Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 14:18 UTC
Static task
static1
Behavioral task
behavioral1
Sample
397ac5e45fed842bd346c04d5d4b92eb_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
397ac5e45fed842bd346c04d5d4b92eb_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
397ac5e45fed842bd346c04d5d4b92eb_JaffaCakes118.html
-
Size
122KB
-
MD5
397ac5e45fed842bd346c04d5d4b92eb
-
SHA1
efc6564b2528d1cb8192f8c87fff5bbbd4ed136a
-
SHA256
14be0528b532d42591aeb4f398f5b900325af81c485d5b80689dc9c8131497a1
-
SHA512
c0e05bd27dfc2691dd201a81943b2951ce8184c7976a5f4999cca9943c5a49275cf60b9d692ef11fb822a49679e928a3ad29cb696dbb476fc11639e2a9d4a462
-
SSDEEP
1536:G9DMLJjN/AdWvTnhjDf2/aAOga5cZeuzBLzAxhQEGix8mBfzB25xkZsX57Y+NeLM:G6AdOgVKozWkvwIH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426869367" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000078bd86a5a66b03f44915118ed2837315cbf96dbdf9334d5559a002bff397ba74000000000e80000000020000200000003e6077aae41cb1951ff44c6a26f9a2a6e312f075fb9037d04109bff650f5e914200000004cca1e3a499b35a5c1e309836edd96bc8d7259b410b32e7d3e592ce1fa312a9740000000548b725ead3fd58b4e8ac0a393f96f2e3ca06aa15c48815d32d76af92f36cb8659548ba789845787f0796f3d7e6b041a194125ca254dca60d8377a70983aa3ec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C22C811-3F90-11EF-932D-5E6560CBCC6E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5033475b9dd3da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000009c00596481589e655a8827d43fcedf7631032df5f14194351a7ccf42ab664fa2000000000e8000000002000020000000d2861ec608ae5dd7029f927eabd981774ecf41a3bb09a81ef14332db71bf0df390000000db4af07ef19bb4a6680407b0e81b7fec6257abd05739c4f516ed43a503f2cf587867faeea3f3c80f58767789bcd9b4f86fffeea4382df768ec3683bcb25a8dab0124067cac736887b292a1df50fad2247ff6d75f6750f19e347166e90a19550931d25770a54505a653500314511ca3e67354816b62d6ddff6912f46a4bf225a5f905f809fae7bcde971d19fdc627d515400000009c5a8467341653a0adc7a50cd690bd598e68ec130fe8baea55f461bc9bb9c0ace84010fed8bf1b5d6c54fb1d82c84ea52bd3460d394092d284518833fdaded3d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2276 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2276 iexplore.exe 2276 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2776 2276 iexplore.exe 31 PID 2276 wrote to memory of 2776 2276 iexplore.exe 31 PID 2276 wrote to memory of 2776 2276 iexplore.exe 31 PID 2276 wrote to memory of 2776 2276 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\397ac5e45fed842bd346c04d5d4b92eb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
-
Remote address:8.8.8.8:53Requestwww.e-marketing.info.plIN AResponse
-
Remote address:8.8.8.8:53Requestserver.livechatinc.netIN AResponseserver.livechatinc.netIN A108.168.142.216
-
Remote address:216.58.201.98:80RequestGET /pagead/show_ads.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Vary: Accept-Encoding
Date: Thu, 11 Jul 2024 14:18:24 GMT
Expires: Thu, 11 Jul 2024 14:18:24 GMT
Cache-Control: private, max-age=3600
Content-Type: text/javascript; charset=UTF-8
ETag: 2477595516990879164
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 16011
X-XSS-Protection: 0
-
Remote address:8.8.8.8:53Requestc.pki.googIN AResponsec.pki.googIN CNAMEpki-goog.l.google.compki-goog.l.google.comIN A172.217.169.67
-
Remote address:172.217.169.67:80RequestGET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: c.pki.goog
ResponseHTTP/1.1 200 OK
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 11 Jul 2024 13:30:49 GMT
Expires: Thu, 11 Jul 2024 14:20:49 GMT
Cache-Control: public, max-age=3000
Last-Modified: Wed, 01 Nov 2023 07:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
Age: 2855
-
Remote address:8.8.8.8:53Requesto.pki.googIN AResponseo.pki.googIN CNAMEpki-goog.l.google.compki-goog.l.google.comIN A172.217.169.67
-
GEThttp://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEF8VuaW0eNbgEvZC4RcercE%3DIEXPLORE.EXERemote address:172.217.169.67:80RequestGET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEF8VuaW0eNbgEvZC4RcercE%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog
ResponseHTTP/1.1 200 OK
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Thu, 11 Jul 2024 14:12:10 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 374
-
GEThttp://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3DIEXPLORE.EXERemote address:172.217.169.67:80RequestGET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog
ResponseHTTP/1.1 200 OK
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Thu, 11 Jul 2024 13:37:56 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2470
-
Remote address:8.8.8.8:53Requesttpc.googlesyndication.comIN AResponsetpc.googlesyndication.comIN A142.250.178.1
-
Remote address:142.250.178.1:443RequestGET /sodar/sodar2.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: tpc.googlesyndication.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="adspam-signals-scs"
Report-To: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
Date: Thu, 11 Jul 2024 14:19:06 GMT
Expires: Thu, 11 Jul 2024 14:19:06 GMT
Cache-Control: private, max-age=3000
ETag: "1637097310169751"
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
-
Remote address:142.250.178.1:443RequestGET /sodar/sodar2/225/runner.html HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: tpc.googlesyndication.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="adspam-signals-scs"
Report-To: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
Content-Length: 5046
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Mon, 08 Jul 2024 10:08:22 GMT
Expires: Tue, 08 Jul 2025 10:08:22 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Mon, 21 Jun 2021 20:47:05 GMT
Content-Type: text/html
Vary: Accept-Encoding
Age: 274244
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
-
Remote address:8.8.8.8:53Requesto.pki.googIN AResponseo.pki.googIN CNAMEpki-goog.l.google.compki-goog.l.google.comIN A172.217.169.67
-
GEThttp://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3DIEXPLORE.EXERemote address:172.217.169.67:80RequestGET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog
ResponseHTTP/1.1 200 OK
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Thu, 11 Jul 2024 13:37:56 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2470
-
876 B 17.2kB 13 16
HTTP Request
GET http://pagead2.googlesyndication.com/pagead/show_ads.jsHTTP Response
200 -
190 B 92 B 4 2
-
152 B 3
-
152 B 3
-
348 B 1.7kB 5 4
HTTP Request
GET http://c.pki.goog/r/r1.crlHTTP Response
200 -
172.217.169.67:80http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3DhttpIEXPLORE.EXE842 B 3.1kB 8 6
HTTP Request
GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEF8VuaW0eNbgEvZC4RcercE%3DHTTP Response
200HTTP Request
GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3DHTTP Response
200 -
152 B 3
-
152 B 3
-
710 B 4.5kB 9 8
-
142.250.178.1:443https://tpc.googlesyndication.com/sodar/sodar2/225/runner.htmltls, httpIEXPLORE.EXE1.6kB 18.2kB 16 21
HTTP Request
GET https://tpc.googlesyndication.com/sodar/sodar2.jsHTTP Response
200HTTP Request
GET https://tpc.googlesyndication.com/sodar/sodar2/225/runner.htmlHTTP Response
200 -
172.217.169.67:80http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3DhttpIEXPLORE.EXE470 B 1.6kB 5 4
HTTP Request
GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3DHTTP Response
200 -
747 B 7.7kB 9 12
-
747 B 7.7kB 9 12
-
831 B 7.8kB 10 13
-
69 B 126 B 1 1
DNS Request
www.e-marketing.info.pl
-
68 B 84 B 1 1
DNS Request
server.livechatinc.net
DNS Response
108.168.142.216
-
56 B 107 B 1 1
DNS Request
c.pki.goog
DNS Response
172.217.169.67
-
56 B 107 B 1 1
DNS Request
o.pki.goog
DNS Response
172.217.169.67
-
71 B 87 B 1 1
DNS Request
tpc.googlesyndication.com
DNS Response
142.250.178.1
-
56 B 107 B 1 1
DNS Request
o.pki.goog
DNS Response
172.217.169.67
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534e1f6cb5f8f3d2226e124f0c8d186f0
SHA188ceec3fae7712ac82c52786b24c99da5ccc550f
SHA256bf830a276be57198a4c6e0f4e011eaf1218411fc1f0bde4cc77f6625a8888a20
SHA5121ae3539c9545b3a0be6b32eb2e4bf18d33d6a3d89a1713243e989e0be36fdebcbe9b68fb8c22986d75ce0cca83e47c7d9181362fd35c24974c95c66ce3598cb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d589e7b863409539f9c7b6d626a23428
SHA106630b96468519a1ef4522bb39f5fff0bed68b67
SHA256f64349f9ff38c340b9ad5e0e7afb66d840c0686ffde2de9ed067b9615005fb93
SHA512e2b57da74f60227380493ef2d941a28bf0b09bc2da400a6385424f0e69a5a89ad191d60f8bc144c1d304d18d75829655a74e083f5e7b3aeb9b8f22dc34ff7374
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebfbe4fd1cbd500be03b4292a113be91
SHA1194e1a6cb4c5e235b916f90a3f9678b35ae1efd2
SHA2568d5d7aa0514146d7a18dacbb1e15bff8f6930e15b5d97435d48c305352a9a836
SHA5122f6dbf6f37cb0456967158d21611f9d6378b93f1ba2e25fa383fb3ec04b180bc9a4b4861f24cf9eb583fe74575b8d51cb9cbe1f6013f418014f96a237b892e36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578ad0824f4197b346fee2d3e1141973a
SHA1c30d6ac87f346f9c0dc55257121002a183451b28
SHA2563536afccfd10ea5cc7327f57c79ceb584274b7a37d29f9737ed6cdcfc9bdfb77
SHA512dfc6ae92f060e70135201ff3247dee3227b8b91cf577b9d1f48e7c90526c1634d22e89e38c7e389c2874b8e3862851f989b6351e7a7abe7ff33cb486e1550f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0b2c18fb7ab97969557894696aa8471
SHA18ed589d86edacd35b45123314147ea3141e8de54
SHA2563ee7f9040f06b26710e309879fe46496a38960421c3646a6ef9a39a5146c6974
SHA512815913e47b045b1623c279580600c44ae7e2ec347b5f82ffcd1caf096f290e3d395c784561d65df7bc763dbc3ec55aa2197ce60e7c21fc1c46b182b603ffdd82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a582fdb8187fc8b9ef46ecb45c9e997
SHA1d2c61f97219da17827e12f6a59d6fd7ecbc0e864
SHA2565342ec52cf4cc6a8228e75bc56c496e5975035ddd923fffdcbcddf4ee74df681
SHA512cc6c526923d425cf218809e2126798dcd23482d2b753ccde1a1d1f8d378ff711fa3451e79261af1686cec35deb9910988646747b4c1a96f69fc8ccbb58410a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54da9bb8e30d9115a356c1320a93e0f80
SHA103428a639d8ae531c49140db5f5abfe83e44ab6d
SHA25685adffd1419b7c9e1d1e17e98130a0e2db52291f443d32c48531f09f946689b1
SHA512693558e727be5310f2c5da603050c87d772997dd38835cf19c1c39a8d6e991876c59aa57ceb737edfefedd2344150237fb57d3c040bef3a633ed92ab4581dab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57aa761145dcd8d1cc0399048fbbee7e3
SHA1141cfbfc0a9e93d276b0b4f4fd80e4d04a3714d8
SHA256f1d87eced600d42ad887ef19620560f443092de25837f546ae1c54cff54eb7de
SHA5122707cc86a3b98997a60bef798ac1f5834268e969e22dd06b914425c4815cafc2bb6439426ae5fe4d61c2549d8e335a2c7a99599ce4f7b2daaf8053f4961ca860
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56db8356f2cc734f820871ea4e5b42bb4
SHA127fcf3797f915eb3bc023c8956af2a15e05a699d
SHA2562a4f800e031ddef3268d46e4864fb795e8e091b327a914180ee35b4d1f0edd6c
SHA512dd83136d05507410ed2b43d6a6d3c0e5623ac6470fe7211f800122c52ec966a763ddbe25b6264b66ef394725128049657cfe22a651b411b55b3a7baad653fd9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc48857d38d14ca054af842b31298af1
SHA15409b3e9a36728102566fa10ffd4b0b362114264
SHA2564af3371da53d8854dc995c149b42aaad7e811f0161f8c37a000a641194e6ba6f
SHA512ea6df5db3e1b7402f58fc70a9029ebbe1a5cd81b757de9f991cb9c25ed47161c826dbe8f917d838e0ad1e6882ef7fe84bfd39379c3f3a08882015efe27c51771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53533467b127ce4b4cd5f76a2d934c363
SHA1c9bde246c238444afb656aa6ed474999f743e435
SHA256a98534e0a17bc1770d63acf3e2c2e0b147bc44c6753da12d49ceb0a3d271fdd8
SHA51239647da88db30e2375d66b7c20b5b7493a601b51277a9a54f994d98b470c2a59566c565d13b69dcdacebdf2d2b45282120cf8da4f3dad55f85b4d0d4bccb985f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dfdc79345c60f31343c674656fbf091
SHA1bca3772410b9d9a125cb4fa3a577ab0d5dcb2494
SHA2568069026723cdb852829fcb68918c483fb32663156977e4f0c5f9a73cb0014dcd
SHA512f76e3f1a3a703b2d44021799e5ad93017b0d0a6e2765c14b58f1e127664f90394c771acf7dbc71b068f235a6cec0c2c64fd53c3f7ac26ecb221cfbfb3a8223cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5299382ca6f52c88a8dcd330a3c610f5a
SHA1d605f7a9e8b0719c0298752ddd9563d8224078b9
SHA256d94dd174150722055bd88fdeb48d4b53ad4a574945bd0954907bee717cad9c53
SHA5120917d79f93d42c4a69f82c8cc27e5def0a2e4216ac05b67fb5d71de595e65f114dca65cc276a2d750692533510e49a8a9269f51b188a07c61943939e1487c3be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edfe21e2d1a81dee264853e6bb382bf4
SHA105c30a266caeb6249970d5351c8ef499f65538a7
SHA2567b78e369c0ed5f2b26a63a41d14a1689257574522633126a670bc289cbfc7d79
SHA5127f1419024f16e70a8df3fdc01a859a4a3477207ae6896698d7bf2d1460ba9a48fb898cc66c2f078900e6ae40cda33184faab9512f1576bba9c150600b0113689
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59770d7dbc0ac7b274f2c4790a9aa9dda
SHA1791eb2ecf122a707b13c9dc84aad02f5026e7239
SHA256f1b62bcd40a7f55072c165c95da2cbf3b43c6367c659542c5913102c3e6b3dbc
SHA51253b4fff8f079fd27e9bc2e74f3bea37aafbdfa299eb493d1e6fac4ad03eb00a63629a0fc6c1ef383f9421378b5efe1bc961accfb7fb1583dba9fd7a5a4454aec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ebe2075030171df6e4c10b67e62c504
SHA16babbb986f30a1fb10170ebbc1f8d971daa43edc
SHA2564cbf410f6e51138f58db7030e8b73ce79609630cc6c43f984d12eab81761e679
SHA51264c3e71cb89f77bc012410ee442ddf1b9c99837d9f43d4c3df2f220ba985c07e0d72c7f08c94d00694c6294896471f8e0eeb44a255c9adef514938aa57a98242
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579f1491eaf7cf5966e031e3959435657
SHA1b589c9727a18b97723fd577cba2ccab8e5616167
SHA2569e3f7e0d3bcd5cff16cd282cba8f120d2c0cb8b134e05075d7504fe91de9154a
SHA512333fe6a499def276129bf94857059fbcc47fcf1cbf7a3926c2f0406f1eaf0795d3af77aa96bab165172000d7b4b39e06104d83c57dfa6ce67579ad2be7c36f8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54221c44fe3d0fb281bbf670ec32a3920
SHA1d2681d7baf0935d0a73e57a5023d8724b8f66713
SHA25685b10023710b6b1b8c1bd3f1a48c60c9428baf0eb71fe858087d3486ade132c0
SHA5121ae1bed3aaf529ba408bcc96056e3591ed4ac07186b72d2b11428cd70f8023c2877bdb44bb405b5fe22109e6df1a4a99aa34e214d3b1adc48c14ebc9f21f052a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5febfcbba1ea4e9e45bfab067b7c6426d
SHA15440d12adbfe42f67bccc1a8cd347ceeb62094a1
SHA256d69cada1db17894081492f98371c09d055d3baeb45334f371bacbc5b31511567
SHA51288f909b91918222f491242778f8cc79ac3f2d75b207a5545905d82f33a9d6a146fa1ac20715d184decd99a93da5d6ffdf53f4613d717672e03bbf8ac72a5e21e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c5705b76b4eff5a0e79cd42f89dff97
SHA1950c517f83cdebd6591bb3ca84a975042d07ba23
SHA2568263e7a6fdf29ca8c3178940a392ba3c723a6bac87c14f3d6a6accb7f7453dd7
SHA512095517698f2d9ba230cfe814af4bf6caa98f8a0820887967b8f7a7e3515e369d52cc72204e65b42903bcfbcff29265702f38db0eeb9123154a35d279efd148c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5263040ef83e1403d1ae63df771b729a2
SHA14c58f4ca584731c0f49f80dc22744adbb2a67f21
SHA256150156995c341391575337e937059850daf6e2d06071173d973169ae6104d395
SHA5128c30060ea5e383d4f1c6bc62415fd0a431813fe79b751a5e3c8d9a9cd3d3610f311c8ee561f2edfb7c9c9882e47eda82d6f2830e162879b9ed48789f23282284
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\f[1].txt
Filesize40KB
MD5f951df76605d85885456d04136cec221
SHA155db353333292943a6fbe6e448dabf8a2668d117
SHA25683fcf8be13dbd064499cad20cc63fcf059687526e11e27bbe0cfd4a17e06bb8f
SHA5120997fc12fef60e682daaec1526671725f3cfc62d8e10c5c3fa860e1a275d83244d403c16aace45cef7d8147401e6a015f1b0c0e5c91038e4e2ec5d059b65cae3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b