7a9ed13b2b7cd8f756f56bb99cb4682b717683e9f9d350eaafbaabda8 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0598b0493bfda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E3DF0B1-2B86-11EF-B238-4AE872E97954} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424665945" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009f3d6897a1bc2d4ea4c913d363dc1a1b00000000020000000000106600000001000020000000966ed508e7b490b4f9b4638ab6db33431520e6adf04d8b55598e160050318083000000000e80000000020000200000001a1ae23077ac0863f5daa0c0285c9c3b923a5d8195833f78408fecee1dec1a09900000007b6edfc33cbde9e66dc863165ce07c50537fcd8da81cdc36edc1a8ec785f4128353cca4f12d6a855ac25d94584455454175260bd0ea655e4cb84b72c4eac707d0b33631a81b806fab5c73b0cc08783b6760b68bb705f471ae10af25273c384a251f559cc2659cfeeaee6a2d5040d7a13bcdce2a19441c5500f7c4eb7e808cc2d2956b70db9d74814a4d7cafb1fe8f0e140000000a60416809466c34b0d70cf3cffd26904d4f6e1c164b754fbca98cf36d60c70b3c2c883e6bc79f9afc185db0b5a290df0034d5c32802301b116d219a86aca2369 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1040 wrote to memory of 2944 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1040 wrote to memory of 2944 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1040 wrote to memory of 2944 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1040 wrote to memory of 2944 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b14811b2b6c5648a6a3566069907a29d_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 kit-free.fontawesome.com udp
US 8.8.8.8:53 secure.aadcdn.microsoftonline-p.com udp
US 8.8.8.8:53 kit.fontawesome.com udp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 13.107.246.64:443 secure.aadcdn.microsoftonline-p.com tcp
GB 142.250.187.234:443 ajax.googleapis.com tcp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 13.107.246.64:443 secure.aadcdn.microsoftonline-p.com tcp
US 104.18.11.207:443 maxcdn.bootstrapcdn.com tcp
GB 142.250.187.234:443 ajax.googleapis.com tcp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 104.18.11.207:443 maxcdn.bootstrapcdn.com tcp
US 104.21.51.18:443 kit-free.fontawesome.com tcp
US 104.21.51.18:443 kit-free.fontawesome.com tcp
GB 142.250.187.234:80 ajax.googleapis.com tcp
US 104.18.40.68:443 kit.fontawesome.com tcp
US 104.18.40.68:443 kit.fontawesome.com tcp
US 151.101.194.137:443 code.jquery.com tcp
US 151.101.194.137:443 code.jquery.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 apps.identrust.com udp
BE 23.14.90.73:80 apps.identrust.com tcp
BE 23.14.90.73:80 apps.identrust.com tcp
BE 23.14.90.73:80 apps.identrust.com tcp
BE 23.14.90.91:80 apps.identrust.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
US 8.8.8.8:53 x2.c.lencr.org udp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 104.90.25.32:80 x2.c.lencr.org tcp
BE 104.90.25.32:80 x2.c.lencr.org tcp
BE 104.90.25.32:80 x2.c.lencr.org tcp
BE 104.90.25.32:80 x2.c.lencr.org tcp
US 13.107.246.64:443 secure.aadcdn.microsoftonline-p.com tcp
US 104.18.40.68:443 kit.fontawesome.com tcp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab23B8.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar23BD.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 79d25067f400175991bf013a7f8ff14b
SHA1 7626b384d9be4f2c808a44b87045f2e2a4430083
SHA256 e031429926c26d567e55b402186ec7f68f7ff9d5f2804d689f35838d16c7fa91
SHA512 e8e825e750e349ec2156f682078a8c0f74c40c7652d2e4c5a17b12846f4d2d1c647c044b28e682387c5a191bb9255a6441872328caf056fd422b3eed11517695

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA512 1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 686513adddb8d0ec2f3eb27597f1c6b1
SHA1 70790a3d3843fb7d2ad5c1a9b6c8c712fd19c331
SHA256 f2155ea5178be453858f9dfc65c59573af68dca5512fca87b93a15a4d26c8a68
SHA512 40c8c622e690ceca84ba343b6f282db87e90684af054975241d69bfd54bd2063ba2f457f2e555f9d9f25776011c8f6200c67a3ea550ee5059d5c8442f2547bfd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f6769707aa6cd31803f855cad91ce1b3
SHA1 c11fd3b79038e1302d54673d21000ffd9dcd0df0
SHA256 721d2dd9f206e469f56d641c111304fedc76a69028b39d07ebddde84a4edc944
SHA512 ca9e6e45c66bfdf200fdb714408ec625d60e21786ce0d821dc2f09ea8ee82d60b1b06dbc3c8752fcfe53205a15fbac73f6690f1110b983a37d9607a827505d95

C:\Users\Admin\AppData\Local\Temp\Tar24DF.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 bba487e4f9fd7401f1ed6e2743981319
SHA1 f96a1f189ac1b0e6b0a0c1087940a941dec55cca
SHA256 1d1b0338d221ceb1859dfd183169255ca0bdce89ab838783f1415c62fc47c54d
SHA512 21dedc430738c5699d59ef98e014f81ff20a1d651280120f17264df68385b75745442959334700554e21030c8df812c800da2341fcaf9cafab60c3e8d92dcf0d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b1a247e07e242409388cd291caf466c
SHA1 5115edbbb16365cd48e183309bc39b7785253293
SHA256 de471b7e6e2b4f390324b42bd80cd081949010c913ff9e91d2dc6dafacccd99c
SHA512 a052481a3f5e01eff9729dddd27878113b8b888f9bc23a47efbdb0d7077af1ba0e8378775854411ce68b4486ea56e1bb3f48110d933609688b235536593bac7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

MD5 c5dfb849ca051355ee2dba1ac33eb028
SHA1 d69b561148f01c77c54578c10926df5b856976ad
SHA256 cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA512 88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e43fc4b84f6c78b0b3198618342b404
SHA1 d125fe79eb38e53bddc38ffc742a3aa8ef1b5a08
SHA256 eba5d1e242c1467488f4e821edc7c8766f6d359e22e1dffd14188f6f774e4aeb
SHA512 7a688c0acf9159a15c627b221f7efee7183b030d2b567accc318e8b361e576ec50d88836f5ad99ef15683ac270729e6fa6f3daabdd04d8ccb54b9ae4c7910104

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4fcd7d9628fb5fdf349aac32908e2a3e
SHA1 fc3602f20a50d8339767912e9452929854d02d08
SHA256 63a6392aebba0b6dc7368015bed2aa1fccc889cd7cdfe810625fb276c9729648
SHA512 605d1cda8a334ccb2cd3657d9c56bac171625902979cc8a342c1d178bb6a7501fc965f840b113841608c93f37aee2519ffc5c9ad39eeb43a6f31e69c52b347d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fb813cf9cf79aa124e513979c4e47e80
SHA1 24d52e1bcfad8d8f151863ee7e9c81512e5eb884
SHA256 f752ab11d8a1b86d91d76a523dedfae0ce1fe3f2f01a9051024cb3164fbc9ed2
SHA512 3358369528758e79985d84cbe877ef0e701f88e6947454a3a12c008952d9b90217a801015c7aa8915ed2f685c7a89f40ada51038a944571ec6166a7e66aa5b57

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_0E84AD23AC2E74B30DEF739614C7EB94

MD5 d2831ff4f05b3f009029720e198b0b0b
SHA1 09e7c3a80e56538919db5febe71b4423f8d5a707
SHA256 6f8c5be807641fdc95b536da15c55b2b9f87eddfc34a7b3a506c8ed2269bcbe9
SHA512 0f37d844cdda802f5609aa3a681648069999ddd14e3ccef3367232f2402450018468a1c1ed14ec784c548695876a23114c4d7733f7433cdaf751d001f799eab3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a340fa2e7bd9e4eb324534e4eb49b64
SHA1 bc0412fc64595e714d3deabcedd744f98e8052cb
SHA256 278a1cd09482da0b7a36e2c4149f9ce4101e9698f43e3a1082ef018357eb905f
SHA512 5379163d056e146cbfe456892e8727e70a86207f053d5ef77f9e0f4a8628966a2ffd5497300914f46299df233926b5f293e860d9894844193cfafbd4d099d750

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 e25a07cf9a11b19d8ea664485df3c570
SHA1 3d7a275796c587515fdfc50e78d2a88cb5e314ed
SHA256 84ae63fe90e0a4aa40ff4cb9e77d809b9211da79775c2a25df7df2d0983b2c27
SHA512 714be58b7dcdc328321585411f92962cd0170d54e591e0104fa5e65389a8a062d7f59b16023d4968f1fa44c2118bb985e76452f3a99549014f61fa975d0db413

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3dc2b6b27b3b0848b363834c92f0d6b8
SHA1 7740cdf3b9423bbb29a48ef78428d3459fafe0fb
SHA256 d28cc1fe944abc4b4f9557c3ea6b43e4e5bfdcec1ee2af8efd2e92e6cae12638
SHA512 9d8b037a7461d6edd7864b9eb979672d4ebde03e05b2723848eb4d3196d8ab82c0a098ad3ff81e5c63ee263ce3358faa730788494a1c5569422969c2149e69b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

MD5 4d6772fe3141cfed2cfa213bd4c53562
SHA1 b76e5c54828d399741313dc2f51493b5084e4059
SHA256 e87a75bc2d745c0dd8b0d0edf0544f5102df0703d3d28ee04ae86abb422e0bb1
SHA512 7c76af75dddae666c34843e85c8a7eebbf5e0bedc35b0ee935b9818ce1a38239140fe1b1ea5fde8fe11cc42fe2fbeb4fb666743c56a1e4b582a9ffdca428cf9a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61

MD5 8054d83fb00b56253f0a1fa8a3a9100e
SHA1 2fbb9704d0f2e4a374b0c82643ded300b65bad1a
SHA256 070338f234e968f15732cab5e505a505355facfd16cdbc00ec15dc453628fa5e
SHA512 c8096ade68b0fad7689f20c2b27cf87886ad1ff140213d1979ac96d68f4f73c4981d9608d66871943dadbd79a227437948cb36524305dc2452d41e729325cc51

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 135b688c47c7cb93663243ee9e80ba03
SHA1 5920b828c3d748610389da4c205af115cb61f143
SHA256 f047e06328b5064b5d2e0a9c8d8bd28e6061448172e3a011ce3b35bddbf16805
SHA512 cb5c1ceaecd02dbf7d5238dbda8cd3f2a4bcf4cea6f4de47b1b2c36517e8da49a31156378f92fbcee40add728fcf6a3589feeb3a9bbaa87ae05ae5669cafce88

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 90693fd95fe91b55fbd7bc8423fe2e49
SHA1 0c931fe9e3260434ce0d989ef6268e9bb0e70aba
SHA256 9e6ca9658b950bd8eca554c0ce676b31e298d6ea639891e26d7c33928ca7c497
SHA512 fdd52bee3f4bc771be8f92687575376ad4da1a77500e72e8f83fb1415eae5075f81c6ca7358479e0dd5b1578a7f8db05f90c4324f26a27342f1a15690cdcc917

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a8fff00b53b86311d05435844519cee
SHA1 a8e1c06a463b47545caf7571b011e35e2b6c95f3
SHA256 043b52b42de99fd7ae8d8b649d3ed0b30981b3a184f5abc79cbc02589dd22207
SHA512 d7d5a64370845566e27523adf5d2f8afae6e4c0b5db8791317fdab6c7a701ee1f72af548a71b3be95a778663a0c219202c5086beb375dafb0e90e3a9018d3a84

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d038f4de928af5a0e5c025b63b12587
SHA1 c6a6680e371c06c72d4c190d8489aefe7b6ec040
SHA256 a80740adbda20ff5d04968aae3b67c98758f4d92d9b30d0c544e7123987b0714
SHA512 ef87cd112acd6e29ea1346ebd56275db07bda9eb1f8d0ff0713298deacebc74f1e4a984e557d1fc593001a01a664e8e8a733fd877b6f93bac359805110476b91

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 13f33269525d23b3e3537c60719515b8
SHA1 2901184c7416d934933acdbf438d6e81e9dcbfe0
SHA256 eda1ce03d688e439b03f575b780b31b5df6fb552d22be70ef127bbf05c6fd492
SHA512 b92afdfb3dfc97fb397910e206a977c6453721d1f3c9b3d620388c2aad275a7bea76d7128b2124dedaee93293dfc338623186727953ac48f380db1b729e5556c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3a5bceb7ed4248507343614170038106
SHA1 3ea090b9fabdf788ff6f92fb451b8556b3bc6656
SHA256 315d657e5a42487ed6add053f4515f5ebce3426d4d5877c582ff9babb55b9ea5
SHA512 7f4372a8443ebda1b87cd8ba8525f1ebfdaa273549da9b4e9f762557f46696b4536157b3bc89d87b1cd62053d2fef16e86a510c163e063a54d038f98f013d04d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cda77f032568ada868401e5aa2509e02
SHA1 bb3653865bded755d8f9bed602df0474c7cec751
SHA256 1aaa27eb35d797c6ccabac15ea90748313cb977efb2832e087f34781ecad25c5
SHA512 c9f465d63c0f0a17d8aa87c0c98094fdcd93d26d4570f7317ca4b92bbf9b22341efe532529854fe937401bfdbc1114d5d304544f5be57f0ade5540ad4d34b83d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8e65bb4884eaa86922e85a54c2b26abb
SHA1 7f9396fec84ca68da0ca28abfa0c98d50542fa90
SHA256 e269cffa0cc8d6c0b906559ab6cfbaa8ff0e134b357a7e1e291c4a86cd8207e5
SHA512 49a0f2d3d6e3e0235d1d8ff3e7dc5e88769c132c63cfd4879286c98894e56a8c0be93b1c8475be2cbcf9da79ababcfd92cce6ebb5581b48ed73a97e616884fd3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b240cb5405bb26afb8bb72935875d50
SHA1 a7593b5aaa7c3055531a61978454ef654e2499bb
SHA256 237af247360cccde6c9097202a082951e432fd1ab5a539b39fae8e6b7e7d6223
SHA512 64be5a4d3daa425cc0097dc27133a00ac553e5b5d14e87188382eea304832c07065e933e82da1289bcb14d591a2800844c14b20434c2769c8909a50e34ad154b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1839fff30bbb83043b15044c82151540
SHA1 60e4062925dcd57a7d97b694267cb25eba11b776
SHA256 08177b1ac4e48fd248fa5c6c85cebeae17ea4e961e30ba9bed5183994211a82e
SHA512 2921e2c12b04b6ec93cf72f9e100bfaeda7abf117a21cf881bc6f28190ba1370b061a3e2e17fa23d0975c86c01111cab22b47e98fd80202aeb47c45b723f0ef4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bbab335b36e73626701d1fe49bad3e9a
SHA1 ea1af98e0935bbedf70a7c4b864242a37e254d1b
SHA256 12cb8e8e763814784ce370533f3e2da0b04c5203793cc83a242a084989d3ec08
SHA512 daacc3fdce812deb197beae6e65726274741002f8d145587b6e4bb5244215165fbcc6aa4cfd8f166397f3b52890f6369acbf6be5b9ce4509ead29aef09bf6fd1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a32f5f3592f605434ae30386b6eb337
SHA1 21859153b2b35aa2a28331b96b6b7a9575b2cfea
SHA256 f4cccb90f854b6d58c6380f0f46f95d773db1b375a54ce75ed4e113975a052fd
SHA512 b22bcf6d9f785833bb370238c04dc3a004c31f9f00e5ec88bb3ddf0d8db3d5de68fa7c8cb78d6692cca187bd9266f2880dea2232f96cc21dbe3bba0ac120aab2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9620f0e5338e4b514ae7c4b367ba2610
SHA1 0727a5eb62d593f4345fb8a78255a4aad279bdc7
SHA256 2034dd7b277b83c7a52d596d5b58808df23cdea89e563013d79fb962e1a6525b
SHA512 f37df0af1eb248a93e9ff866976feddbb48243ffd28f5b563e7e1f0adc8818032f10387301ffd0b17c09cdbdeebe4398dacc60bfcc5c2c77979501c527097aa4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 086a83606372a1cd2ceabfdec6e1d10b
SHA1 e4f952abfa3c151b744d5e9f7800eae46e65a300
SHA256 963033022ec4bb42cb902d7a13c912ae01d183448bd3649406a215c4fece0ba3
SHA512 0c57bf5d19eb2727f9bd70f64078c02a59e4cb14061064c4083476d90a547b244bd61e02b8af6060351e3b8ac5e71ab4d1f7ff37060c3820baa95f9ef30a5717

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ae9125e65b025e630b2b3a18130e2fac
SHA1 216dd74b1b763b26d3f70bd2ff444bcb510d12ef
SHA256 494c97189eec27c7e9443cbe23efd85a28cbae0c517bf527d97e12e995ee8011
SHA512 a52cda07507099e39f1cc6dbc34898d1f29d9fc987594e494e7bc41e1c5b765ada80663e854da00b6a3b31fffd7f1d2e1522ad9865e7e6b2da5bba3eeb579768

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 100c102575c4ccbf136835763c85847f
SHA1 4e612127419adcab6012e69a9300e864f70e0b36
SHA256 a43a7e629bce830845fc0f408b89e6bde29f230f205bdcab1954ded6cc4d8f59
SHA512 083454dc1e099e10cac4b36ed2278f7822f191c9250df8f7ebfbdc5c73f200f310afcc1da97b05f2f62bdfe2b75bc2cb60fa8890c4c16d685754e411a93a3e09

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4df2b294d42e7273b261853af68a3603
SHA1 c898ea2538d69ebeb13a6446a25125c5db5f481e
SHA256 831d9c0277fb38a6215461b98e1dfe9fb22052cd6f10b348142fb69446d1741c
SHA512 e2c2efd151a27bef960376803c250d9fb5049dace85b526e410666f4a98f11654a2fd511f1a1624c0be9b2e2fade0a4c567235d5c3aabe75100be19ba1989b10

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 90d71a08eff24a089e95f4a35bc7af9d
SHA1 b626b4004d8ce6fd3851992661cc03e0fb10203b
SHA256 2018955b29511078d7ef5cabe161fe6ba4861912d2c708e019f7a2074c1eb8cf
SHA512 238348b90c0c3d23f7904df285d842d569bcee301248c3aa00204ab5d0330a011f92f7c6c347c7af604abbe0d31a0b8338b977533d8b3a5eeba04a4af44c5cf7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6de2c6984ca04b29a0ae309d652f0677
SHA1 73ea6b0542419d770116ce4d6b5895c880159570
SHA256 57eb49a3a5d3f42775b277ae8a98ad1c81be895c7fbde18f700306356f75b08c
SHA512 b2e8a597d78656e88884bcfafb662d4e7d0bbc5d79a54638e82a77cf1b9956d6e92f27728cb634e6717cd9a5acd02760107ec96333bd559669a99009cfde9d82

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3001ff44510383d218466273da3eeb6f
SHA1 175dd5b2a314189db55fa665adca534ebd347801
SHA256 5a4a000230c42fde2d7f467f84e24f24c7789cb5e135df10cd2101f32601fc19
SHA512 1e705e83f82e48778fc3c58a4d63132216c7a1aa1b857bc09fb1250c060e123e736694d0abdaebf1fc45f615db6d99738a6c08a8bf896ee5295eb560669ddea2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec9110cef13d85bb729b7e7cb620edab
SHA1 1489bc4e6c64998ca448851af745fb15d8854a4e
SHA256 45bf326845258016c5207637d1ca0af403dcf272d5c23b088e9125c6caf47e34
SHA512 a1ae1346302e450366e88fc17d9402f6c5ec3de85643fcae254e7048a83216ccea3cdc175b2f57c9a242d478a627b1685b11591ed5e35e2c7106aa7996931b7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fee3c6fdb85d7da33230a666cff4cc32
SHA1 3e1f338a37abb9eca6157d56d35da7a42e1d08f5
SHA256 1c2ce56299a364c89e43f0c48e5ecb809d2b6f66e62a7810850badfa9f82dc75
SHA512 433e773e152e39b39116f46f0cb6672d974255d6c701d1d9823534e8e5be06842a94f3a241a5ef9be8ebd225e8907ca7e0fc8abd740d8b6cfa00156050277a2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c376ba4a712b805b1c635596312eb5c
SHA1 da13480508e77efcbd000a9404d0927334046996
SHA256 ccb47d91ba89ef3d1718c813622f04a05e96186ba6ed2cae72d6cfdb50e52647
SHA512 53df7c88768cfe5a4fce0b1a19294724a096ae046a2ad55176f3f58545a60ed4bf563ac1797998b622ee7c33f6234772f967d3d0ec3ce993dea5e25a32a406c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ebca4a00ac3c3581696a0b8af0032934
SHA1 2c3fe8cbca8997abf7ab219552df256e1639c19a
SHA256 3c22ba66270f48761eb1abebdfe2e010e3ac26ebb5064e16b4509f83f16f07b2
SHA512 53c2ec989a24280be38827bf22a04fee180b436fdec8ccd9542eb69f1fbed82a565f0ae4004819b82ab59f14d0223733f7301513501ff1f130a7d7fa8d896ae9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 95fa0ce17a9f49f8e14f5e3dd7d65144
SHA1 38d288772df3f36d25d74d37c34a40d61ca8714b
SHA256 60d4781a288bcfd94d30752ff6ce533f30ffd4f8cc8c1dcd0ec7683d3e497baf
SHA512 3647f933362ce69633a6a0ed4cbdc9e4c33cba3248c20a67cb4fa91efc2e0a5f02ea27269e7930cbf859f2d3a8ea12eb94385caac7ef5c6568719bf6dd460bba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5aaa79b032fe19fe60d8633d6cca2d97
SHA1 bdac9dae76052450e48a5a5dd9a96e405f109fa3
SHA256 466b8c4a7f07d7582eb5ee8d80d5a813fd6f4172e79f07e06425249475129321
SHA512 3777de3a9799778e25f73bd323d628cf8227cfdd9fb55a7c2995900a7654dfd11fafa804f15067d38903bb760a7294b298eb5bb5350b563caf1e510c137f0daa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 d67c46a856b31e7af387c8212ea42f4d
SHA1 8cf96aee6eb47088037f881a8d81311aebbac94a
SHA256 e0ca992fcf3b8663945ee8591ca0353861a3fffd7233db7eb5d2ba10176504ff
SHA512 7426283754fd034eb41b16384843eda3e7a2b81044f6fb4522556ecccae5d63d522ac40bbb269840e71ab60ac586ab4c416b4bcdbb4ecc74398938930cfde1d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bb579317393519095e0d8445f96bbc64
SHA1 2552f5a9f069300be1c9571934859971700e7a2b
SHA256 dce08e0f7d0bce4261f1cc5aaaac6f2b24e4b2c2c4483c2923aa1760656b1da8
SHA512 88f6791bfe783b0a3a195f8206cb8dd5114c72b1bda4537aa2f7e0ff525cce316f8d8ed74fad1028621129bd4a7e5584a1122564b944047bbf5e70b52bbfde17

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6616f332a350cb933e238525a656045
SHA1 d74116d431ee23dac9b3b76fa024e4fed85bb44f
SHA256 77ad534b85a472176bcde6c4245076a80a495965d81282e0633afbb4cbb734f3
SHA512 375cd728d33c1f7725b02820885b50037a7cbfbca08b52365bebf219f789839de220b26e4cc9a35254fef6758ba17404bc7b9587d87d863785acc20775a4337e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3a2a2353dec8af1be2026559cfa698e
SHA1 ec6d270ba5fed5b7f7d7c8f43f180a906eebd17f
SHA256 e5ad30bbffadfce9315ba94dcc91d9e063126fdbea71e7bc5096daa128702280
SHA512 81a58f64e2e5f08c89cf1cff82717545cf48bde56eb6526ea8d59a89110e860e1ba9d1a2d10bc90ed809c0ccad63d8346db7f76aee92c8f3a9adeb99e9e97e3b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d06468a7c5bda2232c5f5e826a2924a
SHA1 86b9857e96c898490fd830c922c6cdcf6249f499
SHA256 7be1880e710cef6079bc206974dfe66a48178d2a159a31b2b9ff9476c2b7694d
SHA512 f4ce8e4d4485c248c2d75c34b69458a244b7195547df1bbdce353f4dc38bf2fab68ead412bfeeda65c1910737e7b1e62c1d92948a88b54c714c1c8d16c468e67

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 8ba1abf18419bb47644002b03f48dfd9
SHA1 2634d0668cb6f48ea950cccaefdef47e0153293f
SHA256 d5d24dfaab832551508c2b152488073c46189aa8ee14fe25a9eb614b5a9a3ff5
SHA512 4cf35060149ad377ef87ae5a13cc4e11966d32e1440e265258c055422540568e0b12cd37e0bc8e3676566b594024ef0cb6a6aacd6cf9032cf1af68cd8dbe9060

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 22d00fb036c713086171d8fdb6a569a4
SHA1 7185f2cfb22279fb485b4f29e63015fbf82d49bd
SHA256 33ae150176fa94352b622886fe7f417b6366e7399ab628dcfe55f7f7613efbbc
SHA512 e5085e8afb2c227219b4cde5ed98b9bf8eb4802d63078ef8d4e991f36568f71229d332116f5f4a5bfad6010dfa53787ab474c2d13e77fceb11e7ded7f4595255

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92877d238c9b471d621e493a85c12429
SHA1 58f62eff902e0d9710b6804033463d6f193e979f
SHA256 fc4b36de00324215bca97d01207cc91760623f5858acd885e601e9f56fa0f14a
SHA512 cd2d0121bdfdef2d8a98da0f5c2a877c54b2079261300bd358502c874e1eab689b600a2f287b7c3680fb1036d3818f8606f41c76e73bc019d8ea9c3e2465e8e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6d13e57b6b76e52bba24a1dde5cb3c97
SHA1 e8d23c7ab9edfda66ccec921a41b14bfd176d315
SHA256 39eafba934b32d2fb3d3efed8ff3ce1d5dbb257b6ef432a8238b3c194078388c
SHA512 1c49fb089bc30e73b88f1469d9dbb9ad45644a2b3af339c99142c29a5e2d946769062432d48ed3c8fafeea0de18d391c2b0c3f2d21bd353089b256d5a51286d2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96a40095a37fe6d44874cb58f18897ee
SHA1 cc908f6cc4bffc90babb5c751b5bba14178b8745
SHA256 c886edb84d8da6de35d5c52ce24ed9a2812d3f30d4ee905927342f6a90d11cbb
SHA512 82c94e004d4e00ea14138ac572941e824ffebd9e9b2c7e344296131916b22d630b93fbdee297da96b5ccd080b82d1f90b474d475d2cd91049814c44402029da9

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 02:14

Reported

2024-06-16 02:17

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b14811b2b6c5648a6a3566069907a29d_JaffaCakes118.html

Signatures

Detected potential entity reuse from brand microsoft.

phishing microsoft

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 4632 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 4632 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 3812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5064 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 5064 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2904 wrote to memory of 1432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b14811b2b6c5648a6a3566069907a29d_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfd7a46f8,0x7ffbfd7a4708,0x7ffbfd7a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 8.8.8.8:53 kit.fontawesome.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 kit-free.fontawesome.com udp
US 104.18.11.207:443 maxcdn.bootstrapcdn.com tcp
US 172.64.147.188:443 kit.fontawesome.com tcp
US 151.101.130.137:443 code.jquery.com tcp
US 104.21.51.18:443 kit-free.fontawesome.com tcp
US 104.21.51.18:443 kit-free.fontawesome.com tcp
GB 216.58.204.74:443 ajax.googleapis.com tcp
GB 216.58.204.74:80 ajax.googleapis.com tcp
US 8.8.8.8:53 apps.identrust.com udp
BE 23.14.90.73:80 apps.identrust.com tcp
US 8.8.8.8:53 ka-f.fontawesome.com udp
US 104.21.26.223:443 ka-f.fontawesome.com tcp
US 104.21.26.223:443 ka-f.fontawesome.com tcp
US 151.101.130.137:443 code.jquery.com tcp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
GB 216.58.204.74:443 ajax.googleapis.com udp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 secure.aadcdn.microsoftonline-p.com udp
US 13.107.246.64:443 secure.aadcdn.microsoftonline-p.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 207.11.18.104.in-addr.arpa udp
US 8.8.8.8:53 188.147.64.172.in-addr.arpa udp
US 8.8.8.8:53 137.130.101.151.in-addr.arpa udp
US 8.8.8.8:53 18.51.21.104.in-addr.arpa udp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 73.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 223.26.21.104.in-addr.arpa udp
US 8.8.8.8:53 14.24.17.104.in-addr.arpa udp
US 8.8.8.8:53 229.65.101.151.in-addr.arpa udp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BE 23.41.178.65:443 www.bing.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 65.178.41.23.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cb0deac1c23ac3fdefc6224edcfc14de
SHA1 602fc88456924a8ff922ab9a1f29bf74cab4e05c
SHA256 1696d99bfce7911374977c0713ed9a37c0a1f361f208bea7e65def22cd4981d4
SHA512 c7754aafbc1b85602251773afad8f154971678f6c8208ef2edc8145d75aa5b717f295bd5f8aec1a2845a34308e426a6063c4f4cf4f70c0b860cf4ffa7c8502e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e6e99437adc5d8a5c523df246638a8e2
SHA1 4a877bb4117c14fcf5190f6c5fae18d204a2d526
SHA256 7b02a5681a9645e1c8def9665c0c98ed121641a368df2b28294eba2e360b8312
SHA512 354115283dc8128ff6be0dc91f4c2a1621d923ed23c029cbac726df75a462e637851680c85a7f1917cbc90f2717c5e636ea414ebf40ae3937569bb61c376fd5d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 10977da1fdbe8c4dd9da52f0a1273254
SHA1 8cff12ea5b1c9a2bf5c1a3598897ca5d31add9eb
SHA256 e0a1266c2687ea71c30a034abf93ff38ae1e2cef3ecb7aa6948123fb4b9d257c
SHA512 08efac60e4cb2097e9821d8807c800c54876aad3d8dff16f8ba5b75c2e2efa132b762de04520194575b3a23d4d1c55be834d37bd421e393d56de9a1da068bfce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 6cbfad4ca6cd79471fd8e293759ddab7
SHA1 efe78b9fd1fe4529ad27663149ee348d2f819782
SHA256 c9aa10a6527c2fc22c163eb546780a364fed7520807a4ad3c7b2b1e6f57b69e9
SHA512 f4bd1f1115477f24be596c755d091aaaa1da6a8be16f60842a450ffb172b8a57251a71ecad1687bfce4837c06585bf16e2dd370b5b25757fa940ba33445ee9a4