Malware Analysis Report

2025-03-14 21:57

Sample ID 250111-af2xgswrhr
Target JaffaCakes118_f1f2f0ecc40876fa07b77af868900d4b
SHA256 9d410d8aa31bf5eacb1835da80e7c11310bdfd9eeea887b81a1f51f9330d2f3a
Tags
discovery google phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9d410d8aa31bf5eacb1835da80e7c11310bdfd9eeea887b81a1f51f9330d2f3a

Threat Level: Known bad

The file JaffaCakes118_f1f2f0ecc40876fa07b77af868900d4b was found to be: Known bad.

Malicious Activity Summary

discovery google phishing

Detected google phishing page

Legitimate hosting services abused for malware hosting/C2

System Location Discovery: System Language Discovery

Browser Information Discovery

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-11 00:10

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-11 00:10

Reported

2025-01-11 00:12

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1f2f0ecc40876fa07b77af868900d4b.html

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3724 wrote to memory of 3936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 3936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 3572 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3724 wrote to memory of 4128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1f2f0ecc40876fa07b77af868900d4b.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9ef746f8,0x7ffd9ef74708,0x7ffd9ef74718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3281382193098754938,10337778693553818528,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3281382193098754938,10337778693553818528,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3281382193098754938,10337778693553818528,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3281382193098754938,10337778693553818528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3281382193098754938,10337778693553818528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3281382193098754938,10337778693553818528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3281382193098754938,10337778693553818528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3281382193098754938,10337778693553818528,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
GB 172.217.16.238:443 apis.google.com tcp
GB 142.250.179.233:443 www.blogger.com tcp
GB 172.217.169.2:445 pagead2.googlesyndication.com tcp
GB 142.250.179.233:443 www.blogger.com udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 sites.google.com udp
US 8.8.8.8:53 cdn.ay.gy udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 172.217.16.238:443 apis.google.com udp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.54:443 i.ytimg.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 142.250.200.33:443 lh3.googleusercontent.com tcp
GB 172.217.169.14:443 sites.google.com tcp
US 104.21.48.1:443 cdn.ay.gy tcp
US 104.21.48.1:443 cdn.ay.gy tcp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.179.233:443 resources.blogblog.com tcp
GB 142.250.179.233:443 resources.blogblog.com tcp
US 8.8.8.8:53 106.27.33.23.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 233.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 54.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 1.48.21.104.in-addr.arpa udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 8.8.8.8:53 adf.ly udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
GB 172.217.169.14:443 sites.google.com udp
US 172.66.43.117:443 adf.ly tcp
US 8.8.8.8:53 accounts.google.com udp
BE 142.251.173.84:443 accounts.google.com tcp
US 8.8.8.8:53 publisher.linkvertise.com udp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 104.18.0.75:443 publisher.linkvertise.com tcp
BE 142.251.173.84:443 accounts.google.com udp
GB 142.250.179.233:443 resources.blogblog.com udp
GB 172.217.169.2:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 linkvertise.com udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 117.43.66.172.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 84.173.251.142.in-addr.arpa udp
US 8.8.8.8:53 75.0.18.104.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 3.bp.blogspot.com udp
GB 172.217.16.225:445 3.bp.blogspot.com tcp
US 8.8.8.8:53 3.bp.blogspot.com udp
GB 172.217.16.225:139 3.bp.blogspot.com tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 resources.blogblog.com udp
GB 142.250.179.233:445 resources.blogblog.com tcp
GB 142.250.179.233:139 resources.blogblog.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 8.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 172.217.16.225:445 2.bp.blogspot.com tcp
US 8.8.8.8:53 2.bp.blogspot.com udp
GB 172.217.16.225:139 2.bp.blogspot.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 172.217.16.225:445 4.bp.blogspot.com tcp
US 8.8.8.8:53 4.bp.blogspot.com udp
GB 172.217.16.225:139 4.bp.blogspot.com tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
GB 172.217.16.225:445 4.bp.blogspot.com tcp
GB 172.217.16.225:139 4.bp.blogspot.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.178.10:445 ajax.googleapis.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 172.217.169.10:139 ajax.googleapis.com tcp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 34d2c4f40f47672ecdf6f66fea242f4a
SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

\??\pipe\LOCAL\crashpad_3724_BFMKLZCCFBLLXHXR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8749e21d9d0a17dac32d5aa2027f7a75
SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9b47302473996c9849dd83660d0b59e2
SHA1 d0f03e5c5b5ac55c28e9f9ebc5408f3916709275
SHA256 3dc36945f1ac7eabb01cf5af7e979c4eda804506a66b871b1f89a4bb9aa6b03e
SHA512 eb5f84234e6c3941dc625ffe5b6386b0aa9726dc8f35cb71514e877f40a3014b9b90226f1c764cead24d849701e83c03444e947f6a4f34e3b2573c540fa1d298

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

MD5 d79b35ccf8e6af6714eb612714349097
SHA1 eb3ccc9ed29830df42f3fd129951cb8b791aaf98
SHA256 c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365
SHA512 f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9e08a0064750af11647a0100e6656b15
SHA1 70ae738d9b59fb6d10e4c29dd0dc2f45fd107a6a
SHA256 0238a8ebfda6f00e2b801fd7fd02fd00f7cde15a80e356663ca8a75557b6f1cb
SHA512 89e313aab909797df50f14bdc95cb2ed93426b2da7e2a22c5bffb3fa78d0c238f32cbcb4a449e5b50403ee987a698e81f0664d649c862a561eff65be65cc334e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a7b91d7fc3b49b91c7424cfdfa64442b
SHA1 d0c28d4efbea27f3d81187189bf44ecb155ecfd1
SHA256 0a04e706a7eaa2e07312fb5666b9923af3ccb32107879898f372bf2139f129ad
SHA512 6311f1b8bdd43a7e24081059295c2ad1ab10d471a99bd9151e654c288baa87fad51e08284be604d70f343a483ec432c834f23f63cd7eac08955f8a184d1461f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 4df7f11cd9ba6db2ac5d34b6383c72bf
SHA1 d6bdee32971109113cca1f62e1139980bb3d3b91
SHA256 00facd57220a66fa51cfd7242dc8f5d9d000d4f40deff7ba7d752c2ad5ed352e
SHA512 426f2ca272dd424754952d6d73a29c5e23831f285a72faa4251a40908d66bd6382276e8d2c240d892b3b2a52c005d540044576acc18a756a96c58083700875d6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 9af8430fcadd01e3f45d58745427ab4f
SHA1 954b08361557e37e0103883400d638ccb58bb471
SHA256 c3b1d3d97de955b369a717712dd68e172abcbdefd14a5cbafdf68b49b8e1f099
SHA512 ebc609708798e347dd97a3be1a6c15f617b1f928efa9e53d8b397cd63e0d7d57f6906860e306b45a2eb6fa2ce8d43f91dd0fa580e533f662f0146fe1c71c7123

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-11 00:10

Reported

2025-01-11 00:12

Platform

win7-20241010-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1f2f0ecc40876fa07b77af868900d4b.html

Signatures

Detected google phishing page

phishing google

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69860031-CFB0-11EF-A2DC-6AD5CEAA988B} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442716075" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1016714cbd63db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa6e42a642bd1c41b360354f4cd1b83e000000000200000000001066000000010000200000004fb5c573762065663930d08e1166d3593e55da251125fd56d29fb1640f4ac890000000000e800000000200002000000078c430209b581dcad9d99f4b4b1f9b626ffbb0f602e06a611e94e7738f6f554d20000000654d4a6336b13790ef846e7eb42a3d7bfc47c93dc9194f57bd60e61aa2468a3040000000043978462c374f95b17a8568c64e5d92df01f3a8ea7252436f66db2fcabc597ce4b22844902636505415951df27bfb5dbd68bcf82a37d31aefa3b375e92ecad7 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa6e42a642bd1c41b360354f4cd1b83e00000000020000000000106600000001000020000000bc674c291e8d42a7da2cf2236df08036b7ffd3b79d8a3b1f6f27d4d5e991916d000000000e80000000020000200000008fa07c4a38e0b6ec7bb4ec37a83a4a3ba90849c6ff703724aa9259a3329bc208900000009cf86c2fb83cf28e99f5103d5d5ec9aaa35d640e8aab7d7cbff84b3cd95a51df9d965136aeb4a2832ce6e48ebaa2443f83786e4fe85097235693e568bf35994a488008e723a3e8d0f6967700611cd583de255ead4503e7bd310c26fc0df613757e35029cb85517ac80ddddb38bdbde94f68b5b4c21bd13781110d26e2cfb3c408f1fae9240e784e6942237837230be964000000079d86f3d54392a778ef6a474ea378a2ada68d3a295d880d5644200435f86a8d049264cb50d19c237a17cebfb1246d47ad70136cbc086df97f6207e6155909ff4 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f1f2f0ecc40876fa07b77af868900d4b.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 cdn.ay.gy udp
US 8.8.8.8:53 lh6.googleusercontent.com udp
US 8.8.8.8:53 sites.google.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
US 8.8.8.8:53 lh4.googleusercontent.com udp
GB 142.250.180.22:443 i.ytimg.com tcp
GB 142.250.179.233:443 www.blogger.com tcp
GB 142.250.179.233:443 www.blogger.com tcp
GB 142.250.180.22:443 i.ytimg.com tcp
US 104.21.64.1:443 cdn.ay.gy tcp
GB 172.217.16.238:443 apis.google.com tcp
US 104.21.64.1:443 cdn.ay.gy tcp
GB 142.250.179.233:443 www.blogger.com tcp
GB 142.250.179.233:443 www.blogger.com tcp
GB 172.217.16.238:443 apis.google.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 172.217.169.14:443 sites.google.com tcp
GB 172.217.169.14:443 sites.google.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
GB 142.250.200.33:443 lh4.googleusercontent.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
US 8.8.8.8:53 adf.ly udp
US 8.8.8.8:53 resources.blogblog.com udp
US 172.66.43.117:443 adf.ly tcp
US 172.66.43.117:443 adf.ly tcp
GB 142.250.179.233:443 resources.blogblog.com tcp
GB 142.250.179.233:443 resources.blogblog.com tcp
US 8.8.8.8:53 publisher.linkvertise.com udp
US 104.18.0.75:443 publisher.linkvertise.com tcp
US 104.18.0.75:443 publisher.linkvertise.com tcp
BE 142.251.173.84:443 accounts.google.com tcp
BE 142.251.173.84:443 accounts.google.com tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
GB 142.250.200.46:80 www.google-analytics.com tcp
BE 64.233.184.154:80 stats.g.doubleclick.net tcp
BE 64.233.184.154:80 stats.g.doubleclick.net tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 s10.histats.com udp
US 57.144.120.1:80 www.facebook.com tcp
US 57.144.120.1:80 www.facebook.com tcp
US 104.20.2.69:80 s10.histats.com tcp
US 104.20.2.69:80 s10.histats.com tcp
US 8.8.8.8:53 s4.histats.com udp
US 57.144.120.1:443 www.facebook.com tcp
US 57.144.120.1:443 www.facebook.com tcp
CA 54.39.156.32:443 s4.histats.com tcp
CA 54.39.156.32:443 s4.histats.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 88.221.134.137:80 r11.o.lencr.org tcp
GB 88.221.134.137:80 r11.o.lencr.org tcp
US 104.20.2.69:443 s10.histats.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.146:80 crl.microsoft.com tcp
CA 54.39.156.32:443 s4.histats.com tcp
CA 54.39.156.32:443 s4.histats.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 92b839135741069b05829b07b6f3f3fb
SHA1 f9f5ce1b773f2fe6388af9d48416827e80964cc5
SHA256 4ae12fedbb424da1938e2bf5b343dc175d9cdaafd4123715be68dda9bb2f18c5
SHA512 c229439b8ae1b6760533115e1e9c70a2aa8aec489516c7245c139a6f2961bb5b8f79d3bf67b71e1df725ee2a94fc355974d297edce4b57b4a5ad2d46f4a0c38c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 ca83f08a1e23a5e031f71734dd673fd0
SHA1 7817b14b30c3d55326d971257a73b440fb94ec00
SHA256 b16553ceca10558b04e6c8c6c6b1296c3bb67432616074f8fe181be7d73662e5
SHA512 28d59bd2af02cd0370bab9c3d6e5afc61b664b60878e99268305d12a17d4cb3a975b1498589697bb9d9fec84d9aabd973472750f81ab801aeda6eff7d3bc6214

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 58fc0ec88167029f7dcb2a0a2ce41f88
SHA1 3e189b1f06dd6cbd99b1a4b9fada655221fc2859
SHA256 66503d1953724f7e65e221c309174b9991018cfec26b29c4ef80282b415a6fc3
SHA512 54c9e690c575230b02f44f27dc91677efc11b7531287b98ac85babfa0f3c229ecaf598c362a1c673f36f082a027c5bd0bee980170065e0799bc6a2b14f0f2e31

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 562c504643d9e191709999ca45b61a45
SHA1 77ed67d85f58d08f9c2c4d3ac1c75fc043cf458e
SHA256 22d6427536933f98d2aa7b788150d7ade48e74e63c1ebd9a83fab1c4ccbba6ac
SHA512 60be09ea029f70dc8153142211b8cacd7db3e580d808d6ee1f8c81697c7e982efeff484d2bf1cb9960b5e821f6c77dbfcdd28d6dc1f2813cc920d3cfb09a2333

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f4d60eedb64e9094a484911b14053e4b
SHA1 71c3e8dbea8cddd7ad49eb0473dddbf4fd5e439f
SHA256 e114ca0f4bcf2e65c698e311499009ee704816e7cc13d66a748d3404287af90d
SHA512 159408c0cf56a19ec58a7b1c662ca4faab9e2e1b036893c387eeb3742b615b2adae6f70cdcd251d4c8e6f2c8c0ad6c20da8e18f8a46ab7ba1dae0bb7bbbaec69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 bfc47a8bf4d2b3d566063a555f54b49e
SHA1 6a59ed2abfd34fde592414f1b11726b83fda5c4c
SHA256 13b137a54e2fe688412cf2cd4313ebcec3259a3414c60cbe2b2f006d7e00c2a0
SHA512 626dc82b4ed271980bfc5da25a1913e899529b9e88b66c245e57409252c3f56e1716a0bf7b122d3d02e00a4d2ad753850c05e92a1e38feea9fb904c14d469eed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 ef2696061e439a7dd0a4c006479026a6
SHA1 2b69916ecd954e2ef8fe9ff8a6205a619af05047
SHA256 4646b037328b820e28ca4e7264e69ae7d868395d678078dbcfb1ade4360f3332
SHA512 a733e6205d6f2313ff15a01d338972a555e406a711a6c08b8cd86eaf99ae67a0a1022b27cb2e0a029eff4419cf4b43323e2e65f32f24fc00e1469d56bddc8c2f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 ac7f828c82bd803f7c79d883b354bb97
SHA1 50d04f5a282a40cd6f97ae91eb3b8b7749444501
SHA256 233feb7be3d31145895b6b0313040b489965adfa8722f4527143ad0b1c36a407
SHA512 fbd2331a71a1c069394994fce11dc74b8f6c69bdd94cef84e7e8e74cf2010d976a518d211a090c0dbaedc9d30e1d7c2fd747eb4f204e549e99bf45f50cf3d579

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 17381adf5afae2869b869d4f13e02904
SHA1 9e09d55fd3e3803b1681def1903e7cd4d97a77bb
SHA256 4dc4c011c1fd1c46ae7c8316025020e4fb6b671d09092776a7a7516816583707
SHA512 99a78d317ac039223c02f6e6717d7fef99ec6a4eb6298316a1715195019a1ec5177b9174b9796634f875e5e2f6ca80cb7f152d6f32bea37c5cbcf303e8cd7189

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_DA783F5F6B4EACF017C07E5A0C9B6E7D

MD5 fdaaff306f9908166f3fec130e798df8
SHA1 0ab422ed789b50e706ba69c9f787443dd5e6f9f7
SHA256 4bffcf6a3521fd5825a18d7fe6eedd7549facf2f7953c6e05b81fd3a9bb81a55
SHA512 1b1d4ee0c4d003b072987d0a67efc691f516ad1933b2df5409b411420f33e7692a15bc4b0a4405ae2e558a59effd4da610a49de2cc89785135568bb8ba829e3d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_DA783F5F6B4EACF017C07E5A0C9B6E7D

MD5 b144ebcc6693937b0fbcf994ae3d0fe6
SHA1 b3d7a5145076304a12be1089a7085d333206cf88
SHA256 8a14b8fa8212e03771bebc33d810e8a68013055b39522b2d921146f64dc49c6c
SHA512 54c236d458947254c3eae91e7bce58d90633a1438478e6bfe4d5b541aa000659cada662ede9648a2698c9a3c7febdb6cdd82b8490e1854bef621dbe4f31d57d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_CF0CBB3D0D6F86153E0774F3F89E134C

MD5 9b4cdd6975a8d21cd71b93763aff238c
SHA1 41473197a57e1007d8c11f49ea09503d7a56c772
SHA256 f7bad0db45fdc901980b553e75e6ccd0f85059d18111f31f35356e204d8fae96
SHA512 0ee79a8b3a9d40903c4947c9d68bb95930241731d72e1864e69bc834ea940315dd3686521ed2824030980f081a287c92ca2af5a2d3736d2bf4ade25b0b57db6b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_DA783F5F6B4EACF017C07E5A0C9B6E7D

MD5 62258ac351b9bc12507ecfdea495337d
SHA1 5db87b361c003579ddbbf230abb66101bf1de1a5
SHA256 436b22263abf8efe098211662c64288191e9a34aa0eb9ee110780949aa1d4142
SHA512 b76f30e96e14055fd134bd53ece76d3ddcca5af4c509675c74f557a4dca8195298ebb63c90a1e0df9e0a1e45367b44cb0c04c7873ce28bb80cacb0c8db9c3288

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\ga[1].js

MD5 e9372f0ebbcf71f851e3d321ef2a8e5a
SHA1 2c7d19d1af7d97085c977d1b69dcb8b84483d87c
SHA256 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
SHA512 c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\plusone[1].js

MD5 2e4a448a27b8a58d75f607c7bdcca6f2
SHA1 31cf764c6c2240148eaaa2b9816e1219a273d0bc
SHA256 d3696859f3485d8aa6f8a4d0054d64fc1ee614e57725221dd1c97b930f02bc3e
SHA512 09ca4d8b6a0fc653490921befcb3d752e150ac9abf24d1fdd49c9453fe2baf969b76433a45121451ef642ea3f73f9c62871cdde5e07976ffdc03ee5200e4d35a

C:\Users\Admin\AppData\Local\Temp\CabBD0A.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarBD1D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4b7d1592a5a01aea5485e5bf54de7932
SHA1 54638ed3b340711c7272161e121804185db31c9c
SHA256 f8af94a3aca262aca0755b62e316da6a96e17c7db168b61a700f0ee4057929c2
SHA512 db5fcad180acaefbdbe06f3a40bc895a557cf88fca0f3a797cd8404af7f24015d84df4475f473e18647072ff886695dea800b6904b29593cc2b52850c13f1e4c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a037363292f9400fc92e411578b92f67
SHA1 bf62983ffd1075669f4aaeda7ef1253ff602dac1
SHA256 d8347d6ac228b7306ab69dc82733e2136603c4c08463bee76df3af9ef4c41256
SHA512 48e5a7a313c660559ecf83b78d55bafcf54552656b053ad4fdf2c032329f61ce2b837bb5476f66f80b9fcfc9f2d3fe22e90c14a06632bd41237e669aedc0ac0b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\m=_b,_tp[1].js

MD5 8e974a1c8adf8ca30595885c9b523063
SHA1 b1df5f0c61d470270008eb435835d49bdd38ef55
SHA256 4292b7548789ca2718f56298836b37e50f39b94cf74ef2002a973bc5bb98bf3d
SHA512 0ec3a7c5572908e3014003bc418fce9cdfa6b7965c4c3419ab6e1a48e972e3ca191cdda1a5f0a4392c4a7605b6d178e6420b2021033f805fd9f7a009da5da496

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\KFOlCnqEu92Fr1MmWUlfBBc-[1].woff

MD5 cf6613d1adf490972c557a8e318e0868
SHA1 b2198c3fc1c72646d372f63e135e70ba2c9fed8e
SHA256 468e579fe1210fa55525b1c470ed2d1958404512a2dd4fb972cac5ce0ff00b1f
SHA512 1866d890987b1e56e1337ec1e975906ee8202fcc517620c30e9d3be0a9e8eaf3105147b178deb81fa0604745dfe3fb79b3b20d5f2ff2912b66856c38a28c07ee

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\KFOmCnqEu92Fr1Mu4mxM[1].woff

MD5 bafb105baeb22d965c70fe52ba6b49d9
SHA1 934014cc9bbe5883542be756b3146c05844b254f
SHA256 1570f866bf6eae82041e407280894a86ad2b8b275e01908ae156914dc693a4ed
SHA512 85a91773b0283e3b2400c773527542228478cc1b9e8ad8ea62435d705e98702a40bedf26cb5b0900dd8fecc79f802b8c1839184e787d9416886dbc73dff22a64

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\KFOlCnqEu92Fr1MmSU5fBBc-[1].woff

MD5 a1471d1d6431c893582a5f6a250db3f9
SHA1 ff5673d89e6c2893d24c87bc9786c632290e150e
SHA256 3ab30e780c8b0bcc4998b838a5b30c3bfe28edead312906dc3c12271fae0699a
SHA512 37b9b97549fe24a9390ba540be065d7e5985e0fbfbe1636e894b224880e64203cb0dde1213ac72d44ebc65cdc4f78b80bd7b952ff9951a349f7704631b903c63

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\m=VXdfxd,fgib1c,YwHGTd,pxq3x[1].js

MD5 0212f84f9b3c279098932d83a43b6448
SHA1 22ef0e934187e4a4bb70bce5a59e7eed3e45e82b
SHA256 9dffee8e9e10ba5883b18f8f0803e06bcdd3751909cd3a2ad48195a33a4132c9
SHA512 846ab48914f0d202bea88b83a3c81772dcd4a1afa47d3641fc8be2649783441def213b18d1fa82e58e0a3b699592d2be8421c6adb02c0d7f679f615b378775b6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\m=p3hmRc,LvGhrf,RqjULd[1].js

MD5 70789832d7c37d2e3808ea243e5c09b7
SHA1 ca35882c7ff1a4533bdac7d65c6a619fac7c5563
SHA256 3c24d546d095e74dfb56fc59d17686fc3a78431081980cc463c532020ff9e4ec
SHA512 e6f107ffb6083dbf8d8d4570a1917ac03efc66940f6b8a11b322dd97dd61ef0a92e61add2b32a39be09c50f3379c64ebd3694a76fa189c58cd6f8fb33e982174

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\m=P6sQOc[1].js

MD5 7c38c8b41045db0374895078c4d449cc
SHA1 6bb0e9d5b4b827f231d03ecd227093f1c3535806
SHA256 0f36f27ab38a134278cb7570cf0fd52e7220f65002b0c972c655bfd40b70ef33
SHA512 75b4d73f6a5f678f3c0299d202c9010ef7de76fc928f0dc0476dabbf31f9cd1f377f099995629a6330dd5d61478c18e8e12818b79e671f79d34af3bbee07ee49

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\recaptcha__en[1].js

MD5 19ddac3be88eda2c8263c5d52fa7f6bd
SHA1 c81720778f57c56244c72ce6ef402bb4de5f9619
SHA256 b261530f05e272e18b5b5c86d860c4979c82b5b6c538e1643b3c94fc9ba76dd6
SHA512 393015b8c7f14d5d4bdb9cceed7cd1477a7db07bc7c40bae7d0a48a2adfa7d56f9d1c3e4ec05c92fde152e72ffa6b75d8bf724e1f63f9bc21421125667afb05c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5797781c22abcabc5f3e7ec009e36346
SHA1 920a3b769f393a668254a45714ff12355c987df7
SHA256 2dde52cf19e4c0fc1fc69a89708a3bd567b324488dff30841218b30ab84d59e5
SHA512 bd168f9581e8496eaefa8368128d682017fc2d4473cf4e50bb5bc85692db6c9b1d1645f7d2796eaa8ba11a1647fe7f2c65c5a4471834a90f28f9e75c024b89a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fe59e99e812513c971f0fbd19754959e
SHA1 952fd937df7fff0408c5f40c6683fdd05cc121d0
SHA256 b58f934df233b55e8abcdcc387ddd647edf679c7cc11d1aa910d92249b681041
SHA512 2167b8f9225a845da2bd335240f6a3bcee9ae51c692cb546707723da91442490fa6b98e12468ffe8b79cf998932cbb25f8a1f331a369e8f80da379281f34fdb1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 839d2b8f4780cc34da6d1e5ad9f113c0
SHA1 adb1c70f7e16d1a54d60dcae186ff09e0d70b72d
SHA256 2026ca86d53bc5a76507f4ec8d0366d9a69aea30d2ce18e9541d42f9bb3984fe
SHA512 a9bc3c9f82afb363f8bac6b25ab417075106e1e85348d765692a14a758b593b396ea42e5a9265b957f4e7693070b74a9feead708b5fdc90e19d6027118dddbce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8f6d6c0472c0fd97179ef8af3f46c1f5
SHA1 1999a8868bde183800e7899bd878d6869b0feaaa
SHA256 f80923c98d2add590ca183b11ace28cf4e5f3d8b9579c7af3c2214764f1faadd
SHA512 91e064a114fc80165eff57f50bfde80d780fc47d88f0d9b614f6a997b662af28ab0cb0e847aa093d1fadb936b6de98a5c0b5e68a6aae2b56dda3e7866cd7f749

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7a89f2728a92b235db47ef965b3eefc9
SHA1 18795e1ea3df59d6bbaf97932778266f81d91d51
SHA256 791dbbeb58a827bfb73d74473352d3fd163750a891aa4e464fbde623eedcdc28
SHA512 772da42641cbd9db5c5db38ca8ca7c9bce8694c74a8175e108a6476f44241e0d0ee10fd12aa6f7d4f09dd6505791983e6b83861f4df2803c0050738a5b46e481

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0110b9bed2becae1e597c8fefd4a2d05
SHA1 0a208e6ff6c79cea9862f7eddc7541256370bdb0
SHA256 daadc3b07ce4f4f665484e9ce2b91159187b7e5fe9b32b70be8ee0c99d17cc30
SHA512 ed11dfbc0553e5e312fecbb4fd2e1fbbe26ed65e0a335ea7a949760ecd7ba87b2b6c20a05a02bb686ba31e4cb4e9cccf1632d4c4c6e335672ee2d9aa25f4be73

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 88b1f305c686f2145a3672c096f779bb
SHA1 adc90df1dd2646ac50f317a5f07c8273d632a566
SHA256 89673d8f32871a91b13fec1f1d685ac115108992e0d6a84f558117326a535eb4
SHA512 c34ce99a93a76b201541d72a8c333a3f5ae44b27a1a3d1332f42883f557bf96a3f2590c952fc76e1683cadfa1678f29b2dda6431ea470a89bdbfc678eaab1836

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92e4d232b482d2f01c85df7551bf3ecf
SHA1 3118a9c213a8d960eadb4974a95338fbf42411e7
SHA256 27106dc3420accac7cf9e6c3607fe3f2df7820f2898a57aeb5054bd211a0dc74
SHA512 067953956ac71b8dd959133f819ea524d7b9a9d1a4dd06a81bcde33102d75cdee88887501ecd5857025d66ae0089f0d1268b4d872b32db425e650842e885ded8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6722af1f96da45a9686d76ea461433a
SHA1 1af1f94209d7e54d090493a5cd248408776b56a7
SHA256 01597aba13c43c68d249a3d62ef19c688afede5d58869e8a48e450f9b3dd0732
SHA512 0681b821af08e1bcdc11fd28fd3e60e5003a677fd50e5cafa9038b11093ad3834995b2e828f9ca509765af0f098907f9049df7ec07a45f3ac2154875d00971b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ffa143d3f483205e7cd894ace2e6d38
SHA1 d19858bacc3c90bae92458ba7f669c84004c0d82
SHA256 f5075d83b668a1be7a35d98b47b67f3c1697e90d57c030e220a94cb1a5f04ad3
SHA512 f2c7aa718f6f1aa5c438dc0c44a7266eb8f423e6f6bf1612466ac89f5aec994ccf64402598ddfb7abb3cad80128279e065b505dfc931e259ebf4cb48b8072a18

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 31a467f0717a49fe9ec8c9fff0a461c1
SHA1 ea884fcb5f49192eafacd0752eeeaf2fe0f8f526
SHA256 ca301b3ba04d48e9b174545c7e9399f01db10f6763f7af0a1654ed72a857ff0b
SHA512 e967a03e3cc5e312b6eaa304f611bdb4efd788fe1096e8a3c6b9ed818dea6b4fa239f3d898b4975521fa7e851d6b47279ea7593cccff84cb2e42c91341fe73a1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a499f47a9c00b0fbeaaf448242ce8a93
SHA1 bdf2f58942c16de9c721a3591a1810da25bf6eae
SHA256 ade85eb6a29720f2909bfcc43f4f041859c2e649c0ba4019354f01af57256083
SHA512 c79465c14353d6661612ad5cf931a8847f568d1052f9d25ee992b7fdf90b1cb0eb1e382b1aec749df5701f105a8f5a4b26e41a542f0a789e4891ab95ab5a1821

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 57ec1aa3b1e6778745c10dd65dc8d590
SHA1 28f10ccb78353593f2aeaa435455133dbe6e83ed
SHA256 33b705adddf172a5c1aef54a5fe46df9135e0eb76868cc589f416abcaa883d58
SHA512 fb62236937eb35f0e4077482a21d17e35413f000eb76ee457da4e77211cd0c7ec18ad587856468ccff31bafa695892750a5b7a51f1c0ea5142db552c1c0bd82e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 adcff88315ecc4fb276a68013ebe3112
SHA1 d4892b8deceec61ea49244837d69b43a7c5afce8
SHA256 86fc21615455e23671c2ca40fd5bcda1c302a025fdb59d509dae212a4aff1b14
SHA512 34bd91b2123846264e2f556619bf11bf903e6628dd79a2402ef96f82503e23af75d2fea4e6025d5d075fefa95f3b35596c83ecb6f681c6a1dd18690fb1eaba4a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 238a70e586aab904b925c94cde9011af
SHA1 759c9705fc82ce5ebc20ef378472616aa406c180
SHA256 a78e6908471562524644094c0de8bf4e3c926588ce12c719d4839c3c31c4a40d
SHA512 4833afc056285bb5b71371fc89b71bcf524b3b642711100c457e2058bc09818282cb6cd9c8b4356d133d350718200d9f0ce729da81b8761d05b7461b221cd553

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 90d0d66aaead1266a01444d9ef144b96
SHA1 294fc14036a4c05ef63fd034b637ee32d101a3aa
SHA256 010e76d6bd925cea4fcaf76147dad838d8cf8a79382f23fd0486c7bd6e8424a3
SHA512 422e637fa9ded3c076ba87fa59d9bb2c051b3aae3195e6ffc7862512f8f5ead7f6485e887b7658ed3c835f57d558baca7d520acaa64d8b9f34824bd354beab0d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b13ae35e93a1d90376885fc89b100f65
SHA1 4eae8eab361d5016eb68ad3688aa2e77c08d8fce
SHA256 bb93dd4c06e32619955dfc3f3db0b79116e03e3edab889b9446cf3f31278e57f
SHA512 23f3d6d0f969391368d897e540d6ab8ea7e9a7b2209d82cfacee8ad841fb9dae359eb446be1411ba5a8f683e2f9a8a0fb4a264b1175f8c9f6a8d536423b985d3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4765c1633734f31802904584aa85d650
SHA1 314a54ce70abf2638d20c30b97392a593cae09c1
SHA256 ffef42ce7ee1b9e9ed27a3c0c5244f75e145a63aacb55af72b95a2ffd3b70b08
SHA512 21b9af28715c9b86c084e0dacce656e324f95bc1e297f1235b8afdff49751c70ad3abf2b2e418b721f29cf82d7db54bf327d2a475bfffa2ce2e3395f081e4ae6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 5d242f694b4ebfbe60a85f37b96a5b10
SHA1 f8dc8c7328ed77d220935625dd59e0faaf8c749f
SHA256 042fd928d76e201f03d4c837c140793905584975d9f374e3dd75c557be64fce4
SHA512 b0d61c2abd9ba106504cdb7faff1e0191c9a9619dd0d99673c714c43fecae7d657b4e6c97178186578cc6c39d6cde32f8ab0bca4c92b8873ed3dc11a02b1cd06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eeda9d1dfdbdc98e1c0803d01a33f33a
SHA1 22017d5de524919808f73a43943df3357f3bb4ac
SHA256 7d5b673c2b2a75f118bb48ffc7b568177e0af9578a877f44092b727f22a99f3c
SHA512 b05b932860daeb68231a5bdb13cf098e81e835610403405d946a9c4b3c4b5224fa9f9139c0b592677c84da68184b709b020f0ea09fce2fb882c27b1734b34d78

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f20c686691c47738f82323d15239ad8
SHA1 7d13021d7fd45cd6560989bc7e6f6a522d72b56e
SHA256 7da099c73888b28f24197be80cdcad93f5f79bcf2e6b9e78d0c3e556a0ba5851
SHA512 2e146e3e8cf055c2c9bb9a13e0a358066953d4cd1ea3a0d91c00e08e6092e2f0aca473b52fd8ba70cb944f5b2ca7cd32f3288af61eab8ad6e3b5b1bd8fe5b8cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 de86d1c7154cebc8e80eaec5feff9933
SHA1 98da39c52fdd34662f5be1fb56193dff771a3f7b
SHA256 1f336b50605120b6bded2c942b9c4b58c0c8398a2fbba8b1fcc52c9cc984921a
SHA512 cd445b0d9e695ae5bbead213bab43f5f7289caf5025db88a2f5e887067811c4270c9635c3980ba84d789eb6dd1764889f936081f3d1624f0a146a32348aedfd9