Analysis Overview
SHA256
f70a5a378f53e182c06c71b2d36be12ebf4aff223be288e9d69ab753f4a812a3
Threat Level: Known bad
The file JaffaCakes118_3466bd0014338f26541f731c610b199b was found to be: Known bad.
Malicious Activity Summary
Socgholish family
SocGholish
System Location Discovery: System Language Discovery
Browser Information Discovery
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-31 20:17
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-31 20:17
Reported
2024-12-31 20:19
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3466bd0014338f26541f731c610b199b.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5f3146f8,0x7ffc5f314708,0x7ffc5f314718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6884 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17589353901523363884,8696625770676580660,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5060 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.potter.web.id | udp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| FR | 216.58.214.169:443 | www.blogger.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | kumpulblogger.com | udp |
| ID | 36.50.77.66:80 | kumpulblogger.com | tcp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.214.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.179.250.142.in-addr.arpa | udp |
| SG | 172.105.122.89:80 | www.potter.web.id | tcp |
| ID | 36.50.77.66:80 | kumpulblogger.com | tcp |
| SG | 172.105.122.89:80 | www.potter.web.id | tcp |
| US | 8.8.8.8:53 | connect.facebook.net | udp |
| DE | 185.60.217.28:80 | connect.facebook.net | tcp |
| DE | 185.60.217.28:443 | connect.facebook.net | tcp |
| FR | 142.250.179.78:80 | apis.google.com | tcp |
| FR | 216.58.214.169:443 | www.blogger.com | udp |
| FR | 142.250.179.78:443 | apis.google.com | udp |
| FR | 142.250.178.130:445 | pagead2.googlesyndication.com | tcp |
| DE | 185.60.217.28:443 | connect.facebook.net | tcp |
| US | 8.8.8.8:53 | static.ak.fbcdn.net | udp |
| US | 8.8.8.8:53 | tweetmeme.com | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| FR | 172.217.20.164:80 | www.google.com | tcp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | g.imagehost.org | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | www.blogblog.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.214.169:80 | www.blogblog.com | tcp |
| FR | 216.58.214.169:80 | www.blogblog.com | tcp |
| NL | 172.233.44.120:80 | g.imagehost.org | tcp |
| US | 8.8.8.8:53 | 66.77.50.36.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.122.105.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.217.60.185.in-addr.arpa | udp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| US | 8.8.8.8:53 | resources.blogblog.com | udp |
| FR | 216.58.214.169:443 | resources.blogblog.com | tcp |
| FR | 216.58.214.169:443 | resources.blogblog.com | tcp |
| US | 8.8.8.8:53 | 33.215.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 120.44.233.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.179.139.118.in-addr.arpa | udp |
| FR | 172.217.20.164:80 | www.google.com | tcp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| FR | 142.250.178.130:139 | pagead2.googlesyndication.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 21.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| GB | 163.70.147.35:80 | www.facebook.com | tcp |
| GB | 163.70.147.35:443 | www.facebook.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| US | 8.8.8.8:53 | developers.google.com | udp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| FR | 142.250.178.142:80 | developers.google.com | tcp |
| US | 8.8.8.8:53 | 35.147.70.163.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ssl.gstatic.com | udp |
| FR | 142.250.178.142:443 | developers.google.com | tcp |
| FR | 142.250.179.99:443 | ssl.gstatic.com | tcp |
| US | 8.8.8.8:53 | 142.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.27.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tercopy.blogspot.com | udp |
| FR | 216.58.213.65:80 | tercopy.blogspot.com | tcp |
| FR | 142.250.178.142:443 | developers.google.com | udp |
| US | 8.8.8.8:53 | 65.213.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.238.56.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| NL | 142.250.27.84:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| NL | 142.250.27.84:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | 1.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 61cef8e38cd95bf003f5fdd1dc37dae1 |
| SHA1 | 11f2f79ecb349344c143eea9a0fed41891a3467f |
| SHA256 | ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e |
| SHA512 | 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d |
\??\pipe\LOCAL\crashpad_1324_VWJPRUSARFEWIXTT
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 0a9dc42e4013fc47438e96d24beb8eff |
| SHA1 | 806ab26d7eae031a58484188a7eb1adab06457fc |
| SHA256 | 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151 |
| SHA512 | 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 542b7ff6a0ad3e46b1b398301e5023a8 |
| SHA1 | 6cedd071c2a3cc5523194bae8c81256dd0a82289 |
| SHA256 | 80d68f221d3564d588fbf15034d276a51ed975d9bc6656028e1f13cd70d1be79 |
| SHA512 | b5d6dd1a7157be5da907a4428066db415932fbf47e46026067adebc7d36347c041a70dd8722dd93149b54aa76dd377d9bb05230c8a154092b3c2b94fd582cbb8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | a5ebb546b874d34b7be224511b661e1d |
| SHA1 | d1a9797f6191c8349ce1e4e283a858a41c107b5e |
| SHA256 | 6c74905a026bd2eb9edc6723bc9d8ecc34bb74387c082b3c0f6f4d30df9c5d4b |
| SHA512 | 68a931153a9c7cc95e9a2a9a9e23749e1b2559dfc2ae5e67e3307a65827436a1cb47150d032e7b370bac06f82f087790d9a68933fb5790ace7a0bc54cb1853c5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 720a71ee06bad32b6ea42eb357400ff9 |
| SHA1 | ef7fef65c5eda01d553b05a39b9d4999845d99a8 |
| SHA256 | e03ccb1e899de60c2ee00a625eff9ce730cabdb6cfd817437acfa57a0f972ccc |
| SHA512 | e43d9dc8554ce6607d4a8d3ea794cd4c0dc4425e9e7e16140415b68841bf609d2aa7f103d454fb2552b0fa065945f50b3cd515cc04640ec37bac0d8bc2933f9c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
| MD5 | 2ebfdbd309ee762211b4a2ac39708c4d |
| SHA1 | b002922c672dbe1dd4caa02af24d0b1e7da616af |
| SHA256 | 54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797 |
| SHA512 | d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 5ab5b2045543e648bc6d43238f4f7ca2 |
| SHA1 | 26386dec93ce548bcc50f04131f8571208026a0a |
| SHA256 | c2eff1fae75286ca2ee0fd27f4f66d7723cf247cdba309f4329efdb7db8283a6 |
| SHA512 | 8c74d69752ba22c0387939a7be0291cddd6ab1a29fb2dbcd2d90cf5c0e3136c28c4ed59faa34f5c9a85f9e3a379dbc56f1969aee0689bfbd22f69ae62f8548fe |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 33bbc899917d8baf96da5f27696a4fd0 |
| SHA1 | 1b889c5db1ad43d49bd8a8c0fb5c8356e9cd3e8a |
| SHA256 | 096cd80b43094b5ee77c007565be939d5b2639b66690b51fc24d0bee0e636dd7 |
| SHA512 | a5d50074c6fe78698eaca1a2d73db1018ffed69a204ccd81f112fd746760325b70cb0de61cfed70f0f08bb4911219cbe8f7980c85095a0105a251dfe3ec5aa72 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 79fca75baaac9ecb0a9728dcca668216 |
| SHA1 | dd9121d36951d664d40b8d06d2e12f8de0b20b31 |
| SHA256 | c371f76b6a293955caecfb834ff18c5191e7aa0dc2dcbe2a146687a2fe9cc859 |
| SHA512 | 30829df87f081ee5d15a948c53379895701e1eaba056ac0916bdaae1fc99fd05e1d4cd370191f5941add2e18b6d12981676a2120e24d0c46a269a54f74875a70 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582769.TMP
| MD5 | fbb4bc4cb8fd49b71021720df58a3fe5 |
| SHA1 | 2f23891cfff3cb20fc2d28da3bf1f02585d6492d |
| SHA256 | c8035716ce5a8bd474a260a9494c9c879f584416fde31f843a99c630964b43c3 |
| SHA512 | 0e8386a29c02ee6afaad5d7ac4a80bb1419618b9eb32c24e4cfc225ab38770a4c2f3e89d2d5a5b761efd56da3b2f22f5057da69d9da6e7ad6b6d71190fbc52de |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 23089d14d02381b4a4a828102d70f7e0 |
| SHA1 | 1056e1ff1cecaa3066c0500d601fa85d249deaf2 |
| SHA256 | 7fa0d19096221132a9f3ba3d815e6182df1f698584f75301aae393fe64f001dc |
| SHA512 | 82b57577df13cad8983e9ca7ae73a4f6461dbf7099fdd4d88246eee80d16e8730761eff5293fe2ef2f7e08bf70a02318674511478409783ccd05b9723bb0bc41 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | eb243eb6f1b8cd6a97ad2f17c1a25e7d |
| SHA1 | 620d3cdee4ce00d98d39472f756b87bd1b1c2243 |
| SHA256 | 69e89b0134dde02323b051f8b80a364c2ee2ed00f709b60798493a77397e12dd |
| SHA512 | 6300201ae02c5f01dcde679124c7838297b4ea97914ecd27037023bca210b7578d294cfdfc1424bcd1871aa50cb68bf0ae4d789c7f7136bd510ab79e10c0aeb9 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-31 20:17
Reported
2024-12-31 20:19
Platform
win7-20240903-en
Max time kernel
145s
Max time network
146s
Command Line
Signatures
SocGholish
Socgholish family
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441838111" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f2bf66ea8fd4aa4480079cd318a4ba5c0000000002000000000010660000000100002000000038540c94b68d3ea7e362ef5b719d81ee00f12f46e004bd5ca742f76fd224ab12000000000e8000000002000020000000f44dfc9c330412c21c18628bab94257689523c3ee0a109fa16fbae2cb88d4124900000009532bda19bcf99d5016ca98b73a5415608375f4b00ba7fc175e0f0cc6de7035a6e1892e64f3b89100a74dd6e94353793f1d0e38c84fe98d78a083864f1972eeaa2926c3c7ed8cc5d40b9487e5d52269eb1e3cf81d8239dbeb98e748ee664ab07f301e949883488e054605bc5c3d066831557927d3912c4638c352d570b982d2533271046d2fa21dd1bb9b4f412b01e5140000000413e3589a2b4de2b2ac0d2af61d36286ef1e96040f55aa81cdacb7daa3caa71b0044aa7e77e6cba3b517638f19e0b80a19b10d4b77b684913ddf5d3f15333b58 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f2bf66ea8fd4aa4480079cd318a4ba5c00000000020000000000106600000001000020000000b26e21211c93c43cee55f8a6486d758f3d821e7804b7f3bccd3086e412c2cdea000000000e800000000200002000000079250f88c85f8695ae9d9d6e06facc8bd2727ee6a33a12ff860348ee17983b762000000077579029079d59100681869081880c680ce35693fd9dd412260750341e416036400000009fdeddbca4ee534a2d549cce76bdfbffe3bc96bc827a92cb15c6f93ed12b60868e36df7e74ed4cb749229379ddcc5e7d7f543726bd594034a1e4a9f29913a4c2 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00864c1ac15bdb01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F635D61-C7B4-11EF-BE3F-EA7747D117E6} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2092 wrote to memory of 2880 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2092 wrote to memory of 2880 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2092 wrote to memory of 2880 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2092 wrote to memory of 2880 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3466bd0014338f26541f731c610b199b.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| FR | 216.58.214.169:443 | www.blogger.com | tcp |
| FR | 216.58.214.169:443 | www.blogger.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| FR | 142.250.179.67:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| US | 8.8.8.8:53 | www.potter.web.id | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | g.imagehost.org | udp |
| US | 8.8.8.8:53 | 1.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 2.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 3.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | 4.bp.blogspot.com | udp |
| US | 8.8.8.8:53 | kumpulblogger.com | udp |
| US | 8.8.8.8:53 | connect.facebook.net | udp |
| NL | 172.233.44.120:80 | g.imagehost.org | tcp |
| NL | 172.233.44.120:80 | g.imagehost.org | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| DE | 185.60.217.28:80 | connect.facebook.net | tcp |
| DE | 185.60.217.28:80 | connect.facebook.net | tcp |
| ID | 36.50.77.66:80 | kumpulblogger.com | tcp |
| ID | 36.50.77.66:80 | kumpulblogger.com | tcp |
| DE | 185.60.217.28:443 | connect.facebook.net | tcp |
| SG | 172.105.122.89:80 | www.potter.web.id | tcp |
| SG | 172.105.122.89:80 | www.potter.web.id | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| FR | 142.250.179.78:443 | apis.google.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 216.58.215.33:80 | 4.bp.blogspot.com | tcp |
| FR | 142.250.179.67:80 | o.pki.goog | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| FR | 142.250.179.78:80 | apis.google.com | tcp |
| US | 8.8.8.8:53 | static.ak.fbcdn.net | udp |
| US | 8.8.8.8:53 | tweetmeme.com | udp |
| US | 8.8.8.8:53 | www.linkwithin.com | udp |
| US | 8.8.8.8:53 | www.blogblog.com | udp |
| FR | 172.217.20.164:80 | www.google.com | tcp |
| FR | 172.217.20.164:80 | www.google.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| SG | 118.139.179.30:80 | www.linkwithin.com | tcp |
| FR | 216.58.214.169:80 | www.blogblog.com | tcp |
| FR | 216.58.214.169:80 | www.blogblog.com | tcp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| GB | 163.70.151.35:80 | www.facebook.com | tcp |
| GB | 163.70.151.35:80 | www.facebook.com | tcp |
| GB | 163.70.151.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.19.252.143:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 95.100.245.144:80 | www.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab52E3.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar5363.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8452S9S3\plusone[1].js
| MD5 | 3c91ec4a05ec32f698b60dc011298dd8 |
| SHA1 | f10f0516a67aaf4590d49159cf9d36312653a55e |
| SHA256 | 96b335b41362fd966c7e5e547db375ef0be7dcb2aec66bf3646782eeaed4b2cf |
| SHA512 | 05345e754b39e9f83514bc3e14b52f3cbf321738fd7d973da55db99035b11b4152fedce2c203eb34376cc9e18571db514ff9fbcb4174a2dd7cca7e439cd25944 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IAE3FJ0M\sca[1].js
| MD5 | 18a5ebbb9b9da1cff4de40fb1385d301 |
| SHA1 | f62e73aa5f9fb3a8c7c27230c98f8060ff4698f3 |
| SHA256 | 693ffde224523a247b0d2290b8bfd7c8f35a41ed317bdc80c5ac1c26baf6ead1 |
| SHA512 | 01f370dba0ad9a3e7eb81aaa326d6f63051f221799d3cc8672f60f587edb3b9eb265a79672b9e62b524aa8051307c892b09f5d8e13d2c5913b70e223c9c433cb |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\all[1].js
| MD5 | 2c32934a5c5be9ab25809948426cb6ed |
| SHA1 | 3f3b672991b000e5cb38fbbb6667e1e20ad0141a |
| SHA256 | 41a46d85ccb79b612627c7cc0f8f46a35a28c6d52308722f18e82ecb47d23ad2 |
| SHA512 | 574e60b4a56f607b6223a1f4edc97f5b0034ceae7900c04a02e76f8fee48a5e91dfdebbd84317bd5f1e54ccec2552abcffca77307877723eecd624d7104675f9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dafef26ef52353a76b105ed82e3a3c4a |
| SHA1 | fca95a0155348f389b5091128ab7b3067ec178f2 |
| SHA256 | 115df889001b729186c28392b668ae61475768245d47d4d9c2f505132db3fcd5 |
| SHA512 | d72599e682798bd4b56ce54c1327998e15b6e2c889fe15bc06b93be7f58ac25641db7399ffcd6c4d8a779af21a1ddabcbc3a95ee1451f41ded85d49e9f806a46 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 53331edb1e210f47b2451403e3a56b5e |
| SHA1 | 3f0f37b83d69eaaa1740db7480a7a9263a8879f7 |
| SHA256 | 53cb7e16d8563eea7e0bc25c5316fcdb51533f98bc7bc3f446c84eb573bc915b |
| SHA512 | 725e856d48416c68f7971bb5f52f99d7092f4b0e1af1285eb30f8d1c91a54860443ec7ee675760aa8fbf40e57dbdfef4ecf334e6bca85885528f9f68a9fa3dc3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a3c332308f7cafe0516ec89b38f04bf2 |
| SHA1 | 73c730c5b8b933496fcc74f34a532a8d67ae4fb3 |
| SHA256 | 4f6970f296a615031bc6ccaa3683aaa47aa8987ef74ba6494ef1153111c0fd36 |
| SHA512 | 61028035abe385b0d27fb141c21e560fc835199dbed631c4f0b30619a703c4b31714d3bbcf1c30f2983450abc6b8568187c77892eb0c5246e2190bc39af49979 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8edfabc346e137ce5a3d254891f63717 |
| SHA1 | c9635056cd672c8569b071c9a188e74158b9a4eb |
| SHA256 | 218da1f71523c5fb5c1cccd1d6f6442346eac1ef78d88b77b97561beaaf09fbd |
| SHA512 | 43e39cd3a87d05889c4bb46ed036194f67765cb9c6743720b55dbc6437d33a1bfb19835c814c2057a0224d9be7a6216d8a4ed951f5939c167c6c475698ad6252 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c01037f4815b5f76758943ac8e014f63 |
| SHA1 | fe095b991268928f47f216f548f1b40fd3883878 |
| SHA256 | 844b78d99d410c4afc6b9d780889c6cfdc3b95cc3373d119cc5bac16094d49ad |
| SHA512 | 536df14175d766ed16518deaa8af4bf9933de968e4cc19ab1577ca35c1c0debf01ba800376cd6eb373a256f02189f5798b34537570158c9c6a3253c639f13e5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c685b084716e9fdb321ec1fa11e1c53f |
| SHA1 | b86e235f2ef2b4bd04ada608f827fe8a5bce7b26 |
| SHA256 | 0b8c98540ade76458dd61a4af62b52e52eb98d029493994b1d42fdd5ed61de92 |
| SHA512 | 8733cf5511ad79bb4ff2345d9528669edd0e49dd3bacb27089cf92ab54d05d20ea572ba203695a2a34e4ecc6feb6551f63975201a54e136549ca29221e5fc3c7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7549a9c91766a373a947c3a5ee1580c1 |
| SHA1 | a58117b835c198abe11d90486d731116b6a70c2d |
| SHA256 | b9ba6501018c72e1b4e009841c28ce5708c93600402415a6e4a91c5f112a36f8 |
| SHA512 | 4a57a54b2b366b05d16dc5be0d024a15e0c250b21965964fcf6cd8a374d918a9a5e0e584807c29d9017d25bef734093651d4d5a246338ef7efef905d5787588d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4a13edeb165f09d7a1c68ea69b7c0785 |
| SHA1 | 4dabf18df865ddbee9e708f0060157dba8539eae |
| SHA256 | cf6b5a79ede36b24b8a21d659e4fe6383f0e3dbadefc305145b9b76b469cc6e2 |
| SHA512 | db9acadae54d0bac489418031f4b3a6afb45c7cfd2d39f9e52336d2282f10bff43e48396ff8bce1edaeb55e41dafbc0174c1b7c69ca93d08b874c6bebdf1b77e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fc53953d4f7a391148e306b9c9d054c9 |
| SHA1 | 503a22d723de144cd2a2a16747123d5ecbfff997 |
| SHA256 | b99904be3738640d15a6320ff947d91f279505955fbed811e1297db4ca560b53 |
| SHA512 | c56cc7704c432c961f9377ea5b35ee393a0bb0258d13c1120c38431ffa00a0a9a0673e2e5947db8f6a104c354a63ad6354cc9b324f5e87b9372f10a633a6e19a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4bd1768ad230173d49a5f61fa1ec9c28 |
| SHA1 | d45e38ff729c90cfa25d43a5ff6c2c2fa4b5dd9a |
| SHA256 | 809f9e506b1be1912ce7f16cf2cfcdd9a7fa830478f5527c44e6f9b7e7badb84 |
| SHA512 | 423ed1d2c6197edfa830b4b47bf79153a0c4695a7d63738cd0c4b72a348d5a421e7a7ec3c7177b77851156e527db09b20f4559e5dd1de4f18e3e10b5296d47cf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 25b9f7de349b33e115df5f3ad628b7aa |
| SHA1 | ffe36a83e12370ebddd319eb5e6b7c03f1c62e2a |
| SHA256 | 9beee727aa7cbf5c1c01bbd4a69be0a953e62f40095d033c728e98c3ea681d4f |
| SHA512 | 7c4ffae5c0fa9e8320840ebfae696c1927248b0f8c8feec06162e9b1619351ba2acebbe90255390b8f6d326e8fd1eb978826675087eb0a0ca82b3dc22ee9929d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 55f71cfe9c8357e2fef423c37c1be5cb |
| SHA1 | 44ddd7c1c96a9f565e18bb0157aa35ac76be22d0 |
| SHA256 | 99abee677579b7f17280122decdead35b9f5d815c983690e3209936fd36b2b97 |
| SHA512 | 965b3cf833759fd2df9ec42d0e99158dccbc677e809c881c77521fc1ae39ca7b730c14a057d5aff9a9429789f5453e1fee8ec4f75a9d49936b7f4e2c5ff1ae43 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cfdf965fc23f5554a6fa78aa8e884c69 |
| SHA1 | 8956f71e50dc3a8d599206ab97ff8359f07658b5 |
| SHA256 | ceb789e52526ca03fec0bb183492d1b6362b1011a671dfc558177008d79c2ca3 |
| SHA512 | bdfa7acadac043782b984c08916d33d8036b0d62227d16bacb722d79fafcb8b65a5c70160a1296742056bdeed62f17d7af8aa6e69ae1f445484230c580f2d7aa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 22b0bef93da8d9407e3cb17ff7e9a955 |
| SHA1 | 88f65fea15d3a8d721d8f1f0bf9f75364afc6656 |
| SHA256 | a1c1ddefe4bbc3ececa446954e7d08210eaae33a1baa6801cb45b3ed61a70425 |
| SHA512 | 148833c44b51b87eebbf79cbd8fb4eb01d14cca8ec6e50af7f435d3727b2464688a93c9e5b8b389d4bebac975282e709b6f7647a853fb192406d4bec8c5f3c1c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 075c8d6550618e40fd419f076fcb5e22 |
| SHA1 | d500ce09303166ae9072703d2b0831e9afeca853 |
| SHA256 | eeafbefec640854c4182e8428f493403d43eeea31ef081b4b5cbbcb06a91f6aa |
| SHA512 | ff52dd45596e71635ac4b2a6d5e6aeb02aa343b6d34c32b2f833cab9433bccee41c028b75d14b1e3fe7cace14b5fed55a8cefd2fa88f956170c849d9e41103cf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b2bb58eaec030f2a184ad5ecec51704d |
| SHA1 | 83b1e5334a2f049df95936582b28cff45c16b333 |
| SHA256 | 79329302eb2aa59b9659781b4580876996fa088718c6b80e08b37440013f505d |
| SHA512 | 058831feb7a01ba6fa5eb0196b5ea2cedc56f24a852959059db26e4c7befd39d3c12ab7b7daf6e67cb2a479a6cb34a1fa94186a56e3e66194737b06b79cfee3d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f7e5beccd28cbf71e0017590006c92e4 |
| SHA1 | cf4d9d53d5db29cb593f7b3191d7d98703e0528e |
| SHA256 | 2d450e9c976d611b60b5f0534cf644b94d7c3425fcd281182c1b1cc0d4624426 |
| SHA512 | aed583b39b46f8390a69d0c1cf8d6f3dc22fec6d49fc5abb8fdfa41f33704b6b96f94c89801dd7adebcb24bad10c9cf3020a00aca5fbe1b33f80b9eefd0579cd |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 25ca18e9d34915f0b4eaad724e531356 |
| SHA1 | 3af802dc453080265411d19cdd88da7ec8a96075 |
| SHA256 | c1714fca142f3c670037214299c1b152ca030ca924afddb94e2da6bf2281c3bf |
| SHA512 | eb6b33f9140e4a4bf9751eb180b9c186dbbdf4bbc8dc22a07ea67878629b67b1180bf663d19aadb24806749d24416a4552582406d4d8331bcbe33049467e8aea |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dbb559cbd65c5a9113289f0c7b2257c8 |
| SHA1 | 31bdead93d821a487aebd11f7bed17b2be7d86ca |
| SHA256 | 153f141bd498229c383db1f7298b8da003c5786a93ead9990b788a53554d74ab |
| SHA512 | e5bab2883f378a07f60669f8d7e237524215914e3abc245fa8ce99f9e71b3842e46bb7e6713cfc6638fe6e046950726afe78ad3d82809072e568ef0c4c8af859 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f39e57da57b4b4b41c1ae25263fcee60 |
| SHA1 | 1b6262feed580ebf4c2ab643c4e733a0e6c84d22 |
| SHA256 | 5f1970f0c6020b88ca27c26007a2d986dadf108435483a55e605e17873d9a10b |
| SHA512 | 6c568b03ba0e344988b44046d75be0224a88d9501ae727b33e1fcc41790509c1574ccf4bfc266cd108ce2dc0961992b513ae1c3f93d87777515c8653b1a9bb0c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 19603eba7d3a3e0cc3aff3ea9cfa73a4 |
| SHA1 | b012834453d69a646fd95f50471c31233c1853cf |
| SHA256 | 21bcc0da54db88704bc82360a438a17c2c5fc979420663e5231485b9c01f6e60 |
| SHA512 | 98433c8e30a2018ba827b58eb1810727a4dccaf37048064c3d18ba805fad195462f31938e46be1412effa5a54820dd6f4facabde65b393bc99e6c2476f809de6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 43de500ecf1896cd50c4800efb9c3041 |
| SHA1 | 4ba95347c03610076a7b69fa0950305ce9f28ae3 |
| SHA256 | 2faf84f576844eef15e8a25ee8dc6a6bc6ee6198d1ab7b1cd80a437f2f82ce0b |
| SHA512 | 0038bc95fee35f9cd47bea248eacfc36d7a71b664f0e47d5b4c6e667d7a5bb1ea3fb70a24ddab2f5507700f14de452d20bb7c5c3c32c664d1bcc764843e2b6ce |