Malware Analysis Report

2025-08-05 23:32

Sample ID 250119-x95a2asrck
Target JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09
SHA256 17612a5d50b77aaf43c282c8fbc67254f93f20a9b1290f16449a088541964116
Tags
upx discovery spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

17612a5d50b77aaf43c282c8fbc67254f93f20a9b1290f16449a088541964116

Threat Level: Shows suspicious behavior

The file JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx discovery spyware stealer

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Program crash

Browser Information Discovery

NSIS installer

Modifies Internet Explorer start page

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-19 19:34

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Toolbar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E}\DisplayName = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E}\DisplayName = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{C47F73BF-F3C5-40AF-B346-A80D1567802E}" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E} C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E} C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E}\URL = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{C47F73BF-F3C5-40AF-B346-A80D1567802E}" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E}\URL = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\SearchScopes C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 636 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 636 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 636 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 636 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 636 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 3120 wrote to memory of 1580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3508 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp
PID 3508 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp
PID 3508 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 1132 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3120 wrote to memory of 2040 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pf.toggle.com/s/3/6/36532-91420-gom-player.exe

C:\Users\Admin\AppData\Local\Temp\Toolbar.exe

"C:\Users\Admin\AppData\Local\Temp\Toolbar.exe" /s -silent -DefaultSearch=FALSE -StartPage=FALSE

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffc5e8246f8,0x7ffc5e824708,0x7ffc5e824718

C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp

C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp /s -silent -DefaultSearch=FALSE -StartPage=FALSE 4736 C:\Users\Admin\AppData\Local\Temp\Toolbar.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 204.27.101.95.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 pf.toggle.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 redirector.conduit-services.com udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 79.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 pf.toggle.com udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 redirector.conduit-services.com udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 8.8.8.8:53 pf.toggle.com udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 pf.toggle.com udp

Files

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\LangDLL.dll

MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\UAC.dll

MD5 09caf01bc8d88eeb733abc161acff659
SHA1 b8c2126d641f88628c632dd2259686da3776a6da
SHA256 3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
SHA512 ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\ioSpecial.ini

MD5 7dfae2258718e7cbdf445254c01893b1
SHA1 e7828b7df42564239b8e60203f8bc2031438f850
SHA256 fdad2b510be9a153307a39289f9c1d142cbd8268fe5870bc1fedf543f2005158
SHA512 d3fcef4526279e634909c0e55002756f640e05d6123e08d53ba8ba21f7116d1011e7c094d4b8bf168358d188c1b82afc21b4626fbc13cb8d1a2fbf21571bc716

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\InstallOptions.dll

MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\ioSpecial.ini

MD5 2e8c995f1214eb49ff6554022d10110a
SHA1 5eba54723c28a8966f8e9f36254c10feaf87c43b
SHA256 2acd68059bb28a7c3808176bddc46a2ab551ff080984ea25689afd80d9a4bf83
SHA512 b44f5628eea5ec4e312842069dbd905b7dc3b82f01fa756b157ca319b108e706990b644ffefd7f123e9dea44625b85375d6fdae045ab96df4ff66608b4bf5ce4

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\pantallatoolbar

MD5 306f288588b1550eac1d1adec12e96c4
SHA1 c18b667ecdba0b0777621a4c0d8185268872ca30
SHA256 0a4b338064a08a2bcd13992e754856ea9044a6880fd673e725cddd3744ab787b
SHA512 62d970f811ba93056e83f23eae1220c89b8b95548d3855491c0c6badf7e5e84553c2144eb3c8f75ced038869d0bfeebfc7ce9f14e2bfafdf3bfb8cf4ecd96c0d

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\pantallatoolbar

MD5 cca1bdf11fc43a25933969cb604f7a73
SHA1 85b074839b4a73ddb407a9bc03aa4a5ab6788f2a
SHA256 d8feb9da6aebd7b89a96b6cd72c09939965c5cce90253f1ab709f6d61cd9dac2
SHA512 a0c65d84a0f8aec4c459559e171dca4e4a793aa48a9416a5ea7c3d596ed086ef8501dbe12bec972fc247cd7ce1ff1332519abec65049c5798c84ac01fa76c110

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\pantallatoolbar

MD5 4f9ce7aab55602e0c259ee72bc64ade9
SHA1 eabd7cc46a62e0e6018b88d79582b2907d6cbc4d
SHA256 b14f54e7f247285bce27f9575b652f55022f937148f1e27c9f3186df5f6058b1
SHA512 7c1e0199052eb69a6533882c1f3d14010c374e5e91d43ea2fd6bb9d1b83eaa6d7730524a7b21185bed38fb4f6f4b98e4cedbe1b0c266cd39cf0292715c8da551

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\FindProcDLL.dll

MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

memory/636-256-0x0000000002AD0000-0x0000000002ADB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\NSISdl.dll

MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

C:\Users\Admin\AppData\Local\Temp\Toolbar.exe

MD5 5a82a45f2e0aaf617c8d511d43100fe1
SHA1 515aa5b88b8c129046706d8542bee3699f62968c
SHA256 4761b338dc54c9a3adec6a79024029d5041b75f4f9bb30baf98b5d3ff34d7614
SHA512 4811406accf89eac961a349b78449185e894ae4c89a7c380da1e67005c953ef782e57d2370fdc09027bb36586ad57d2476888b33b5913ca74142c72b1c17051a

C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp

MD5 793a2c91c1b687b58809d7bb079457a7
SHA1 29363e8d0591accb9dc84512c6e634e1e17c591e
SHA256 fcb29c8c20a765616126e5a14beb2761ece72c26bd459b9816e65e81770fd3b4
SHA512 a50e03b15e0a735d41fe3a5213c454cbb76d934ae27e367f8b0f8a38c1666926bdd161b2a88e7cc7811a9f39635c16d6e2b62c07dd1aee6880639903ecbaa31b

C:\Users\Admin\AppData\Local\Temp\nsjAAA8.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

C:\Users\Admin\AppData\Local\Temp\GLCF472.tmp

MD5 8c97d8bb1470c6498e47b12c5a03ce39
SHA1 15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA256 a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
SHA512 7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 7de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1 010da169e15457c25bd80ef02d76a940c1210301
SHA256 6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512 e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

\??\pipe\LOCAL\crashpad_3120_BUSISVMOKEQARPXA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 85ba073d7015b6ce7da19235a275f6da
SHA1 a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA256 5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512 eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8adb252cfa4ea9b391e420d87eafbd0f
SHA1 a82f7abaddec5dce9dcee48a9bcd55fdafc360c0
SHA256 085818b03d375fd6d687f8662602ba56000d646271b6b3a82a719965dce5d72d
SHA512 d8d9f822bb9847f4d725dd50d1ff5e9898a1d749f5670cb604f2512eadd8ea3619f05ee9ee666a5c72bfbdd0935ac6cd6db0135052b2048f2f49364dd0bd4631

C:\Users\Admin\AppData\Local\Temp\GLMF483.tmp

MD5 484cb68472473a1a84ff07996bb8c1f6
SHA1 bce9d810f2558e73854e7c8e05f122b002558e9a
SHA256 15bb390af019d92e1d02771b02335fa360db1bb34bcf4f0c72705027428f4ff1
SHA512 5f756d11290e0240fabeab6cb638f7e42024b95b5a44eea6b44dba610919a9d9d5654a87af29ef249fb22bfb9eae7dadd3abb42faa594a465efa1ff358a2fd47

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6e04f7eab06e30030fbcc02b18a930c3
SHA1 ecf064fcb803ca8da085c29d8833040e438caeeb
SHA256 56ff7f479dea27c648025375074295f08ea1ff9dc2c6e221c5790b7bb7d78090
SHA512 09a6d662f526821d8621a8b06024f406be0f8549f1119c543f00ede4d072b68b247e8fba883b3e6cadd2d6ba39c83cfdb26a63961c98a1c49f97b19035b2cfec

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 15610396730687db1f9463bfb07360e7
SHA1 1b2147f8910ea8726e6cd6435585b36cf8070a1e
SHA256 613f019a3dc2a532b07e15278b183e908207074bd1a707907597184e975ce551
SHA512 4a280e7aca6d2306e19e275a4f0141766b708594f642b86e8181885355dc255a64bde04c25f571a523ea8bca211da54d3cffb4f676994feeda55cd0353a50e29

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Analysis: behavioral9

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 224

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2680 wrote to memory of 2520 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2680 wrote to memory of 2520 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2680 wrote to memory of 2520 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2520 -ip 2520

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 624

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 224

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLBD910.tmp N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GLBD910.tmp N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe"

C:\Users\Admin\AppData\Local\Temp\GLBD910.tmp

C:\Users\Admin\AppData\Local\Temp\GLBD910.tmp 4736 C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.conduit-services.com udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 8.8.8.8:53 redirector.conduit-services.com udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 66.77.197.18:80 redirector.conduit-services.com tcp

Files

\Users\Admin\AppData\Local\Temp\GLBD910.tmp

MD5 793a2c91c1b687b58809d7bb079457a7
SHA1 29363e8d0591accb9dc84512c6e634e1e17c591e
SHA256 fcb29c8c20a765616126e5a14beb2761ece72c26bd459b9816e65e81770fd3b4
SHA512 a50e03b15e0a735d41fe3a5213c454cbb76d934ae27e367f8b0f8a38c1666926bdd161b2a88e7cc7811a9f39635c16d6e2b62c07dd1aee6880639903ecbaa31b

\Users\Admin\AppData\Local\Temp\GLCD93F.tmp

MD5 8c97d8bb1470c6498e47b12c5a03ce39
SHA1 15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA256 a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
SHA512 7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

\Users\Admin\AppData\Local\Temp\GLMD950.tmp

MD5 484cb68472473a1a84ff07996bb8c1f6
SHA1 bce9d810f2558e73854e7c8e05f122b002558e9a
SHA256 15bb390af019d92e1d02771b02335fa360db1bb34bcf4f0c72705027428f4ff1
SHA512 5f756d11290e0240fabeab6cb638f7e42024b95b5a44eea6b44dba610919a9d9d5654a87af29ef249fb22bfb9eae7dadd3abb42faa594a465efa1ff358a2fd47

Analysis: behavioral23

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

140s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe"

Network

N/A

Files

memory/2492-0-0x0000000000400000-0x0000000000476000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

121s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 224

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4988 wrote to memory of 3996 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4988 wrote to memory of 3996 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4988 wrote to memory of 3996 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3996 -ip 3996

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 60.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

143s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProc.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2440 wrote to memory of 3316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2440 wrote to memory of 3316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2440 wrote to memory of 3316 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProc.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProc.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 166.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp

Files

memory/3316-0-0x00000000006E0000-0x00000000006F4000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240729-en

Max time kernel

120s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 224

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 224

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

99s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4800 wrote to memory of 2264 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4800 wrote to memory of 2264 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4800 wrote to memory of 2264 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2264 -ip 2264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 8.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

96s

Max time network

98s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4244 wrote to memory of 4824 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4244 wrote to memory of 4824 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4244 wrote to memory of 4824 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4824 -ip 4824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 8.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 60.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

118s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 244

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3144 wrote to memory of 116 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3144 wrote to memory of 116 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3144 wrote to memory of 116 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 116 -ip 116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 636

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 166.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

120s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProc.dll,#1

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1948 wrote to memory of 2688 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1948 wrote to memory of 2688 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1948 wrote to memory of 2688 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1948 wrote to memory of 2688 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1948 wrote to memory of 2688 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1948 wrote to memory of 2688 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1948 wrote to memory of 2688 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProc.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProc.dll,#1

Network

N/A

Files

memory/2688-0-0x0000000000400000-0x0000000000414000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

111s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3620 wrote to memory of 1360 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3620 wrote to memory of 1360 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3620 wrote to memory of 1360 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1360 -ip 1360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 624

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 204.27.101.95.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 60.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

118s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 224

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20241010-en

Max time kernel

15s

Max time network

20s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 228

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1204 wrote to memory of 4100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1204 wrote to memory of 4100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1204 wrote to memory of 4100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ZipDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4100 -ip 4100

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 60.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 80.110.55.23.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\sqlite3.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 166.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp

Files

memory/3472-0-0x0000000000400000-0x0000000000476000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win7-20240903-en

Max time kernel

117s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Toolbar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50} C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}\DisplayName = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}\URL = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\SOFTWARE\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\User Preferences C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}\URL = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000feb3354da8cf554589cef8d0f47951c4000000000200000000001066000000010000200000008083bb01d77ddd1857dcdf54e2e25652ae2a8518e17d8a7c588d9af978321c68000000000e80000000020000200000001b31e22784e8c539c18a1ad3313a3ad17e69e8fb0ef16f5846f61c47662028a990000000918bce9b5bb24db740a67e297206bce81be1cd890c155731a63c922654d4d23198d24eb03428612c8e1cbc1be1d20585903f34fae25b496b8f931cdfb7b1d54ca9bad0551c0188a3e5906b7ee9978b1716325442f4e3954348edf0273c8e67ebdd7c0c3bc34ad28ed79e68702227005a2a67e61802f98ca4c29c544e1fc5052817f430c34cb79f83909d57836362b56b40000000c6abee2239e023eb42905d7cd369f1806c3521573f5d3d51467ecacfb9fc804820bbe924bf514e4024d32b17481ff089eb78ce6cba0080dca60fe5b16199da09 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000feb3354da8cf554589cef8d0f47951c4000000000200000000001066000000010000200000000d71879e83f451940f305e34ba926387d68dde98a082f4062f8ae693178ef2fc000000000e8000000002000020000000f3cb4fa1f176f5f442096ea012a40dbdc16fb0cbf585a57feb2643f1f8452dba20000000c0c955a7b405350e15ece2f061c1646404652f8ac0ddf7387db1c197d44542c8400000009e059bd5a903f6a740a9292f1e0c0caf9fa6e39e26cafdeda08196817bfaadc0337bbe18041aa44d165f4efb6ab410ce0fdd37ebb7a4de69a1c90f0d8742a4ce C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}\DisplayName = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443477144" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70119642a96adb01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A939DA1-D69C-11EF-8E45-E699F793024F} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\User Preferences\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000feb3354da8cf554589cef8d0f47951c40000000002000000000010660000000100002000000064c3d69ca9496262e560b1c681f797272fcb83b493de81d0acfc3befad081e1d000000000e8000000002000020000000c4e2e3ecfa46431dcb30e8caca4919347be21189e3d8e655e4c75385ece5655450000000f852274206b80c15bbadacdf4dae15836c31cc267f77e6605bdd49f3a6bce76f94d71e98d09e439fe1dce1d2235e98d70e8fafeb52ed709f218285794713377add8d0c2cca28a7513032eb2e6851445d400000003ed0b92688bf47b7453ab8c414e59f3950d9f3413212ba88fba932956e40a08d279da0fe540ce84a265aa4a90860ecebf4abfb458028e9eb4fd661aefce1849a C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50} C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A6FD005C-19C3-48CF-BD1D-5E8F21F6AC50}" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2796 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2796 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2796 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2796 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2796 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 2796 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 2796 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 2796 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 2796 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 2796 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 2796 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe C:\Users\Admin\AppData\Local\Temp\Toolbar.exe
PID 316 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp
PID 316 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp
PID 316 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp
PID 316 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp
PID 316 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp
PID 316 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp
PID 316 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\Toolbar.exe C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp
PID 1732 wrote to memory of 3040 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1732 wrote to memory of 3040 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1732 wrote to memory of 3040 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1732 wrote to memory of 3040 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://pf.toggle.com/s/3/6/36532-91420-gom-player.exe

C:\Users\Admin\AppData\Local\Temp\Toolbar.exe

"C:\Users\Admin\AppData\Local\Temp\Toolbar.exe" /s -silent -DefaultSearch=FALSE -StartPage=FALSE

C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp

C:\Users\Admin\AppData\Local\Temp\GLB56D7.tmp /s -silent -DefaultSearch=FALSE -StartPage=FALSE 4736 C:\Users\Admin\AppData\Local\Temp\Toolbar.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 pf.toggle.com udp
US 8.8.8.8:53 downloads.phpnuke.org udp
US 8.8.8.8:53 pf.toggle.com udp
US 8.8.8.8:53 pf.toggle.com udp
US 8.8.8.8:53 redirector.conduit-services.com udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 8.8.8.8:53 redirector.conduit-services.com udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\LangDLL.dll

MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\UAC.dll

MD5 09caf01bc8d88eeb733abc161acff659
SHA1 b8c2126d641f88628c632dd2259686da3776a6da
SHA256 3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
SHA512 ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa

\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\InstallOptions.dll

MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

C:\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\ioSpecial.ini

MD5 7d6130f0f1dff8d00c5669054ec3df8e
SHA1 a1ad9e4b87ca4c86a32b013c5e646afb399a3b79
SHA256 d4473eb6963c22c925c86a3e2c73c9516165ae4572254e623260edc3431d2171
SHA512 e9343da67f78a0473883701c8b71da79e57dd8647d7f18a18587ab84309135793422ce161c5b8026e1f774a9ceb825813d65c563858b36cb93107919cdefa935

C:\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\pantallatoolbar

MD5 6a0f8611b571c4c150b862e4763c1196
SHA1 fdd8813618853ae27c4db919fd174ae8a928e890
SHA256 6e60513b67773030dc4e3855a0d554b5865cc28610a95685818d82e60d65abf7
SHA512 6ca666a7ecf6c4f3cb5c79a80317f74b1ca4254bc3a32a845160ba4a48e7c06ed7d461a31aaa62b099a5d5eeea9ab44a6770c51bf0383fcb0d94a72df85adbe9

C:\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\pantallatoolbar

MD5 8c351a5933cf4069784300881de65248
SHA1 bc4037b9d512bb85f09ac6872e3d69eb80e6c9e8
SHA256 8b1c160d076002c64e5af390b80852680da6d4f70b250c817705c103b2c367f5
SHA512 abd3fef4a8c992fe3613d4a284c86c1ec0d2a4c9c6ed195e6eef4d7c9a1c1050a03ab9320e4defdf2ada6e4e5f1fc1d29ccab3dc55ba30e30e2d909ddac89767

C:\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\pantallatoolbar

MD5 6095bbbfee29184e2ccb5ad51cd3778c
SHA1 fdc517201b53a90fe712b99cccbf98d10527f383
SHA256 7071497ba3ce2e01c7cfdd0adba1e989dcec826525e133dbb7e1cd0b652c925c
SHA512 cd38835c41c1e05aef11d719c7d4d135fcf2728ff58fa815e225656e3b07c24628251b52e9c143878c1146d9209c1d247d30e2fe1735571ae09e9b6ffc88c5c4

\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\FindProcDLL.dll

MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9

memory/2796-255-0x00000000023E0000-0x00000000023EB000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\NSISdl.dll

MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

\Users\Admin\AppData\Local\Temp\Toolbar.exe

MD5 5a82a45f2e0aaf617c8d511d43100fe1
SHA1 515aa5b88b8c129046706d8542bee3699f62968c
SHA256 4761b338dc54c9a3adec6a79024029d5041b75f4f9bb30baf98b5d3ff34d7614
SHA512 4811406accf89eac961a349b78449185e894ae4c89a7c380da1e67005c953ef782e57d2370fdc09027bb36586ad57d2476888b33b5913ca74142c72b1c17051a

\Users\Admin\AppData\Local\Temp\nsyF90F.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

\Users\Admin\AppData\Local\Temp\GLB56D7.tmp

MD5 793a2c91c1b687b58809d7bb079457a7
SHA1 29363e8d0591accb9dc84512c6e634e1e17c591e
SHA256 fcb29c8c20a765616126e5a14beb2761ece72c26bd459b9816e65e81770fd3b4
SHA512 a50e03b15e0a735d41fe3a5213c454cbb76d934ae27e367f8b0f8a38c1666926bdd161b2a88e7cc7811a9f39635c16d6e2b62c07dd1aee6880639903ecbaa31b

\Users\Admin\AppData\Local\Temp\GLC5706.tmp

MD5 8c97d8bb1470c6498e47b12c5a03ce39
SHA1 15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA256 a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
SHA512 7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

\Users\Admin\AppData\Local\Temp\GLM5716.tmp

MD5 484cb68472473a1a84ff07996bb8c1f6
SHA1 bce9d810f2558e73854e7c8e05f122b002558e9a
SHA256 15bb390af019d92e1d02771b02335fa360db1bb34bcf4f0c72705027428f4ff1
SHA512 5f756d11290e0240fabeab6cb638f7e42024b95b5a44eea6b44dba610919a9d9d5654a87af29ef249fb22bfb9eae7dadd3abb42faa594a465efa1ff358a2fd47

C:\Users\Admin\AppData\Local\Temp\Cab8375.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar83D6.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4291bc1b0728bed306d1492474ff39f7
SHA1 1ba20a86062e4a025f8538777ca809125c04b762
SHA256 2e044aa3397a1f0c320bf9afbd1c87e262570ea60b03fccff5d560dc523e1df2
SHA512 5eb3d28e07f0aaeecd7955b74f9c51f2b79914de971fc258901e5a2317f93f2bd74c708920edd74684c77fea3b58f6bcbebe0809025d8fac81e168f0bf58f861

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ed4c3a8d039e7202e1943269ee795729
SHA1 860545be825dae004e4f03f94d8c45f57a4bd4d8
SHA256 5636dbebb86f3767a345bf8dc85609d483b97486a9920c3993a653ec5fe38de3
SHA512 bb25893231d6deb9bb362e9b149ebd9b57c8d1590010e2d8c82958c2b623cec619023f74513e040ef20749ada3f46fa3bc9c0e8ca73976a6f0be4039ebeb6a2d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f3898b2d22a8d466a255922a50729d7a
SHA1 e9be631938512b8798fd8e9d4ed84515271ca5c5
SHA256 87b2015a227b7d4735ca2dfdd62f0593c09051f268614c7bd90c2b7ca6983844
SHA512 8bc7836dc6e74f72b760b501bf38e5fc79ede3b5cca8ba9786cf2c07a96e0216d2dbe0d60b5d41806720b9435401895070b8843501cd2329e31270a5db399b1a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1486d35100e9f36e269036e120f08766
SHA1 98853f67c171c78f69e5b7cce6b34ca310faa128
SHA256 b4349c6f574e2dcec867df25bc772eaaeababc1b059d3b193e6345c1211e3112
SHA512 c5511c7b93a0a53ed191fd47a1767b5087ab02f9922a41ca37acdf8717f739b0daaf763da66fad98ded405884de483b9861727577ef8635cf603e18adf15916e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e7fb35bbf013b60f83ee5afe0a98f68
SHA1 ecece28cbc0b48d8fe6c9b3864aee0550bcce7f9
SHA256 300b046891c11a1f05e29c7cc2101636600b149023d472ddb577118233a8e0fd
SHA512 991f689d8084a0f3ffd2c034ac7f5da0924b113df1956d894bf47935e09761eef55186b3a52b98861c88a4f3e1ea2dff1cdc64d3f5292fd3bed890b69145a395

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec98d5a90b16bcc7b648cd84ee47177f
SHA1 635fa5861306dd15180354755be38ea6e6d3a778
SHA256 bf852a98cabae1bdeed3ad22f769c238df1cab41abb8bc8357640f9f82eb7fb0
SHA512 6e0f01ca0e66edf24de0e02566d5ffc83f16b1c34d6dc064075bae698d49672a1dcba0d067b4e4d7a2ec35dc60b4f26ed5632260e5b75bf79013e65f36b67c11

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ee3167b2d5b18bdf367e87f99c2442c1
SHA1 684316e072b7fd8c38d2a772f98f7c2bceb6b26a
SHA256 11b2816eff9fc0496f91a9dcf0ecc29b98a712c2730d249ca27fda85c6f7872e
SHA512 ae14279c214141d7d22374584d3a2625ad4e9e89369e5595d3a49f0c80b814e9c695510280adab3e2137520e9dbf62def4f7320b2aa59819d85cad177dea2d2f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a35ed86567f6779728f494d18b7f0d0f
SHA1 71e200884a10bf6254ce522deea5eed7e11fc804
SHA256 0934509db031d78c9ffb527e87c5437ff496746e7cd2ca4be0cdace54b29185a
SHA512 63b901432bae5f8c1e64cbae933dd6ecce50679d4ca7727d11cee6231eb838d0e8b12be5be5df3fff97ae6509d61468a9792fa7c059bb67bea43aa49e91cf819

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 38c1f08b71dfc029668809e981e7a761
SHA1 9684aee0ee4dc26c1d59955a9ed408e456c6d1ca
SHA256 e424959489272ef7c7b51865f25dd33fe2d6c5bc04099581c0ba946d2f30c76e
SHA512 921d8a75b1e36c1f8db2b54a0c86c3e49f44ab4ad0d30395b4cf4b50c918725623d506787df2371adabaae1e8c85b91b2b48f05cd92b63895ad353a9e2ddab1b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ecf82392a2aba9675333bb099610dc3b
SHA1 ac93e9a80033aac58543de3ae4671a7beb965911
SHA256 a9af61a13fb1cff8046026cc5d1568252eb3d7bf184c01119db33a22bab35a6a
SHA512 29e513bcc4ba72f025185251c7601df14622419ff15129d7b12034c57b593666562777d91e69939f24871d0dee7f29d6ece6b26e32630c767b3ec62e5cdbf527

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a75214bfcc5368e6a3c1b4d5934fa245
SHA1 bec31e66be4e1737238f7462b3ea27a49f2953cc
SHA256 b87df5a895d4f9cee36e2cc49709c1694423c7654ccacfd9801811c384b090e7
SHA512 b37d22c6a967eb27874f84805ee4c13e3966c6631f378cd6a3d12ce79c7288d3e0c07d57f607916e284741d79c7d7ba77224f82796eb711b9fbe12923f00d7e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 77354c3c967eb3390350968344848fef
SHA1 8dad03be18611e7ac6dc057c518ade4792633382
SHA256 958444eefcd00e9803408f256d939e6d4ac093b5572e3e9978b674b2e0e6b79d
SHA512 a9c4df86bc7c8486da23b7e38b3937f2c99bd22844c211be97912c98726625f940742674dc6e08fddd8ed8ca6386d4a304b2efa354c5b2116ad2a7dd9cdea285

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fe99aa61e29093150738315285193d08
SHA1 cf86f34bc91d6e879079a0c442c5e628220ff189
SHA256 415c46ae397b8014f580d0e1cf4e3190b0398ee7141e8835f2d5b772b8e93112
SHA512 fbaa1c1d3db4a545bc33218cff1738dd0c53f3c05f02c3639a578371e7f4b9c0262607c48c80bd7259773109d2a478aad213043cd86d00e0fc04d8d1f3af189f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 250685180d33a671acea6a1c5cfd407b
SHA1 49b0055f5967bc5a98fbd3ed0fc3f08e75058209
SHA256 75986a4d10979fa40211c6cc19748757322c196c232f0d67ac79f2a7b9ce8cf6
SHA512 756fcdc179548ecf6e7a84da0517e676c4a26459bf90f754e5e948810e6119b16b7cbe83e22527a63a91c89593dd34dabfaaea338d49e60f2cef0168ff677081

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 089bf0018d4f3d47399390f023c935ed
SHA1 89f6133a2da3bd07a440e09098713558fabe6acc
SHA256 12313b1ebafc65f75557ca9b208264839dbe48f3613f0db5d7e7cf1ab824e2f9
SHA512 dc08a24115d3b42b65baa853a81e0721710d11c685b9993f05abca2ae515da18e4291bfa3ac1caa94d2d5f6c81759f706a544ed2b6165fa7799e23262c7ce4e5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2fa567cc7a77b850bdddd08352772996
SHA1 dd00a802f0e1e5d80ffc022a6d66f976a1d98fa2
SHA256 9c26db3a1d0fb355837513d1669ac76d282a0def68a7fe28f3aaf90ca3bb3e00
SHA512 c49f5bfcb2dc4019f16f945b27ba7fcf5739b8800c3635af553e3cee980a078ae1b4bdeec9350f0eb202e008108c62e7f18925f0fcac419ec87ab42cd2318f85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c60ddefe9e4682005769d014ed498c3
SHA1 2afcb61cda04d07ed8c1e9f92207239ae71ad92b
SHA256 e6a98f45da401bb771a02d6501986d13f8451dc68172d9e611e88be3edcb0f19
SHA512 708fdc0cd74e3f969b57c93e997ceb5be54dd9f986fb08c77edffb1967dc2be22f0003f6d97aec08272fafd5bdb7535dbc5f25888fd4c4ef43da611af9d9fdab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dd65b6ab1792e9420ac7422e73ace3eb
SHA1 7b41d20f24174de6f04233dbd74ed9af748126e6
SHA256 c63abc866c9016141dae65bdd5e5b9b15405eb33eeea8de33ee447f595ae6ad1
SHA512 da3f2bc95f763fd54da4e90700277edf7c7a92ba4afe3b4df71c6f303cae090687672c143f10083819a9ba67aaca778d9c63dfffc93f2ba30043f193f5a46c7b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 faee7b730705c546f3c88306a6fa2699
SHA1 f836efe1a81a91aaadd744a127398495e3f0928c
SHA256 afdc83e4f3a2112be0f03816c4aeaf372e250721e8b0743d869f205dd92a5b75
SHA512 6bd97b71319d254227656066ae932154ed0a00f6430c92e0a507cdbee9b128c0263f7b50ec0eda8f2f618ba0a743109b890e7437d6736daef496f0dcc55a17db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f67aa9d7f54ebdfa184b64bf2c6e9e1
SHA1 2bfaf914c0305bc671e52ef0be3f0391244931da
SHA256 865d8e7181293d816a213e86fb61d66725bb869bdda907ac6396c1cd49566f6a
SHA512 6c6bfe4a4533ab3f0a2c85769f37c81597ad382852e8fff72ffde2c47e90ecb203597b7ce4e658280454777a57945582683137ea937d34e182ee532109837c69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 efde17fefe77ec1489ba9e0cd179523f
SHA1 6d851ec8af5f7d84f43ea4fa57ffeeb4545698bd
SHA256 e91ceccb7c3474a34d6a56e9ec1d147212e111583a8fb991cdae59ed838a498c
SHA512 c890078a5babbfc1c3ce1facca2c4e27be896159bfc813b7c43cb0335a49c2704f5cd5682b2d6f2848edca257313e34f145eb0d8495141f280b93486375a287b

Analysis: behavioral10

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3840 wrote to memory of 2224 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3840 wrote to memory of 2224 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3840 wrote to memory of 2224 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2224 -ip 2224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 608

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 204.27.101.95.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2025-01-19 19:34

Reported

2025-01-19 19:36

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GLB8C52.tmp N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GLB8C52.tmp N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe

"C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe"

C:\Users\Admin\AppData\Local\Temp\GLB8C52.tmp

C:\Users\Admin\AppData\Local\Temp\GLB8C52.tmp 4736 C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.conduit-services.com udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 redirector.conduit-services.com udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 66.77.197.18:80 redirector.conduit-services.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\GLB8C52.tmp

MD5 793a2c91c1b687b58809d7bb079457a7
SHA1 29363e8d0591accb9dc84512c6e634e1e17c591e
SHA256 fcb29c8c20a765616126e5a14beb2761ece72c26bd459b9816e65e81770fd3b4
SHA512 a50e03b15e0a735d41fe3a5213c454cbb76d934ae27e367f8b0f8a38c1666926bdd161b2a88e7cc7811a9f39635c16d6e2b62c07dd1aee6880639903ecbaa31b

C:\Users\Admin\AppData\Local\Temp\GLC8CCF.tmp

MD5 8c97d8bb1470c6498e47b12c5a03ce39
SHA1 15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA256 a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
SHA512 7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

C:\Users\Admin\AppData\Local\Temp\GLM8CEF.tmp

MD5 484cb68472473a1a84ff07996bb8c1f6
SHA1 bce9d810f2558e73854e7c8e05f122b002558e9a
SHA256 15bb390af019d92e1d02771b02335fa360db1bb34bcf4f0c72705027428f4ff1
SHA512 5f756d11290e0240fabeab6cb638f7e42024b95b5a44eea6b44dba610919a9d9d5654a87af29ef249fb22bfb9eae7dadd3abb42faa594a465efa1ff358a2fd47