Analysis Overview
SHA256
8893d985babd570b56f9a0cf0311b3120de4f6fd381ba18ff6bdc610fe36fcda
Threat Level: No (potentially) malicious behavior was detected
The file 7ffc3975b3e3977062e82a4687342565_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-29 07:45
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-29 07:45
Reported
2024-05-29 07:48
Platform
win10v2004-20240508-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7ffc3975b3e3977062e82a4687342565_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa80746f8,0x7fffa8074708,0x7fffa8074718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,1553074211294008855,8887264184714970431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4624 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | cdn.popcash.net | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| FR | 172.217.20.202:80 | ajax.googleapis.com | tcp |
| FR | 172.217.20.202:80 | ajax.googleapis.com | tcp |
| GB | 143.244.38.136:80 | cdn.popcash.net | tcp |
| FR | 142.250.179.73:443 | www.blogger.com | tcp |
| FR | 142.250.178.142:80 | apis.google.com | tcp |
| FR | 172.217.20.202:443 | ajax.googleapis.com | tcp |
| FR | 216.58.214.67:80 | fonts.gstatic.com | tcp |
| FR | 142.250.178.142:443 | apis.google.com | tcp |
| FR | 142.250.179.73:443 | www.blogger.com | udp |
| FR | 142.250.178.142:443 | apis.google.com | udp |
| US | 8.8.8.8:53 | dcba.popcash.net | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | s09.flagcounter.com | udp |
| US | 8.8.8.8:53 | www.wieistmeineip.de | udp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| US | 54.89.53.59:443 | dcba.popcash.net | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| US | 206.221.176.133:80 | s09.flagcounter.com | tcp |
| DE | 54.93.84.153:80 | www.wieistmeineip.de | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:443 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 142.250.179.73:443 | resources.blogblog.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:443 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:443 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:443 | 2.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 2.bp.blogspot.com | tcp |
| FR | 216.58.214.67:80 | fonts.gstatic.com | tcp |
| FR | 216.58.214.67:80 | fonts.gstatic.com | tcp |
| US | 8.8.8.8:53 | developers.google.com | udp |
| US | 8.8.8.8:53 | in-creations.blogspot.ca | udp |
| FR | 216.58.214.78:80 | developers.google.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.38.244.143.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.214.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 153.84.93.54.in-addr.arpa | udp |
| FR | 142.250.178.129:80 | in-creations.blogspot.ca | tcp |
| DE | 54.93.84.153:443 | www.wieistmeineip.de | tcp |
| US | 8.8.8.8:53 | 193.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| FR | 216.58.214.78:443 | developers.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | ssl.gstatic.com | udp |
| FR | 142.250.75.227:443 | ssl.gstatic.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | blogger.googleusercontent.com | udp |
| FR | 142.250.178.129:443 | blogger.googleusercontent.com | tcp |
| FR | 142.250.179.73:80 | resources.blogblog.com | tcp |
| US | 8.8.8.8:53 | 59.53.89.54.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.176.221.206.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.201.222.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.214.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 129.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.27.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.75.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| FR | 172.217.20.193:443 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | lh3-testonly.googleusercontent.com | udp |
| FR | 172.217.20.193:443 | 2.bp.blogspot.com | udp |
| FR | 142.250.178.129:443 | lh3-testonly.googleusercontent.com | udp |
| FR | 142.250.178.129:443 | lh3-testonly.googleusercontent.com | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | in-creations.blogspot.com | udp |
| FR | 142.250.178.129:80 | in-creations.blogspot.com | tcp |
| NL | 23.62.61.192:443 | www.bing.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| NL | 142.250.27.84:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 52.111.229.43:443 | tcp | |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| NL | 142.250.27.84:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | 105.193.132.51.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 439b5e04ca18c7fb02cf406e6eb24167 |
| SHA1 | e0c5bb6216903934726e3570b7d63295b9d28987 |
| SHA256 | 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654 |
| SHA512 | d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2 |
\??\pipe\LOCAL\crashpad_3576_TJUGSBPENTWCAXGL
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | a8e767fd33edd97d306efb6905f93252 |
| SHA1 | a6f80ace2b57599f64b0ae3c7381f34e9456f9d3 |
| SHA256 | c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb |
| SHA512 | 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 076fe33b30a76fb0387ba4106b59791f |
| SHA1 | 80b7bd1391398d9b4f1bf31b585831a389721ada |
| SHA256 | e7f68c49243525d0e0f9794ebb79dfc840358c138d38db1fa5465cb05d105798 |
| SHA512 | 5dcdbdbd5238f590bee1e5141044628815020d6a8ac5f4d21a0181c70dc51e7723dacea0ccd8346d667acedba7dc4710fab03840c6f54b4a57d2778d7ea1a163 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
| MD5 | b6c8122025aff891940d1d5e1ab95fce |
| SHA1 | a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4 |
| SHA256 | 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e |
| SHA512 | e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | be012761c4e0f4692969c8541e85d1b0 |
| SHA1 | 44d658c7b64c1d9c9bc949a7f17df9643c96f9b7 |
| SHA256 | 46be66f15702be2c62e5c34e2911839926db50f06e14d62cafc1ecf36859fd06 |
| SHA512 | 9bf6a46bb2b7ace6baf85a1c8a219745787797e2ee67ffd1584d94353ecd9dbef9b72731b5f673f6f1f8e5cc3812cb890f18557ec896ba5a322a43b2686944e1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 437492f4e5bc0c238de7f276a6613f1d |
| SHA1 | 6598d1224e55a619a74bb7163cf54c859d67f380 |
| SHA256 | cb40ecf250ecc7d19dbb519352da4dd5e0919890096054cbd9033247fd4c0b74 |
| SHA512 | 1418212992d54da142ee9599dd6020467ae14faea5bab702305057ec34752fca7ff8d6d6ace5caa01a4c800c5201ceaa8d8d437e76e7945a255cd7c230ef9e29 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 077e399934a611e911c32edd27ca1537 |
| SHA1 | f88898e5ef141a4539c64388b01f62b2a151f4d7 |
| SHA256 | b57d756fa36ff89b8adbd73ea9cd62cbd61f506e2e6512a4b29f72d664e7a222 |
| SHA512 | a51c86703cd96d0d96d2cc732262cabfef175baa26b95008f972b611684517167ed9b302b41e053acd27e7a010a4f8285cec9de3036dfb3d092a920fdfbc6ed5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
| MD5 | 5e74c6d871232d6fe5d88711ece1408b |
| SHA1 | 1a5d3ac31e833df4c091f14c94a2ecd1c6294875 |
| SHA256 | bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105 |
| SHA512 | 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 1355085529417d6eadff92fa8d423381 |
| SHA1 | c34679bda47d542750930394c3efafb77ac6e08e |
| SHA256 | 90fcc851dea857d00650bbb7591d91bc48c9e3d110f50973a298fd902c619725 |
| SHA512 | 1af3d3bc747a81dec5f0cf16c5cda591dc089d2f75de50a36f7ef2c45ce47630a6f8fbdca86baa565d55e83593242baf7ce8693233f1ec0a88a6698e36ada30c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 7bb1c664c1e0e1ad9cb7b47ac658bb03 |
| SHA1 | 51c9fbf35c673b7f37bef8e3980a666381efe2ba |
| SHA256 | f2ac2a3e56c5c4b667924626f08de9499704136f95765acd9619fe01413ce436 |
| SHA512 | 64ced5b621b06b733475465380409d5bc5a982f72e799f5f0265d245bc64fab972110cc4409b28eaefc9fb702c4f0cd80431e43eb9e6c335d5d85561c4e49149 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 06de37848639037480fb142af19013f9 |
| SHA1 | 9a4a51f85f4b350043366252ae804bb79689f7cc |
| SHA256 | 844dc9b38eacdffd39d2b57a588997b0bb82af331ad1fa191cfcfa7e50c44f36 |
| SHA512 | 4630d4524b8a7cd0d30026d1eeeff15748a2c73f75389c57a797a3b1a7038962ffe0ea92e0b8c2b768663d345a90722ce1304111de8b79180ebad60fa4f25ef8 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-29 07:45
Reported
2024-05-29 07:48
Platform
win7-20240508-en
Max time kernel
142s
Max time network
143s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000009931d973fefaf94fe9e765c6843d10786ee65955c6e7e9b43cd43f288a5ede18000000000e80000000020000200000009fcc1add2d32f78dfddd54f32ff532e9d722319fbb778e2d5e2c3288062898b4900000001d818e850f6befe4f098cd8a87a6f964f6eb7c3de698c19ebaa9c01df193eadb8409e13846c53fc812cf4d8aefa9946aba4d1fd7dfa1c84c2cf90b9ba199b9f76d249d894ded09ba9e16d86b326915ba326a33278b8b6fb6e7ec6f719a849d3af40454434c864712a3511adca24c0df6458a748d3013630582a9b6e28c4cd93a30a845c71e66703982133dd32a82b30440000000bf2706ebb4a0aba28a1312fbbf80426cf82b51f2f81e6d57991d7afe2a70a854a64f2dd33f03030f37d629c928af1af5c46c9e8ffadd27e07ad1d8469f9d619b | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000eb01f7d6a8c4e78c29b03d8bd6aacd3a18651fa0a0c758e5555477654e5319e6000000000e8000000002000020000000629a1d483afdd5c50235497f4fc889366f831e07007aedfa7e3b0ae28ff7f50c200000003a4801a4a32230a84c2431ae046fee106259dd5600daea52f88ab82377f3968f400000006eae865bcbf4e256392269bb9c7fd7f645472a3a2d5b5748d166f66e68fae80d45beb94a177a546b3b1ab14386bba55336ab2ea344685ecbaeabce34fc83c143 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423130598" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C21D4A1-1D8F-11EF-BAE0-E64BF8A7A69F} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00857449cb1da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2284 wrote to memory of 2304 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2284 wrote to memory of 2304 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2284 wrote to memory of 2304 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2284 wrote to memory of 2304 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ffc3975b3e3977062e82a4687342565_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | cdn.popcash.net | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | www.wieistmeineip.de | udp |
| US | 8.8.8.8:53 | s09.flagcounter.com | udp |
| FR | 142.250.179.106:443 | ajax.googleapis.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| FR | 142.250.179.106:443 | ajax.googleapis.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| DE | 54.93.84.153:80 | www.wieistmeineip.de | tcp |
| DE | 54.93.84.153:80 | www.wieistmeineip.de | tcp |
| FR | 172.217.20.193:443 | 1.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| FR | 172.217.20.202:80 | fonts.googleapis.com | tcp |
| FR | 172.217.20.202:80 | fonts.googleapis.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| GB | 143.244.38.136:80 | cdn.popcash.net | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| GB | 143.244.38.136:80 | cdn.popcash.net | tcp |
| FR | 142.250.178.142:80 | apis.google.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| FR | 142.250.178.142:80 | apis.google.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| FR | 172.217.20.193:443 | 1.bp.blogspot.com | tcp |
| FR | 142.250.178.142:443 | apis.google.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| FR | 142.250.179.73:443 | resources.blogblog.com | tcp |
| FR | 172.217.20.193:443 | 1.bp.blogspot.com | tcp |
| FR | 142.250.179.73:443 | resources.blogblog.com | tcp |
| FR | 172.217.20.193:443 | 1.bp.blogspot.com | tcp |
| FR | 142.250.179.73:443 | resources.blogblog.com | tcp |
| FR | 142.250.179.73:443 | resources.blogblog.com | tcp |
| FR | 142.250.179.73:443 | resources.blogblog.com | tcp |
| DE | 54.93.84.153:443 | www.wieistmeineip.de | tcp |
| US | 206.221.176.133:80 | s09.flagcounter.com | tcp |
| US | 206.221.176.133:80 | s09.flagcounter.com | tcp |
| US | 8.8.8.8:53 | ocsp.r2m02.amazontrust.com | udp |
| FR | 3.162.33.170:80 | ocsp.r2m02.amazontrust.com | tcp |
| US | 8.8.8.8:53 | dcba.popcash.net | udp |
| US | 8.8.8.8:53 | in-creations.blogspot.ca | udp |
| FR | 142.250.178.129:80 | in-creations.blogspot.ca | tcp |
| FR | 142.250.178.129:80 | in-creations.blogspot.ca | tcp |
| US | 52.86.123.151:443 | dcba.popcash.net | tcp |
| US | 52.86.123.151:443 | dcba.popcash.net | tcp |
| FR | 216.58.214.67:80 | fonts.gstatic.com | tcp |
| FR | 216.58.214.67:80 | fonts.gstatic.com | tcp |
| FR | 142.250.178.142:443 | apis.google.com | tcp |
| FR | 216.58.214.67:80 | fonts.gstatic.com | tcp |
| FR | 172.217.20.193:80 | 1.bp.blogspot.com | tcp |
| US | 8.8.8.8:53 | developers.google.com | udp |
| FR | 216.58.214.78:80 | developers.google.com | tcp |
| FR | 216.58.214.78:80 | developers.google.com | tcp |
| FR | 216.58.214.78:443 | developers.google.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | lh3.googleusercontent.com | udp |
| US | 8.8.8.8:53 | blogger.googleusercontent.com | udp |
| FR | 142.250.178.129:443 | blogger.googleusercontent.com | tcp |
| FR | 142.250.178.129:443 | blogger.googleusercontent.com | tcp |
| FR | 142.250.178.129:443 | blogger.googleusercontent.com | tcp |
| FR | 142.250.178.129:443 | blogger.googleusercontent.com | tcp |
| FR | 142.250.178.129:443 | blogger.googleusercontent.com | tcp |
| FR | 142.250.178.129:443 | blogger.googleusercontent.com | tcp |
| FR | 216.58.214.78:443 | developers.google.com | tcp |
| FR | 142.250.178.129:443 | blogger.googleusercontent.com | tcp |
| FR | 142.250.178.129:443 | blogger.googleusercontent.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\CabD4C.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | b9a6ce2d8d958f97f33e4c90383555b0 |
| SHA1 | 1dfc439a009c45eb482547d65aeee88675679279 |
| SHA256 | 35c92a56b5f0f8520f27ee9b8d093c80deeb4f7599dbedfa8619559986db3c03 |
| SHA512 | 0395ce6722e8663e946c8ab45bf6b28dde3d77c42ce893dd5d9174bb1c2c287b5ec4cb165ab2c606c13b39a72af14ea2d1b63bd3f21b766f8969b6d18db920f3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | ad5d7204edfaaa2e9721dc53cec22119 |
| SHA1 | 98404dc8789ecdbdfcf80bda1567c562e682819e |
| SHA256 | 92f11116968a1aa3146e894c2af897f08db2376edff47bc2a7f0984ee84de2b9 |
| SHA512 | aa7f4cb7860b0bbcd184e61a2981de0cd98bd56c9f354102fcddd206738546b012ecd31e922bd1c608fe0dad1acbebecd4628487be971ed66ecdd414e2f4e92e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | 4858ec7a902b1783fe13b83d847dbad0 |
| SHA1 | f707cbb9ae63c248db7166f403e1c6e286a5e794 |
| SHA256 | c82db1345578e29a61c9305731eb270bc4f2f317930b95a4a87f49a94bfd58ef |
| SHA512 | df0c25baef21a904a88a6f6b7afcb44e5cc58defb8799780c525b794e6244e03671ab72f044f662d5eb65b48ed091f5950a80bb79d3a9cccbceefe64f92a8ccb |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | ac89a852c2aaa3d389b2d2dd312ad367 |
| SHA1 | 8f421dd6493c61dbda6b839e2debb7b50a20c930 |
| SHA256 | 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45 |
| SHA512 | c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36 |
C:\Users\Admin\AppData\Local\Temp\TarDAE.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 59a9227f5d3c87afc6657a4c1cee2ff4 |
| SHA1 | 2c07b587f658c7aae2769a8f055615dfbe3d311a |
| SHA256 | 9271d907568629718faa332ececc33be59551f0b3e45f31a2773091b28ea9513 |
| SHA512 | f15da97368a474b531148aaaecd3c67895954b9ac58cf390a397467a730056ede8b899d719bfd07c7be68ad046651b1e3a5eb8f14c439fbed3811d8e9bb189d1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_02C4C6ED250727F9B08935C0A9565568
| MD5 | ab717c7b6b80f3c0b144b959aae3d0e4 |
| SHA1 | 578fb3f595898df0d21f22704fed7e75fa780c65 |
| SHA256 | c935ad854ace02c1c74ec48648a46b5b40d8d5877bf44ab8909356e2bfe965af |
| SHA512 | 60e579023b4b77f4a652a53e96c1a30968d3a54ed5e92316d18c90603ee7a469a9da544dc55c6d6198c9065ee6b89242e47ee1ad1d9b5785677fd9e2be4c7ff9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e0537693c6bb9d92e3049668c690dc15 |
| SHA1 | 6039eaa672d9ee364dbc134d0638db6d3af85ace |
| SHA256 | 0af943352790281be05f1b2d422c73037858fd7f864e15eabab00f1f23d05c36 |
| SHA512 | e52788569b886ad7dccd41f3e6a54fae4b6f154a06f5f3134a6fa504ebaa179fee79847241ea9cd94fcb5ff28436dbb20bffaf9c028ac38d3e3d098db46c859f |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\52G8PVLC\platform[1].js
| MD5 | e66acfdb2f1dfcff8c6dba736dd4ab6d |
| SHA1 | 36026360b6c8d750488ef2c739e04969f8c5bcd7 |
| SHA256 | 742841b3cf614dd55ce486a7335018bd1992c4d05ef74b45a0781318075a99f3 |
| SHA512 | 113b6e50ded2703cb7a484a66250a38d74833ab9a994dc54042abc95500fe7405f9e5f384186c15bf392c613420a19108482d279776f6e2fd00245b8bd892fbc |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\cb=gapi[2].js
| MD5 | f9255a0dec7524a9a3e867a9f878a68b |
| SHA1 | 813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b |
| SHA256 | d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d |
| SHA512 | d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4
| MD5 | 0e99e23fe61d0e586e5d2b2ea0b039bb |
| SHA1 | fa3c6bf42cc45fac60db08cd4f6b30379bf62f4c |
| SHA256 | 2c8cfadbc33ed2ca5ce547fdc6bd593bbff86d0d7e4f73b320df22a0229f0061 |
| SHA512 | 83ef09c1a7394e04bafc84b1aaf4e9f3c5b5a44fa40c14cf39f11021c054f4407ae207c254ffaf20b7cf3aa181e4bd9ef46f3557ac6382e544b3e88cc4be4174 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4
| MD5 | 01d34b4f3acb8ba55afa29098fd8bf58 |
| SHA1 | 061ba35376c3f396ffddfa9ddb46a204321db72a |
| SHA256 | bb9784259188015c97b9626b80c1645a7041d916e2ae22407823f05e4a018601 |
| SHA512 | 37e1b0e60e8b92681b8a238299733957b7b1a01159d2940efe5bc3c4721129c11d11e292680d6229a5fec834ba3d4c08028c29a5a39c94a54e71a5de66083e20 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 637214799a15387b5f396ce5fad66f23 |
| SHA1 | 11abfb74df267072357666f68ceaab49ee8d335e |
| SHA256 | 966a6e493a4a985b57943076d506df2174b976ef01fc831164fc8022ab18d717 |
| SHA512 | 1c13f540e7f4758f54e81ec424dc34d56dfbc4d70af929e59dca961a0f52f0ea30e61eec59fd46c623715ac329838eefea998fcf7e8655a7ca605d12e9408474 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b55eab5e4bed5d5bdde26a074692124d |
| SHA1 | 3db9b80f0ac009a996bbd1c2863db095415b8611 |
| SHA256 | db1e39e7921a0e831ae122b6c8dcd3198f7b8617c07fb66ace8da26e03fb5191 |
| SHA512 | 4df7a7807889d557c2a3fdea3fb3569049a0bc94caa92fefb599149906edf4e99fa063a34ac57964ceb7967ab83dcd366e1f349802dec7ba7cd3de4783a1cbb0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e6a795dddd71c41ac31ae17c7bb5a226 |
| SHA1 | 255866439dc26dcf5d7175ce7e4a11b46b435b4a |
| SHA256 | ffaf5bfb5a9799c9fa55939114aa0e9887e90294d527b14734f0b4176e4ac23e |
| SHA512 | bc509c9629a59169dbe8fd7ac88eb1e0b6c94afeaf5b9d231c638386633da483ea0b61d980b3c65d167cd4d102ea3b7302757d67d2da3d848b0116c4543bbbef |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1f8ccf1d2031d1bd66675b57539ae184 |
| SHA1 | 51a5989eb87a73a41c43b078bd4f12933eadcba4 |
| SHA256 | e8c6320b620e75da443836c6d4275760f0e6d84ea9e242ec302ed6a870509ad7 |
| SHA512 | ae191350edbb0b37c91353c3d3e0dfef63c28b53336c86aea8d45fc56dac5cf03214b0f7cc338498f2af5b710e4260ad65e741f28ae297fc23cff5da78b9f5e1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 988aeea84e0118845baab63411a710e1 |
| SHA1 | ec9b30096ed7de920e8d17539676431d3876566d |
| SHA256 | 4c59a3a8e1c8fcfdb620f68649b1aa652b9e168bafd5f6ac13fb10fbd9fae909 |
| SHA512 | 53ee5bd3287e42add89529467cbd9f8b5c6b7af63791c7ba1a4f2895eefe36afda35682aa276112a4d17c89231f7bd95f23c6358d4af4394a97e31a2b611692c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0b78eb387ea821ce99996a2c60eb641b |
| SHA1 | 95d1e3e132ac2d5e20d40f60267b57c946ff1c00 |
| SHA256 | b2f606fbdf7101608c0fa672ab05c3e1d4e945169fd1c1c83db9b0e9dd40fa95 |
| SHA512 | 36ca3dd3fa501189dc5bb42bc2268e20a447ee79fdb3d1030e923e0f808bdcff62e3d64b2dcc3879981aa76bf8bc5c45ab2de79b24dbdf12eb46804841b7deab |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 57cce3c0d42a397eb51649cdb80a05ae |
| SHA1 | d07651361fddf442f52d0efa54c38e1b95ffd42d |
| SHA256 | 39e4a7d5df0c2b25eb00976d35240ba14168afd331a5327376240e6367b33c69 |
| SHA512 | 1a7e3d4bc5f8dc9dfafc948eb8859aa9b7a842769542b16edc3036fa9ef9a83a30d8a2f1df74454cd1cd0ec0fe97b1fbaeedc32e0e76760cb765a5e3896ffeaa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 18584ce5da2610948fc155f4daf8a433 |
| SHA1 | a5ba8deae87cda6669eff17f2de4190dd148fcf2 |
| SHA256 | e5fa62d92f12a025c45410584a597363054e572aa0e999193d3cb1e6b8ef793a |
| SHA512 | f41e0e43426f5e169cb5a467239467dfa03738324a3da0fa04b059b60c315581d79b1783f7b1d97d23e1a4e8584779951089144c8296af25c1d2d6ce3b410acb |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a2bb95cd2aefca5115d88a601294e38e |
| SHA1 | 9b3b948ec74afd601bdde8cdf2b60f6f52e4b912 |
| SHA256 | 0757984a03a78e71d324da2466814d864b064ee1d16cc12664779e938b2e42e1 |
| SHA512 | 4e47b15c6e7f00d9ce30f02dc54c7240e4ebc196698ae26cfc12003de3ba040a7f0d423b01a917cd6b2c5aae5fa10c6ba8cc2771e95c3b37bf23e12745d61286 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 671cf3a48311cdb74e5fc827f33bf962 |
| SHA1 | 7d135e56cdb87600db88c13c7696516280c5f279 |
| SHA256 | 8aa6fbeb21fbe836dc7765e87488438b740ee5207fbfabd4d7cdc9557e500472 |
| SHA512 | 3c2744cc952ba8a5522e070c390823052470065dba813adfcbe45ed9ef998c56582c2ef708f7cfc2cf2325003acea2fcb0f0d4498991d71dccc3661a782b9bd4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6d638a1faa6607c156c4ded4324cac9a |
| SHA1 | b3d8fb353e536f05932b442d18212fbc7c5aaee7 |
| SHA256 | 55eccbebcb6e1e6e8e5576f145bfe736c8b0285002fc7c2a39735c32961ec6ba |
| SHA512 | 9a718cc47c8f78633e95825cb95e357eb78ddde31ce342689c1a1eb9c69fac4235158d7e8940055ddf2023e24e9ab969939e1c54ba73807bf6cb31b638aab0f2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fdb90532192491e003dfee219ba3bbf0 |
| SHA1 | 63e4126a33fb943a79a8380a767009f40b4c665b |
| SHA256 | 7090bc2c98ab215a2b5736088b1a88af7aa0664cb7fdd18125090330b3c697b3 |
| SHA512 | 596c47ced605005dc64caa4ca2de82e80b7857abe0b38fa663f4439819a41976e55436daebc598b808113be5882a99b2239e863cf9e5dfd9ca4ff8d468b66cb5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 66488e393ad72fbf28b6b289e3973df9 |
| SHA1 | b7fd54af610fbb98b10ecbe71ac94fff38913728 |
| SHA256 | 7ef084f446c3ba4836bcdd81b029e68be4aa20115d1638928065d780146292f6 |
| SHA512 | 91dc4944c26dfca5a46b874aa823ec63fa40410e6b15693cac774d533ff931b94dffbd9b9caa7ffaca3d488caea0b8824621e58346fe1102d67cfd558b5d2aed |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 00faa7cac5278695583e2c57a51ef911 |
| SHA1 | 99b2c8f2915d735ab0ace73bba49bd8b3aa8b1e1 |
| SHA256 | 32ce362d81aa0aa7f1e80d4553752dbfef0531dfb54a0a59275733eb72a069d7 |
| SHA512 | 6c33c74d18f07b98ea61091f6eec90aa1567047134a809ae77e3c21aa04dcb6e038b1a63c8d421d86de4a8a47a391ff9b4679a538c0c5556d68fa291dc8cae18 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e715be717b0afe82fc8657631425fc2e |
| SHA1 | 7ed00827bceaf97d9acc3a7ee3c16c7037935a80 |
| SHA256 | 67fbbc4ae390c444dda6eac54394354850923e4ae3735c6a1ade985f3a8965cc |
| SHA512 | a6d5ab8b9a1ef017028cf12fed9914d12f52ff6f7e919269b3e3b6a5e5e67f4fb47b4a6b573986438aa5bfbee02781d4e001fff951866e076d43b9d6d4f39dea |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 89066f1db4827143269ffe68383f2835 |
| SHA1 | b2ab80b5c17e0be33e7db6aeb03cfb927f9bfd21 |
| SHA256 | b993377061c16ca7f018f205421aa308098e74f2cd1b3634217ac734afba0dc7 |
| SHA512 | d86d1aa9789ed784efa78557320104130f4d9b820a9706dad04346a591208db9376d366d2fa383be54d3ca9ca1b2765f13c49ddbf28ff5f902a80db43dccd8ba |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ae61d1d1a5ba0987f30f73c8d95c4a16 |
| SHA1 | 3efc1a76faec33858fa15111099952eca7dc610c |
| SHA256 | 46d1783fed8d6549cb5705e95ceb455e2f5b1f1bfc9b85df44f11bcc2cdd3e9e |
| SHA512 | 44d964d9e61fb5479b1ab70af583a279beb53af10224a759ac056cb683fb12ae3d9068c457a6e32865132a749f100fc8a11ef241ed07c4bdfaea641a1aa700f9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1e79e04196be97c93253cb7d67eb5e2f |
| SHA1 | 1553b0d6598c3af93c1a54f3b6020af8dc04a06a |
| SHA256 | 5c4c17d7fc32bfe7fb0f126954a52ec3b609fb1b3ce3b1601d163ffa4a7cea8d |
| SHA512 | 56844ac175b6e0039c84416cc4cbd6733196b39067d4c81829e006d48b188bb1035e7fe2eaf5e3e2e4ad30ba3234a2edeeca79f623702a7d48cff2e43db13ef0 |