Malware Analysis Report

2025-04-03 14:22

Sample ID 241214-tj8c8axkgv
Target ef9637242542e69aab0b0dc47ad9bf94_JaffaCakes118
SHA256 b581e918dedbaa64686797d3f69b764d2e2ab4a3cda43c31e94cbabf03ce9362
Tags
discovery socgholish downloader
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b581e918dedbaa64686797d3f69b764d2e2ab4a3cda43c31e94cbabf03ce9362

Threat Level: Known bad

The file ef9637242542e69aab0b0dc47ad9bf94_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery socgholish downloader

SocGholish

Socgholish family

System Location Discovery: System Language Discovery

Browser Information Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-14 16:06

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-14 16:06

Reported

2024-12-14 16:08

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ef9637242542e69aab0b0dc47ad9bf94_JaffaCakes118.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5000 wrote to memory of 3836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 3836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 1696 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 4344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 4344 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5000 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ef9637242542e69aab0b0dc47ad9bf94_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eebe46f8,0x7ff9eebe4708,0x7ff9eebe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,7167010374299316862,15132027344004545102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,7167010374299316862,15132027344004545102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,7167010374299316862,15132027344004545102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,7167010374299316862,15132027344004545102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,7167010374299316862,15132027344004545102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,7167010374299316862,15132027344004545102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,7167010374299316862,15132027344004545102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,7167010374299316862,15132027344004545102,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.blogger.com udp
FR 172.217.20.164:445 www.google.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
FR 216.58.214.169:443 www.blogger.com udp
US 8.8.8.8:53 219.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 www.linkwithin.com udp
US 8.8.8.8:53 169.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 sploterias.blogspot.com.br udp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 216.58.213.65:80 sploterias.blogspot.com.br tcp
US 8.8.8.8:53 apis.google.com udp
FR 142.250.179.78:443 apis.google.com tcp
FR 216.58.213.65:443 sploterias.blogspot.com.br tcp
US 8.8.8.8:53 65.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 30.179.139.118.in-addr.arpa udp
US 8.8.8.8:53 www.anunciad.com.br udp
US 8.8.8.8:53 yourjavascript.com udp
NL 217.23.2.5:80 www.anunciad.com.br tcp
US 76.223.54.146:80 yourjavascript.com tcp
US 76.223.54.146:80 yourjavascript.com tcp
US 76.223.54.146:80 yourjavascript.com tcp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 78.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 5.2.23.217.in-addr.arpa udp
US 8.8.8.8:53 146.54.223.76.in-addr.arpa udp
US 8.8.8.8:53 resources.blogblog.com udp
FR 216.58.215.33:80 1.bp.blogspot.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
US 8.8.8.8:53 ap.imagensbrasil.org udp
US 104.21.16.1:443 ap.imagensbrasil.org tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
US 8.8.8.8:53 www.google.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 8.8.8.8:53 33.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 1.16.21.104.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
FR 216.58.214.169:443 resources.blogblog.com udp
US 8.8.8.8:53 kisorte.com.br udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
FR 216.58.215.33:443 2.bp.blogspot.com tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
N/A 224.0.0.251:5353 udp
BR 200.160.2.95:443 kisorte.com.br tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 4blogs.info udp
BR 200.160.2.95:443 kisorte.com.br tcp
US 103.224.212.210:80 4blogs.info tcp
US 103.224.212.210:80 4blogs.info tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 210.212.224.103.in-addr.arpa udp
US 8.8.8.8:53 65.179.250.142.in-addr.arpa udp
FR 216.58.215.33:80 4.bp.blogspot.com tcp
FR 216.58.215.33:443 4.bp.blogspot.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
US 8.8.8.8:53 i1335.photobucket.com udp
FR 3.165.113.116:80 i1335.photobucket.com tcp
US 8.8.8.8:53 116.113.165.3.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 www.blogblog.com udp
FR 216.58.214.169:445 www.blogblog.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
FR 142.250.179.78:443 apis.google.com udp
US 8.8.8.8:53 links.minilua.com udp
NL 217.23.2.5:80 www.anunciad.com.br tcp
US 172.67.179.5:445 links.minilua.com tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 widgets.amung.us udp
US 8.8.8.8:53 developers.google.com udp
US 104.22.75.171:80 widgets.amung.us tcp
GB 151.101.188.157:443 platform.twitter.com tcp
FR 142.250.179.110:80 www.google-analytics.com tcp
FR 142.250.178.142:80 developers.google.com tcp
GB 163.70.151.35:445 www.facebook.com tcp
NL 142.250.27.84:443 accounts.google.com udp
FR 172.217.20.164:443 www.google.com tcp
US 8.8.8.8:53 t.dtscout.com udp
US 141.101.120.11:443 t.dtscout.com tcp
FR 142.250.178.142:443 developers.google.com tcp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 171.75.22.104.in-addr.arpa udp
US 8.8.8.8:53 157.188.101.151.in-addr.arpa udp
US 8.8.8.8:53 110.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 142.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 164.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 11.120.101.141.in-addr.arpa udp
FR 142.250.179.99:443 ssl.gstatic.com tcp
FR 142.250.179.65:443 lh3.googleusercontent.com udp
FR 142.250.179.78:443 apis.google.com udp
FR 142.250.179.99:443 ssl.gstatic.com udp
US 104.21.51.101:445 links.minilua.com tcp
US 8.8.8.8:53 links.minilua.com udp
US 172.67.179.5:139 links.minilua.com tcp
US 8.8.8.8:53 99.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.blogblog.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 27.181.100.95.in-addr.arpa udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
FR 142.250.179.65:445 lh3.googleusercontent.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
FR 142.250.179.65:139 lh3.googleusercontent.com tcp
US 8.8.8.8:53 play.google.com udp
FR 216.58.214.174:443 play.google.com tcp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 img1.blogblog.com udp
FR 216.58.214.169:445 img1.blogblog.com tcp
US 8.8.8.8:53 img1.blogblog.com udp
FR 216.58.214.169:139 img1.blogblog.com tcp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
FR 142.250.179.65:445 lh4.googleusercontent.com tcp
US 8.8.8.8:53 lh4.googleusercontent.com udp
FR 142.250.179.65:139 lh4.googleusercontent.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
FR 142.250.179.65:445 lh4.googleusercontent.com tcp
FR 142.250.179.65:139 lh4.googleusercontent.com tcp
FR 172.217.20.164:445 www.google.com tcp
NL 142.250.27.84:443 accounts.google.com udp
FR 216.58.214.169:443 img1.blogblog.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

\??\pipe\LOCAL\crashpad_5000_ZYGSKJNAWLHBBCTT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 025a0e40e0b59412a4fd913bc1dfed91
SHA1 3977786a47440379ca0022aaddd8735e2ab94007
SHA256 de01fb954c7804cb26f183ff308db6b86435c1e22ae79b70e4f8d694e3f14c3d
SHA512 00a9ff32c86068239a06f38f348c5e561a48a89afcd9e91de51d85325d37e1167d6053ef33286ec2bb92fc6477100d84a36b5a525abe4957c529b920196c42bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c1f4a18292df926a6297ee8f54323eb2
SHA1 64706ae136c67a89dfda89069ad1f46c8c0691b8
SHA256 3bdffa9a8628d59a6d023aefcce121a57ee2cd5e21b31040f8d2e59d57d08104
SHA512 32ccd06f8e825a1e1b9b29b3907f25ad3b34d446c544c4308043e4bbd212bb0629fa6127c360078a94232da2d2bd37d8d96701de7fef0d32aa46a75ac9f59f08

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8a8b75ec085255d0e95ec8fa0eea81a8
SHA1 b08ea3f8796740a4242b0e82ff5971870a371426
SHA256 e913b0ce0d1b338b353e11cdf183bced9af4cd9a97fc653561aa7b5b0dc29d95
SHA512 d05b4c49f6d7408ee4c0d33e474ac693e22dfa225faca518b206c45742e2f2c7609171f62b78b6dc850a16761d84921ebe3af8695e9585c03e62b5938eac84b7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8b6141122c5ba477501753a8c8d2baa6
SHA1 c5d224a25294e749ca1a81a250a85caa42fb5066
SHA256 7762ab6f7053b701d7ea096afcd919cd7baea12cb4e9b0d6d8d6d33ae43bf00d
SHA512 065f58dd7fa98fea8471e5280021ceac4e67f6830cb356850045877e77dea07823d55beb3b0ba98bcae524ac65713e61c32e4118ab4ab18e9d4105fb87bf125f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 2442eef2634af1bb654acfb5881bff71
SHA1 b9e0b2dc3ecdab71d80e6063fd3543caea6f3f3c
SHA256 849f29cfdaa86dd6172940eb2c352bbccbf33b5b96148164f8ca853dc91a44cb
SHA512 2354ec20299d58f470952b07c47edefa0fb4ebfe4898ebf78132ee815fbfaff104ed172c3a10c90fc73aaf107fc5df64369e3028cf6915d89ba7164dc0f69c78

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

MD5 2ebfdbd309ee762211b4a2ac39708c4d
SHA1 b002922c672dbe1dd4caa02af24d0b1e7da616af
SHA256 54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797
SHA512 d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 2fe77a6248598d17405789fe5d228f97
SHA1 6e15a5fa7659086bd3649fa2014d652cfb364742
SHA256 34b28790c304de39e6fec068f2810c510e694e9502906019aa5a3f0c0cbf389c
SHA512 c1189d0f7ac6512946c776acec3942f7012aeabee453c2c23f0913345646ab01707a9658f0548387d01ad749195fb7d83e71276923e0823baf19f39972b5c013

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-14 16:06

Reported

2024-12-14 16:08

Platform

win7-20241023-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef9637242542e69aab0b0dc47ad9bf94_JaffaCakes118.html

Signatures

SocGholish

downloader socgholish

Socgholish family

socgholish

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf0000000002000000000010660000000100002000000052238f912a8d157aa1b2457da8384026857e5b4033fe30759c98a5c15f707f7b000000000e80000000020000200000004364d65cb46076f41a7e6ee9b862e83b6a446d12487c7ee2d237dcf769089b009000000010c9d6d656b883bc2b46132915abbcf5b39daba87f723a4e3dfa8f6c1f327268d09800a2078a7d63dc6720b452b48bc285a46ed0d6ea6e66a0db2616ae0bc3d1961126b724206f79d9e47ed82d4b92391fe8efdbccc15a18db8c6c41e0a709f45892a9d9f4a15295feb8aa28b62fc4ca564d1bba78139ea4bd5395bfc2ee3c004efe0071937df00aec6dc4f78b720882400000002ffe2a2ca9bc9ad92193b91f92a5b26d5158c4c8cdeea6f5f59437bfb8872c61dcbe5229cac5ca528c8f4fbf98cca1247732fc83dd9f1cc38a96b7082418602f C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0764839424edb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440354252" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D4F5541-BA35-11EF-8504-C668CEC02771} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf000000000200000000001066000000010000200000001c27db46b9dc37f5a9d921018d8731b9987f532f5615aaaaf8bb373a64f2a387000000000e80000000020000200000006b76e3edeb6d562a81914958acfe187129e2f5ac88819f1387fd62ff6d4bb4f620000000f77ddea7b8bbb111a9840a0ab0c21ca2293cb146f99f254ba1cc6bf728c1795540000000e79e94a434dba2e7ad71fca88e4b18edc6f0ec079243b0ed9d8dfc623c8cd0e90fbf78c1f569017405752e64feb032b5470bbc5d889fbb7258ab2eb080e4fe4a C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef9637242542e69aab0b0dc47ad9bf94_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
FR 216.58.214.169:443 www.blogger.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
FR 216.58.214.169:443 www.blogger.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 resources.blogblog.com udp
US 8.8.8.8:53 1.bp.blogspot.com udp
US 8.8.8.8:53 ap.imagensbrasil.org udp
US 8.8.8.8:53 2.bp.blogspot.com udp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.214.169:443 resources.blogblog.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
US 104.21.64.1:443 ap.imagensbrasil.org tcp
US 104.21.64.1:443 ap.imagensbrasil.org tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:80 2.bp.blogspot.com tcp
FR 216.58.215.33:443 2.bp.blogspot.com tcp
US 8.8.8.8:53 www.linkwithin.com udp
US 104.21.64.1:443 ap.imagensbrasil.org tcp
US 104.21.64.1:443 ap.imagensbrasil.org tcp
US 104.21.64.1:443 ap.imagensbrasil.org tcp
US 8.8.8.8:53 kisorte.com.br udp
US 104.21.64.1:443 ap.imagensbrasil.org tcp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 sploterias.blogspot.com.br udp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
FR 216.58.213.65:80 sploterias.blogspot.com.br tcp
FR 216.58.213.65:80 sploterias.blogspot.com.br tcp
FR 142.250.179.78:443 apis.google.com tcp
FR 142.250.179.78:443 apis.google.com tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
FR 216.58.213.65:443 sploterias.blogspot.com.br tcp
US 104.21.64.1:443 ap.imagensbrasil.org tcp
US 104.21.64.1:443 ap.imagensbrasil.org tcp
US 8.8.8.8:53 4blogs.info udp
FR 216.58.215.33:443 2.bp.blogspot.com tcp
FR 216.58.215.33:443 2.bp.blogspot.com tcp
FR 216.58.215.33:443 2.bp.blogspot.com tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 www.anunciad.com.br udp
US 8.8.8.8:53 4.bp.blogspot.com udp
US 8.8.8.8:53 yourjavascript.com udp
US 8.8.8.8:53 3.bp.blogspot.com udp
US 8.8.8.8:53 i1335.photobucket.com udp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
US 76.223.54.146:80 yourjavascript.com tcp
US 76.223.54.146:80 yourjavascript.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 3.165.113.116:80 i1335.photobucket.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
FR 216.58.215.33:443 3.bp.blogspot.com tcp
FR 216.58.215.33:443 3.bp.blogspot.com tcp
FR 3.165.113.116:80 i1335.photobucket.com tcp
FR 216.58.215.33:80 3.bp.blogspot.com tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
US 103.224.212.210:80 4blogs.info tcp
US 103.224.212.210:80 4blogs.info tcp
US 8.8.8.8:53 www.google.com udp
FR 172.217.20.164:443 www.google.com tcp
FR 172.217.20.164:443 www.google.com tcp
NL 217.23.2.5:80 www.anunciad.com.br tcp
NL 217.23.2.5:80 www.anunciad.com.br tcp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 widgets.amung.us udp
GB 151.101.188.157:443 platform.twitter.com tcp
GB 151.101.188.157:443 platform.twitter.com tcp
US 104.22.75.171:80 widgets.amung.us tcp
US 104.22.75.171:80 widgets.amung.us tcp
FR 142.250.179.110:80 www.google-analytics.com tcp
FR 142.250.179.110:80 www.google-analytics.com tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
GB 151.101.188.157:443 platform.twitter.com tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
BR 200.160.2.95:443 kisorte.com.br tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
SG 118.139.179.30:80 www.linkwithin.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 184.25.193.234:80 www.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 67e486b2f148a3fca863728242b6273e
SHA1 452a84c183d7ea5b7c015b597e94af8eef66d44a
SHA256 facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
SHA512 d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\jquery.min[1].htm

MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

C:\Users\Admin\AppData\Local\Temp\CabBAAA.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarBABC.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 961d3d4a68157ccd3baffd3810b810e4
SHA1 251865560ceab9ac196aab49d97e19c4cea43e55
SHA256 f49813d0f9a8c099d49e2ec6a88c8c089b5ccfdaf3cceb35c590c5d80cfefc61
SHA512 e8c091b71c0e76b07c634fad63ae26d08ee506e6bc25afd59c1668edc4f5918876abca6e72af9e2ba45a78e894ab5d6489efea00d8f01cb4d2f57ae473713c19

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c1ddcc27af002ea44634c7bf0d647d24
SHA1 7b33f140be023c3b4e0fc91f3674e0a71036b49a
SHA256 d2e8a65391fee305116da81e021375aa39d16f4d6459babfeb40c862517bfd7c
SHA512 357e9208dcc634b41b140c2773676de59184df1e74708d53a27e6a471cfea610d9175979875380a980894f50d1620110e22bc6bdb976f8760bf54dafe4d94c64

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 886759654c97d116c723c122aec19022
SHA1 d3fea7620fcf16bf26755f23d163f390437024bb
SHA256 7cf87b94a04c0606c138d54c120fccbcdf645629e9bf6e7defe4cb5b77379449
SHA512 210e43a77bf32f46adaf1c615dcf200c294b753bb065cfa850ee9c31236865ee12e8eae4e4dbcf5a78b3f3bf69be91cc5e27f721da608a2b021ddce82ee1d5d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92411c4c31f6d6ac59da46938cf86576
SHA1 a242ecbb678cc880cb460cf96fc18acb827d4091
SHA256 39fce96f0fcae9998ba47c61bba2ede27418804018d92ffcb2e057f49c0a22cf
SHA512 24a6a1183ad2ba07b2cdbe7fbd8d6e0ae1e0dd3d375d01adcf2acd977b7884f53ea703c954dd7ed0c337fec76e7ce69b1d1ace9f04b935c33bfd1081c549b299

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08c57e3a5e25e1e6ed5b34acdac24eee
SHA1 bfc6c7feb523d60bbe8ec15a3d49846454c06fd8
SHA256 d83cb2cb3024e72aa3f2441ed08ede230d8509dfd91c619c0630c88b122b39a7
SHA512 1aef6a590ef12ece8cebd14fe5a946b07558ee760578c9f28ff8fbc1adac9c0aa1f8a4189d254870e90c22f4aa58e19cf6d16d9e4aa52917dbd26015038c9c72

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c19caad9ef93c003226830cebaf2a71a
SHA1 75b363ec01125ddab5856321f70ab2d794c127e0
SHA256 bb85337a149672b5431970434a00a0e28a65bade2a47e49b14e7b4ad3e8b358b
SHA512 6084d02650d830a45de50a30ffecc4ccc26afd5b959bb4f63357a615acc4c3c9fca6e84e3a553b7dd67cb0e1dafb81b17bf710dd15699c91afb4a63e838fd2c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52f554288a8ff4e2885f9ace534762fc
SHA1 22c81497132971a2b096899b7e23a07ea13e3011
SHA256 5d60e6a3e6bb32798cb0cafdb57768e2f5c8d049081c31261903d19231601c1d
SHA512 b1db9fbb708a48037324185a5488a3a66c1519cdcdfd7692126335740abd843301f4dc438441e8980843d0fcd78910e3dc358e5de1c4418b9021caf24c280fe0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d07d7c7cdc44eb7f39c5f9dae177fdce
SHA1 041607610d2fe2bf0bf0469cb6a4df4f1dd78dee
SHA256 a28b8b2ad46c14ec909980100fc188140c6442fee593aad90343cf2328e7283b
SHA512 c7c5467ba43296bcd8de8238f0ad3b351f36ce9b6b5a4de88812521213b073d45064e65165fb524effeadc444138d4e5b10c34e2ff46967441b98ac311e4cfb9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b62723cf5005a391f88fe356bb76c795
SHA1 133f2a343ca2445c1e933439d5f834ff03e36c38
SHA256 0ee971de1f12308065c635d7c5b65643115f17c5974d37c8eb206b2f6c56dd7c
SHA512 5bf6b04239c83670664f843cd4bd73f2d635eb34a33062187cdbc6c7ffa62730e711292d7af6e54cbd8da6cde54dc937b35dab93507007021f0ada7050c93772

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\plusone[1].js

MD5 3c91ec4a05ec32f698b60dc011298dd8
SHA1 f10f0516a67aaf4590d49159cf9d36312653a55e
SHA256 96b335b41362fd966c7e5e547db375ef0be7dcb2aec66bf3646782eeaed4b2cf
SHA512 05345e754b39e9f83514bc3e14b52f3cbf321738fd7d973da55db99035b11b4152fedce2c203eb34376cc9e18571db514ff9fbcb4174a2dd7cca7e439cd25944

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6G4X5UFP\4176668146-comment_from_post_iframe[1].js

MD5 7b83a4d2c41b81b9db1eddb77371c8a4
SHA1 73c7409d43d6f382bf7d98c57de4a9178ab0d216
SHA256 d848527bba4d3a35af740ff4c0b6a6077a737013c79b751745a3e094626ff281
SHA512 4aac9f43afc3bb63a399ddc7a9587ec064453f30605d6961701792fb66242da041e54534b4090500491d79b8cf273ca9057bc3b986287f4f51ecfc380e5c2648

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6G4X5UFP\default[1].js

MD5 fbe63e689ec843ab80a0caa368994f7e
SHA1 0c24258ee0734f23160867fdf0dadab5d05ee957
SHA256 e31a0469d975e123a9c49504b9710daa7444547cac5e75dfc2f21ddb527356e2
SHA512 e9415841a860405c2cbb5bf99ef6431104d89340bf385218eda2b4c56fc61017475bf1cc37c397f3ca6b77ba745b11340c06f7a4691ff6206685d9cc7f74f399

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eaa2e96d06202978fdb0f6bfe5f6f8cb
SHA1 f3d50197e0843209afbe2ec0886c66a9126019e7
SHA256 4796af92049e8464119ebd3214baf67afd062dcba0556ce8d63c728bf30ce1fe
SHA512 e8d8b545513f79241099127cab61590081e1a564005b86028ea3c674cff6aac7c2210c9531fb1684c475a2cc84ed7ed1e64684b4fddfce215ec99ccad9fbcbe2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0723f3ef4c596572b172c575218388d5
SHA1 66b404418510cd88a6a2b83493015d7bf669cec7
SHA256 9490ab6f0a1a4972e4fb7f11e4218dd2421ea693ec4fea54675b96aac3094527
SHA512 cbe311e8d9b2da07ada99828dc800c0a5c06ee4d9ab11e99e47fec5619222530f8cf60cecef53a1a4d8cac2f9a46a90e149e179bbfa146b74cf2dd2b286b5560

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cd13584b0b2b1e88340f4773e4b68e25
SHA1 aa173a8a4d5b866d7d472278d42d062d79791060
SHA256 afdc93464e38665b703f627cc6f70fc647e5b351ea621ec9e98e9faf553ff5ed
SHA512 8eb994938889e9fc90b44dbcf4349b2fbff839742d6a5632afd7dd2cf5d7be6523cf1f2ef1e78d845e5655443484d8c462028119d1b9f49ff9c6877f941fab26

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ffdabd8df20eea63865144c86a2ed6d5
SHA1 393b9a088780bf56e87ff3c84b5974860c45b271
SHA256 8234e9ce31a96adaa2a1d3d49c63317abd43c098928bab92aff5cdb5c208932a
SHA512 680b8de0d9bc551e53171181f5219af0f05eca0b2a3447100397a94254b4c0672d9ac8166a140bd0e8fe7ab6db171f8931295f7a90a9cf90a1f938f0790b3303

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8cc96b624de9ce2bff879979790d4586
SHA1 1b77e046a0f84e9df727a58ed1835893516d7e9a
SHA256 c0e1a7e69594308cba18394c8ab7f1971e5e927213d4ccdd7a3eb05ba7f81f5d
SHA512 dd774a3069beab31cf2f356883007b34d0374c5eb5166a4b72b24cadc1086dc721a494e557ef250897c675e9cb5e533bf9cb5cc7c697726409aa16a3406d2e98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 10c749ce720ed003fde603cc8529db9b
SHA1 db2e85bc88bbf1bfc0bd5011141d548cfe8338e2
SHA256 88bf91175074e944614820ab801172ad7f97ed707b41035d0024e168e97152e4
SHA512 8aad06988a6c95bce603c753c0020156725d57eaa776051b7470bec07d41965a328d8958a755bc77f27119ec5547b61c771d2f2bc5495bd4a9aac8930c8cf905

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b5f8146e942777b5c1c94e34f9956fa8
SHA1 e0469d526fee3f9924ec17b601384724c413bc0c
SHA256 6b985d92636e77b11ae6576bda6e3d90eba1401f6fa1c06c4379564008f67692
SHA512 253f66a149749a0d5d10e5618757650a71a3755ac3487590f216d58d59fb4967ec6c2c793b977537bf39e6872dc203373698f7b6838d3e603d89f6f30d65ebdb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 80b2ae39b77bde1fd96a44bac70a3d45
SHA1 81eb43439d757f032e0e2fcfd670bbb6ee0a6f1f
SHA256 63648a46177ab7ad067f889ff0d093a59a43e77142c864c86f5e39eca46866ea
SHA512 8006e3064dd0d3d8c2b3e9033248c425a40e30ed5721126f91272c983d6e2324585d6cd26e279835e03d5179c59e420fca2ad1d24f98b1fdaec8fa7f738a498b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 015bdd51a105266032fd5ea39ab936ea
SHA1 81e4080a790cffcfc0d0b130a1c509510abe2f3a
SHA256 03ba0b9a0cf02090963e1a94c5e4651d7ca97abf140156bae17b7e9433de43c1
SHA512 f1b140234b02200a755e7409848336704da50d773a61dadff17d72d75051169272146f879ca4b9c41405b33092f6b0e0946ff0c1858265411b72a36ea2dd60ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 194592ccd73496517d0646dcd0aa74ee
SHA1 b92eaae1ddee6bb1b14c48760513bc4dd7a0b0dd
SHA256 49e1e3ec36c0b161ce2e52faab5499abe3bb90dfd5f665005db057977d045094
SHA512 bbe17bb1a4c6c78653fb5cde6c25cc4710f43cf1ba955b073b2328c917a44b34404c2c852561feda258582d53d72ea4f17df02493dc3efc7a237096c0b3772b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c4e0a4b1b6e25c2e9a8537cc4cceed99
SHA1 617f336e0963400581573da1c239b1dd50afd383
SHA256 11849916b023dc8396371db773e02da0ded3fc92f597fb2026793ee7fa1046bd
SHA512 8a6543fc9cb7fc63206edaae5ca7f6b4b140649cfadfeb743076f2878a791831c38f96f2df3e1fb8c7d2bfd7d0612b48d12646c78fd06b47f68495a6bf2da8e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cfc4e0eca0ebf3ffee04faad0a584a58
SHA1 6d392cac6da4cbf83db4ba2c43f88a776d8921a8
SHA256 1d51330c2aea235335aa74276014118a68da0684c8ac0029fbec5ae035f4f3d4
SHA512 411752cccc8fc187ca08d0b569c49f23576b42c83d2249a2d6740c72ab5aac214de871ad138c2680dc41b7fdbfb590ab55474b02ce4bd658b89bd7423e301cd8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a10c1e0a44e79797401eac0cb5cbe262
SHA1 554e31b02325974f9607c2835905c0065bdee0b4
SHA256 6231dff14cf8e3d4cbfb46fa90e3c18744ccd5c884c0c3378cef220582bef7b6
SHA512 494755459a2b930e0b418914d60be0b5b41aa6f749cdae544cdacb105aa220e9a2fd9c819736f58ab77a043372539ce8859531cab95bdd350f59812bb9cced4f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f246b551396ec1723a43ba476175ee8
SHA1 6916382e8a94891d009fc55f938824c2fa324ac3
SHA256 8c896cfb21c6d7e8328de35c8de05369f5c9cc3b2f8f53bc7e4d08e739883410
SHA512 5cd699977ca3c3bdb8878c8e4820813ec8df8de6cb288948cc9822d47fae84682f31412e70654041e587b838eb70de711ffbe9115f3b550aa973bb99db8b0e34

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ce1195605be86a62cdf3754c51db7cf
SHA1 a9054c96003289c0eab65454698a59118696405a
SHA256 1b1da3fffd4d2464963313b4c4e5b2e1316d2e761c286c30224c84a5963fb73a
SHA512 00b66fa5bc92d8fde9f9e6f0a428877054108ebee4e3f30cb97b2705cd23c8990fa7758e01da035a34570174aff658027c185860a66efcb8d265dd8eb3f08759

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0bbb72640a9286a70225f00c1257cbcb
SHA1 ebab82ab19f80ecd599c48848a50280e267a694c
SHA256 51a595c2b5f45349a96c8a3a9f0a99a68124780a188b50f4a925ff8d7b1ebbcf
SHA512 96d796553644f177cd2c9be99c665b4f9335a5ce7b588c24d9a66c1500b539cdb41c1cb97a024718e32605e206182720bde583638019596dc297691575b7cfce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb1bf577dc33378349d324501553a746
SHA1 cd28a5eea9d07fcea90044cdbe92deabdca7d7bd
SHA256 feae593b0b89f5ca9f973d8b583e72d7bbfc9b0994c424cd7157d9d9a9018db0
SHA512 fc5275dcbf1bd093e8452d5bbd231bbb1518454e6c80bc19c735c860203360b0edea28875fb64532df53bae87c9dcd4da7133acc72ea89b5ef5fabf705b680be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 84ed320a46da2296f7e1520a19e45085
SHA1 937bd0df2f9b94fbda5a4629e341eeda0b706179
SHA256 afd1009af8ba40e5adb9e15ebe45d7e033fc7f1bd1ba6862f61de86673d66e96
SHA512 dafb914e16632cdd959a473b444b0a626aabc51d519115e0dd6b23720ebeff9c2bbec1f5893c5618bbb8bd45d6532735b94834cf920d9185072db52432f8f7fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 591c0dad3f9ede71a8c2eafd00e5b11b
SHA1 9cf1035e18b3fe5ff77250bd14b342c517900f7e
SHA256 e6de25b4040cccaa32b3d0fa8aa595c61b2dc7ac8c21d81f71698c3894882727
SHA512 c937a2d58bc54cf000d83eb7db1ced3093c95bf32d103747ebcf3ff7207637cbf5c0007363c45b048b4fe692c775eeffd02f2d84bf7a2af6fb69b7a7a6cde73a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e0bf924bd25c66ba698e0f7bd56a2528
SHA1 ecf9500d3aa6d4f52a0d861cea6dadfa6634cff1
SHA256 abc9ab5258d08a0521e79567d603b1ff6543d0498880f1a52c4a2c09c876ee61
SHA512 886a9769d79f79ca7d6ea9b95b14afd349f9d055b6873fedf2723d7ca7e66361ff83bd4ed0ae5d8915f79da6da8459ebd60f95f6a5c9cf6359cfb9a5bf008629

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96ef15065e0249c224fdc1314dbca1eb
SHA1 5f15efff88fc027ca5538f70e3d15aadfba20645
SHA256 1bd822ec55f8bb3e265ccec3137cbc8809b268c3745123ca9c8e767cbd37e4d7
SHA512 b9cbcaf0b7c01fb948a116217492a983bf619e3a709d1a39804058f7ed0857eba3da8fbee5c68042f91fb96ebd0d8a6093eb7d9977e15cb9c15c3dd8ca938534

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7dd3ff9bfc523ca6d85a0515ce571682
SHA1 6f84760180acd63fa6b0e8879272d78bd19824b2
SHA256 6ce905a211a49b4c86f65350b302fd32fb45ae3bd2bbd7dd10518b337a64d983
SHA512 567b18b80c5d4b4868afac76271487cec912959cea8abf2378c36d338239de07dd8413ea393129006967e4ab272792409bee2b52ea6e409737cc650207fc6d7d