Malware Analysis Report

2025-01-18 00:13

Sample ID 240613-qy67xsvgpk
Target a5d6935c195f05e9cda742575c4d21d1_JaffaCakes118
SHA256 a13dd63e4ad6cf9a4fccd6e16bdacf8ac4e7caa07050cee14ca99540fefe30ef
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

a13dd63e4ad6cf9a4fccd6e16bdacf8ac4e7caa07050cee14ca99540fefe30ef

Threat Level: No (potentially) malicious behavior was detected

The file a5d6935c195f05e9cda742575c4d21d1_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 13:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 13:41

Reported

2024-06-13 13:43

Platform

win7-20240611-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5d6935c195f05e9cda742575c4d21d1_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AEB6331-298A-11EF-8875-5E4DB530A215} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424447943" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a5d6935c195f05e9cda742575c4d21d1_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 img1.jiehun.cn udp
US 8.8.8.8:53 t.cn udp
US 8.8.8.8:53 www.googleadsl.com udp
CN 39.105.18.168:80 t.cn tcp
CN 39.105.18.168:80 t.cn tcp
US 170.178.222.41:80 www.googleadsl.com tcp
US 170.178.222.41:80 www.googleadsl.com tcp
CN 182.106.158.35:80 img1.jiehun.cn tcp
CN 182.106.158.35:80 img1.jiehun.cn tcp
CN 182.106.158.35:80 img1.jiehun.cn tcp
CN 39.105.18.168:80 t.cn tcp
CN 39.105.18.168:80 t.cn tcp
US 170.178.222.41:80 www.googleadsl.com tcp
CN 121.14.135.35:80 img1.jiehun.cn tcp
CN 121.14.135.35:80 img1.jiehun.cn tcp
CN 121.14.135.35:80 img1.jiehun.cn tcp
US 8.8.8.8:53 hm.baidu.com udp
CN 121.14.135.35:80 img1.jiehun.cn tcp
US 8.8.8.8:53 www.jiehun.cn udp
CN 61.160.251.208:80 www.jiehun.cn tcp
CN 61.160.251.208:80 www.jiehun.cn tcp
CN 121.14.135.35:80 img1.jiehun.cn tcp
CN 183.61.177.35:80 img1.jiehun.cn tcp
CN 183.61.177.35:80 img1.jiehun.cn tcp
CN 111.45.11.83:80 hm.baidu.com tcp
CN 111.45.11.83:80 hm.baidu.com tcp
CN 183.61.177.35:80 img1.jiehun.cn tcp
CN 183.61.177.35:80 img1.jiehun.cn tcp
CN 183.61.177.35:80 img1.jiehun.cn tcp
CN 61.160.251.208:80 www.jiehun.cn tcp
CN 113.142.207.35:80 img1.jiehun.cn tcp
CN 183.240.98.228:80 hm.baidu.com tcp
CN 113.142.207.35:80 img1.jiehun.cn tcp
CN 113.142.207.35:80 img1.jiehun.cn tcp
CN 183.240.98.228:80 hm.baidu.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
CN 113.142.207.35:80 img1.jiehun.cn tcp
CN 113.142.207.35:80 img1.jiehun.cn tcp
CN 125.74.42.35:80 img1.jiehun.cn tcp
CN 125.74.42.35:80 img1.jiehun.cn tcp
CN 111.45.3.198:80 hm.baidu.com tcp
CN 111.45.3.198:80 hm.baidu.com tcp
CN 125.74.42.35:80 img1.jiehun.cn tcp
CN 125.74.42.35:80 img1.jiehun.cn tcp
CN 125.74.42.35:80 img1.jiehun.cn tcp
CN 14.215.183.79:80 hm.baidu.com tcp
CN 14.215.183.79:80 hm.baidu.com tcp
CN 182.140.225.35:80 img1.jiehun.cn tcp
CN 182.140.225.35:80 img1.jiehun.cn tcp
CN 14.215.182.140:80 hm.baidu.com tcp
CN 14.215.182.140:80 hm.baidu.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab1758.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1818.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 86fc8d3615ff54361bca996e54655536
SHA1 4cf46d22999894becc3f2df0ea8bec0d9fbee865
SHA256 5073163391cdcf362e7a1ea425c929d9e076e31d743895b92996669f92ed07f9
SHA512 37fe7c6110886b61c75afa7c1cfc0316dbd8e47a481d2dd6eb2f6d350d94c51ae12236dc0243bcf02854681d4be69b0aec66a3ac42e0037b598c7c83a1b1d635

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 42f77748ac04edfe36934c2c7275aca5
SHA1 4f155f9f22de3b7cec76d5d3a4b4529b09f17236
SHA256 ede5ab43a2d1623f33f5bfde23c1e6764728b85c28f7bab07f3c60f93cce7477
SHA512 2755b0c1d9753557668542b38a75ae7d848cfaec00d026cd63fb78a023471b6971eb2ceb8d91824248b37393d020178d0ea5f395c1f820dfb2c9964948f523fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca164e80fb86ae56456f3893d7cdfd32
SHA1 fc0914a78603b054cacafd9853dafccf147e992d
SHA256 2110126b4d55e6e082b84187646d38fad20eb22c416ee40396b51e6b193c2a45
SHA512 4f013ea71e7ff44c3e43a4adfff3b028e815548c2e0c82c6d84c0a41feffc7d87ad908b896e6325d0cf79b3998773ec770264cad6dc81e7587975bb6bd039922

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ebb11c7d1bff33ef9cb83422414bad3e
SHA1 36f9aaaa0c11075a0f8a8cb3b4ca090b530a5b75
SHA256 c41d31ef43e2a53966f16efbe0c6123004b2b3f0d8fcf8bece1fef55a9a3ff34
SHA512 7f3adf493a6d4d709d0fbc707681e821a26846a4c3b269c3f2b9bd08bb5c87bcd87d884a081be53ed6fca78e5d35e097ddd3b058490b0134ef7cee49d0be2dc2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ad276afeb17e9948f09a92fedfadb6d
SHA1 7da2993b763c68a89047509798c412c0026d42da
SHA256 f4af32a6826687994524b8034b1f7a5b5ff4acb8fd6e2ef966d728e5ddcf9126
SHA512 2ff09c57c26fa49bc1c676c48c29082bae26916103161e18fa83de35fd08d48e0f2f3b0e3046537be028ef36a841a63ecb878abaff378c4a297f8b14d1ee5832

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d43983f337aad637057fa2572976371e
SHA1 7176b07f6d715653eef26bcf5a19d68e96a5bd6c
SHA256 ef2bba684d1aee84cfbe1d4e3af574396227de300fd31aa1e85793ec9b71b101
SHA512 d15d710b809fdf0986a2e27ecebbefa45682864f4ac3993a2327fd41aa8ecaf6f615f054d0c26a166804ee28897978e2c86f48e9011c3aa1039a122f6002ed27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc8226f26508ad9a0960ac04081172ce
SHA1 bc384ced48159fb1cd1fcac7abb7554ddb9b53a6
SHA256 96272efbfc7f9af404f7c9c0deaadb27f007ae5b4c9f7fc175d656116a8a2cfd
SHA512 b6f8222b31824de36b9fede423b37ea03a153e0828e21c331d8367cdc6e890583e38933ed413ca8d226cd669292ad39e2c8804744cde0851e92e782377b1a5c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8afbbba2846d9a34b8e754094f1ddef2
SHA1 19180f8acb0d331ffdcda715bb57515d2c8c0f29
SHA256 d34d00732509f63579092a20c925df5492801b083a4dd7fa72b06fdb33eed14d
SHA512 10200d064ca563ec777b9b5b0dfcba51fd1b628f5d119f0c4ad2c641a74a41528cb20a6b9d5e8f5130bcdab22522e4eb2b3f709ece4d353b7c91a6606e697b9f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c0dcf931db94f2a7ce0253a8f9a7cb3c
SHA1 9a6b44d145cd0701325e2e782781b5ee809d8fa8
SHA256 13b602a2c1e9d82c80472df3f4518e96e1dc25af97ee05f2355d89fd1d1f1606
SHA512 962bd5f28e1291372b000b0005ba8f1d9d9f7e3387d652525b2e8daca6ff6c761671d48290af56f9a1c1de846748e446298f709683cf762b0199673b220fedad

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:41

Reported

2024-06-13 13:43

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5d6935c195f05e9cda742575c4d21d1_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5d6935c195f05e9cda742575c4d21d1_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4480,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4952,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4696,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5428,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5424,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5440,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5664,i,1305347165619645738,15927664461101562802,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.9.158:443 business.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 t.cn udp
US 8.8.8.8:53 t.cn udp
US 8.8.8.8:53 img1.jiehun.cn udp
US 8.8.8.8:53 img1.jiehun.cn udp
US 8.8.8.8:53 www.googleadsl.com udp
US 8.8.8.8:53 www.googleadsl.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
CN 39.105.18.168:80 t.cn tcp
SE 23.34.233.128:443 www.microsoft.com tcp
CN 39.105.18.168:80 t.cn tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
SE 184.31.15.40:443 bzib.nelreports.net tcp
US 170.178.222.41:80 www.googleadsl.com tcp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
US 170.178.222.41:80 www.googleadsl.com tcp
CN 120.41.32.35:80 img1.jiehun.cn tcp
CN 120.41.32.35:80 img1.jiehun.cn tcp
CN 120.41.32.35:80 img1.jiehun.cn tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 158.9.107.13.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 128.233.34.23.in-addr.arpa udp
US 8.8.8.8:53 188.108.11.51.in-addr.arpa udp
US 8.8.8.8:53 40.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 56.104.245.94.in-addr.arpa udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
BE 88.221.83.251:443 www.bing.com udp
US 8.8.8.8:53 251.83.221.88.in-addr.arpa udp
CN 120.41.32.35:80 img1.jiehun.cn tcp
CN 120.41.32.35:80 img1.jiehun.cn tcp
CN 120.41.32.35:80 img1.jiehun.cn tcp
US 8.8.8.8:53 hm.baidu.com udp
US 8.8.8.8:53 hm.baidu.com udp
US 8.8.8.8:53 www.jiehun.cn udp
US 8.8.8.8:53 www.jiehun.cn udp
CN 61.160.251.208:80 www.jiehun.cn tcp
CN 111.174.9.35:80 img1.jiehun.cn tcp
CN 111.174.9.35:80 img1.jiehun.cn tcp
CN 111.174.9.35:80 img1.jiehun.cn tcp
CN 61.160.251.208:80 www.jiehun.cn tcp
CN 183.240.98.228:80 hm.baidu.com tcp
CN 183.240.98.228:80 hm.baidu.com tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
CN 111.174.9.35:80 img1.jiehun.cn tcp
CN 111.174.9.35:80 img1.jiehun.cn tcp
CN 111.174.9.35:80 img1.jiehun.cn tcp
CN 111.225.213.35:80 img1.jiehun.cn tcp
CN 111.225.213.35:80 img1.jiehun.cn tcp
CN 111.225.213.35:80 img1.jiehun.cn tcp
CN 14.215.182.140:80 hm.baidu.com tcp
CN 14.215.182.140:80 hm.baidu.com tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
CN 111.225.213.35:80 img1.jiehun.cn tcp
CN 111.225.213.35:80 img1.jiehun.cn tcp
CN 111.225.213.35:80 img1.jiehun.cn tcp
CN 113.219.142.35:80 img1.jiehun.cn tcp
CN 113.219.142.35:80 img1.jiehun.cn tcp
CN 113.219.142.35:80 img1.jiehun.cn tcp
CN 14.215.183.79:80 hm.baidu.com tcp
CN 14.215.183.79:80 hm.baidu.com tcp
BE 88.221.83.251:443 www.bing.com tcp
CN 113.219.142.35:80 img1.jiehun.cn tcp
CN 113.219.142.35:80 img1.jiehun.cn tcp
CN 113.219.142.35:80 img1.jiehun.cn tcp
CN 113.219.161.35:80 img1.jiehun.cn tcp
CN 113.219.161.35:80 img1.jiehun.cn tcp
CN 113.219.161.35:80 img1.jiehun.cn tcp
CN 111.45.3.198:80 hm.baidu.com tcp
CN 111.45.3.198:80 hm.baidu.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
CN 113.219.161.35:80 img1.jiehun.cn tcp
CN 113.219.161.35:80 img1.jiehun.cn tcp
CN 113.219.161.35:80 img1.jiehun.cn tcp
CN 114.232.92.35:80 img1.jiehun.cn tcp
CN 114.232.92.35:80 img1.jiehun.cn tcp
CN 114.232.92.35:80 img1.jiehun.cn tcp
CN 111.45.11.83:80 hm.baidu.com tcp
CN 111.45.11.83:80 hm.baidu.com tcp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp
CN 114.232.92.35:80 img1.jiehun.cn tcp
CN 114.232.92.35:80 img1.jiehun.cn tcp
CN 114.232.92.35:80 img1.jiehun.cn tcp
CN 117.68.52.35:80 img1.jiehun.cn tcp
CN 117.68.52.35:80 img1.jiehun.cn tcp
CN 117.68.52.35:80 img1.jiehun.cn tcp
CN 117.68.52.35:80 img1.jiehun.cn tcp
CN 117.68.52.35:80 img1.jiehun.cn tcp
CN 117.68.52.35:80 img1.jiehun.cn tcp
CN 118.180.40.35:80 img1.jiehun.cn tcp
CN 118.180.40.35:80 img1.jiehun.cn tcp
CN 118.180.40.35:80 img1.jiehun.cn tcp

Files

N/A