Malware Analysis Report

2025-03-14 21:46

Sample ID 250129-lmtegaslej
Target JaffaCakes118_55602e14b717de28ae519a8e86071e67
SHA256 0de89cecc7796bd58d2e4e370127ccdeb721e6bd887570ed8a856df52469bb92
Tags
google discovery phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0de89cecc7796bd58d2e4e370127ccdeb721e6bd887570ed8a856df52469bb92

Threat Level: Known bad

The file JaffaCakes118_55602e14b717de28ae519a8e86071e67 was found to be: Known bad.

Malicious Activity Summary

google discovery phishing

Detected google phishing page

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-29 09:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-29 09:39

Reported

2025-01-29 09:43

Platform

win7-20241010-en

Max time kernel

150s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1

Signatures

Detected google phishing page

phishing google
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3588A2F1-DE25-11EF-B66C-7E31667997D6} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ebff90c1e9a0745871ba78071abe30c000000000200000000001066000000010000200000007d80c8872a17fa915b62b70243366f13bb0a5a4b8cd2e9fdd160e70d79531567000000000e8000000002000020000000f4c183844989da903f31c4daf8192ea8d52d62cc42baad9db0dbdcd3e0b78d7620000000fde6a551281768e3ed60032ad2681f45d9587d7f71ebc791de56870fab2f181d400000003ec666bb20e56f7680fa63ea4ca90762af6865f3523c60ccdeb8d4e42fafb2300928b8546254cdcf6ae0e44358f57920be46bc3c2d5bf2e583121eea0cfe3845 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07f8d0d3272db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{358FC711-DE25-11EF-B66C-7E31667997D6} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444305557" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ebff90c1e9a0745871ba78071abe30c0000000002000000000010660000000100002000000045a8ebb045747563d7c6c26b0284aad6a7e88f35592e9038a870e01bf8aba0f7000000000e8000000002000020000000d69adf0eb000437142461ba9f0f0bdf32096e83c6a364117c5ad9c8f51b832a390000000883c3035f3655a96e68196ee23163fca6a366237b7aad22f83d12da31d341191d4c5ac09cfa098659c603ce3ed68bf52c4e70ba062c4b8a54b036f3c0a6711e754c9719b3e2045b6370cb2d0a8b5b6cc6c80372519a5590ad2c3c6298096940444a358e11ea3bf84234b1f52fc7d1315326b6d4835f6e811a5f2277c44be00c9189e5ce6d641c18983ac9a48f63e140b4000000027b1290e80a524714f22939b159065c74b7dd2f17af2012902127ef03d146a387b955bf15a77f399d545b4db38c04436147fa8b9b15a612f68473edf50aaaca4 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2148 wrote to memory of 2288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2148 wrote to memory of 2288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2148 wrote to memory of 2288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2148 wrote to memory of 2288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2148 wrote to memory of 2288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2148 wrote to memory of 2288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2148 wrote to memory of 2288 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2288 wrote to memory of 2396 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2288 wrote to memory of 2396 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2288 wrote to memory of 2396 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2288 wrote to memory of 2396 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2288 wrote to memory of 1248 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2288 wrote to memory of 1248 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2288 wrote to memory of 1248 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2288 wrote to memory of 1248 N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1248 wrote to memory of 2944 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1248 wrote to memory of 2944 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1248 wrote to memory of 2944 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1248 wrote to memory of 2944 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2396 wrote to memory of 3032 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2396 wrote to memory of 3032 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2396 wrote to memory of 3032 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2396 wrote to memory of 3032 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://cheatchit.blogspot.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://cheatgamez.net/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 cheatchit.blogspot.com udp
US 8.8.8.8:53 cheatgamez.net udp
GB 142.250.200.33:80 cheatchit.blogspot.com tcp
GB 142.250.200.33:80 cheatchit.blogspot.com tcp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 apis.google.com udp
US 8.8.8.8:53 kumpulblogger.com udp
GB 142.250.187.201:443 www.blogger.com tcp
GB 142.250.187.201:443 www.blogger.com tcp
US 8.8.8.8:53 www.tabloidpcplus.com udp
US 8.8.8.8:53 lh6.ggpht.com udp
GB 142.250.187.201:80 www.blogger.com tcp
US 8.8.8.8:53 blogger.googleusercontent.com udp
US 8.8.8.8:53 opi.yahoo.com udp
US 8.8.8.8:53 www.easycounter.com udp
US 8.8.8.8:53 widgets.amung.us udp
US 8.8.8.8:53 static.ak.connect.facebook.com udp
US 8.8.8.8:53 sites.google.com udp
GB 142.250.187.201:443 www.blogger.com tcp
GB 142.250.200.14:443 apis.google.com tcp
GB 142.250.200.14:443 apis.google.com tcp
ID 36.50.77.66:80 kumpulblogger.com tcp
ID 36.50.77.66:80 kumpulblogger.com tcp
GB 216.58.204.65:80 lh6.ggpht.com tcp
GB 216.58.204.65:80 lh6.ggpht.com tcp
US 172.67.8.141:80 widgets.amung.us tcp
US 172.67.8.141:80 widgets.amung.us tcp
GB 172.217.169.33:80 blogger.googleusercontent.com tcp
GB 172.217.169.33:80 blogger.googleusercontent.com tcp
US 52.1.22.171:80 www.easycounter.com tcp
GB 142.250.179.238:80 sites.google.com tcp
US 52.1.22.171:80 www.easycounter.com tcp
GB 142.250.179.238:80 sites.google.com tcp
GB 172.217.169.33:443 blogger.googleusercontent.com tcp
SG 206.189.42.180:80 www.tabloidpcplus.com tcp
SG 206.189.42.180:80 www.tabloidpcplus.com tcp
SG 206.189.42.180:80 www.tabloidpcplus.com tcp
SG 206.189.42.180:80 www.tabloidpcplus.com tcp
SG 206.189.42.180:80 www.tabloidpcplus.com tcp
SG 206.189.42.180:80 www.tabloidpcplus.com tcp
GB 142.250.179.238:443 sites.google.com tcp
US 52.1.22.171:443 www.easycounter.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.35:80 c.pki.goog tcp
GB 172.217.169.35:80 c.pki.goog tcp
GB 172.217.169.35:80 c.pki.goog tcp
GB 172.217.169.35:80 c.pki.goog tcp
GB 172.217.169.35:80 c.pki.goog tcp
GB 172.217.169.35:80 c.pki.goog tcp
GB 172.217.169.35:80 c.pki.goog tcp
US 8.8.8.8:53 infokomputer.grid.id udp
US 8.8.8.8:53 o.pki.goog udp
FR 52.222.144.10:443 infokomputer.grid.id tcp
FR 52.222.144.10:443 infokomputer.grid.id tcp
FR 52.222.144.10:443 infokomputer.grid.id tcp
FR 52.222.144.10:443 infokomputer.grid.id tcp
FR 52.222.144.10:443 infokomputer.grid.id tcp
US 8.8.8.8:53 o.pki.goog udp
GB 172.217.169.35:80 o.pki.goog tcp
GB 172.217.169.35:80 o.pki.goog tcp
GB 172.217.169.35:80 o.pki.goog tcp
GB 172.217.169.35:80 o.pki.goog tcp
GB 172.217.169.35:80 o.pki.goog tcp
GB 172.217.169.35:80 o.pki.goog tcp
GB 172.217.169.35:80 o.pki.goog tcp
FR 52.222.144.10:443 infokomputer.grid.id tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 88.221.135.105:80 r11.o.lencr.org tcp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 img34.imageshack.us udp
US 38.99.77.17:80 img34.imageshack.us tcp
US 38.99.77.17:80 img34.imageshack.us tcp
GB 172.217.16.226:80 pagead2.googlesyndication.com tcp
GB 172.217.16.226:80 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 www6.cbox.ws udp
US 8.8.8.8:53 i642.photobucket.com udp
US 108.181.41.161:80 www6.cbox.ws tcp
US 108.181.41.161:80 www6.cbox.ws tcp
FR 3.160.188.14:80 i642.photobucket.com tcp
FR 3.160.188.14:80 i642.photobucket.com tcp
FR 3.160.188.14:443 i642.photobucket.com tcp
US 8.8.8.8:53 kendhin.890m.com udp
US 8.8.8.8:53 whos.amung.us udp
US 172.67.8.141:80 whos.amung.us tcp
US 172.67.8.141:80 whos.amung.us tcp
GB 142.250.179.238:443 sites.google.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 developers.google.com udp
GB 216.58.204.78:80 developers.google.com tcp
GB 216.58.204.78:80 developers.google.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
GB 216.58.204.78:443 developers.google.com tcp
NL 173.194.69.84:443 accounts.google.com tcp
US 8.8.8.8:53 kendhin.890m.com udp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
FR 54.192.65.12:80 ocsp.r2m02.amazontrust.com tcp
FR 54.192.65.12:80 ocsp.r2m02.amazontrust.com tcp
FR 54.192.65.12:80 ocsp.r2m02.amazontrust.com tcp
FR 54.192.65.12:80 ocsp.r2m02.amazontrust.com tcp
FR 54.192.65.12:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 184.25.193.234:80 www.microsoft.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.157:80 crl.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3588A2F1-DE25-11EF-B66C-7E31667997D6}.dat

MD5 359cf5971b7a56507567cb1b0e452616
SHA1 c50b9e24a349b0d4574b68e37fce981f9921fbc3
SHA256 207e1f1613c493752641b68ab383b796523ee6ae0a4b20b0afed0cf5eff7aa5d
SHA512 c459da2236e9ebe3240b467e75134570f6c7fdb116f870fb124c6b07f3b6e08189294e9099cc9369d813e35c141186ad7aa8f7ee058dbc43db16217adc764fd9

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{358FC711-DE25-11EF-B66C-7E31667997D6}.dat

MD5 0c8aa77a7b909dacdb09fed85a441f2a
SHA1 85be75f7c72bcb81b1e13105d94cd48f295d47d0
SHA256 bb58507e762d1465510e91f019fc5d41bb8eea2d93c0080a7cb37a1e185a94b3
SHA512 631ad29c4ee83e43c1772d4f8887a40ab5ee5f30f1e06be6be5a52f937f7eb35558c1eb0a9a4c078dac36117d7bb69f0bfdbcdd8e0457d4fc80625696fdb72ad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 d62f401c6e1d5cbbcf730eb38c76ad9e
SHA1 77915a141605d38179391c78eac9cdbfdf383221
SHA256 b334d2d8067af43daa1fa1b46b005483d6933ba3ef9e4281493b9c7bfd06d485
SHA512 45c0d35af2dd51171c59a695fbc620a56bf650d00ea7c76515c16f50c17b55bbed24ae218f19db460eb7298b49761a54231afd373cdb1916925a86074a29c981

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

MD5 84d4223be59616e3b27111a32b2cffff
SHA1 e5eae0dbdf8e0c857f4d90f263951c22dff77b81
SHA256 fc06854392449afa62eb5fd10033f805f89991b75e30e3023bd341acf321a1bb
SHA512 b65157dd6764df857f0e2e7a23e000a9680e52625fd47e4ef6bab50faa5b8116c7e07db1e94b03363fbb921ae6aef00133e4f21bc2b7271d092d4eb5c8d4464a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

MD5 e935bc5762068caf3e24a2683b1b8a88
SHA1 82b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256 a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512 bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\Local\Temp\Tar7F74.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\Cab7F70.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 68dd6d696236bf49cb6db316a65c9f01
SHA1 47f62ac3510cd50049faec737bef45747f001c18
SHA256 90cc1c7603e0592068de6d4314cf1ce02d5bbfe5e7ab31cc48a058b84e5cd95f
SHA512 6cbf1cba758836f09f3a0c0740d6a5fb0a3504d9855df6b1a07c781321ac593278b72ac59e04acbadb510ac6ab0ced518bfcc7d9006bd4ef3c661632bd3f020b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 7c4e8d72d6088f133a32308ba2a47454
SHA1 260ff5a15b2a770d4a8773aac3df4373c451edb2
SHA256 e824fc52cdd8f537d941eb265be2eb77795cd952c2fbb28037f75eec41c0c3cc
SHA512 5fb3f1c5ca3db675a035b400a18bad6445b0a50386f4126c4d63c22caaaea3a343334176ee182f0497b2b81e76b7cbff033278356b0a8f600da2546824bf6524

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f0a7c479a2b0b0bd83cd0e08b023f5e8
SHA1 48d53147b570c613fc155a3355ef72fefed8a77b
SHA256 31cda1faf67209f82c058ab6dcac3bd4fe0e5f7180651554b139da10dea69160
SHA512 984c014908ecc3bc2189e381850edcf2ba41d322c7d7eca767e7d85c7edf7186109b8c92285f28845bbf94f7b098a38649a78356244d571d9549768aa0abe580

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b8412480952da1fd09c2cd57403fd969
SHA1 685b0d635ed4be6e398912d44bd0fe4c1e186348
SHA256 93d8e7402fd3b8961c47a9df09fec6a3634c4c8e8dc9590b04193cc85bf9a9bb
SHA512 a6fa0eca1320206a4ddb0c7c74798484d9b67f79f29fec0f5f0c9311ea91b4b4e6664779dbfdfe0f1338b5fffdf782676200ab3f3d84dd9e76a8211a42e689b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 86b744d611ba9db33c5ec2514897b8f8
SHA1 5cd21bd0f585a6f5d67970c1609a46db46020456
SHA256 e69fcbb2279a2d4372494cef821cc7fbeccbacb4341bb5b4dc45c8cdf963a4a0
SHA512 beeabf65407570065e60759b91e20dad6cf207c0bf2ca0c0b30afd433da3d0a0719324d51ef26953bbef03db1a45b08190d3aa6d69fefb4f55351f9fa1df133a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cb57042bada2b9e21decf98ddc85a454
SHA1 9b784400971446d803d00df9a54ec130c5bcb4c4
SHA256 03ea34689463f72c0c521a6e90e35daa5e8e3c1b3394c68840b75933b2f58be3
SHA512 d131f1c6df270c592a79f548d666c783cb5c5a9ab6fe65b41aea5fee444939dcee39f84dd5f19466bf13387916aab2c5d39045b2675888bd57e3b5e30965c675

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\dam[1].js

MD5 18a5ebbb9b9da1cff4de40fb1385d301
SHA1 f62e73aa5f9fb3a8c7c27230c98f8060ff4698f3
SHA256 693ffde224523a247b0d2290b8bfd7c8f35a41ed317bdc80c5ac1c26baf6ead1
SHA512 01f370dba0ad9a3e7eb81aaa326d6f63051f221799d3cc8672f60f587edb3b9eb265a79672b9e62b524aa8051307c892b09f5d8e13d2c5913b70e223c9c433cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d9038ec01454f77c289dec54b4cefabe
SHA1 2a8a84085644bd180819c47d0afcd4480db7fc0c
SHA256 de2e9aa1a045d206ee1b4277d30f8db2410ae41a0c8c922b570e2c8a088802a6
SHA512 c9f675c95769f86ab9967df232c22404a9cf53edad50e95c9f1a9ad28731116988141f63d257193671a6b651c942ba64f02d69b982ab7633aab17f5309a25ba1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5f1d17ab616df4fc39c72d7f7d810c97
SHA1 0c93cee471d4228a0b415f4219cef1f3a189b643
SHA256 446f1793972d523b2358f9f884c577cef6b11825de15822a442ec6c0bbb4dca6
SHA512 70e4b1a66d5ce588f2f85a7f8bec7b32c28cf8e64066a4fa4a5226d14021cb435d40410bc28f12cd899b6cfffa18db083d0aadf534789410af66978a8c53d82e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\pingjs[1].js

MD5 12ffff4acbb9995507a036f0ab434943
SHA1 5552f524dfff06eb2dec29c483d6be85bdd64a28
SHA256 0901f11dacbfb21cfcf98a8553ed0687171af2526c6648f71280a8e073122ffc
SHA512 13524800a01e5de3abb977f4f1eb0a3de82e4c09b1a0f7d2f4aa4e67f8f4894d4ba7fb70746b479488c8a4cfe5aa123710d81eb57f50b3ef4247e93a4cc51617

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8f1902c9def1ae58b7bd2814a863d87d
SHA1 b4ff166aa23bf725d2a98157e5d46cf06ed9da48
SHA256 b4c0c28ee5d80cd7f1ec92316c68e6f2acd65aa2f61507ccd822eb2382578b85
SHA512 9079f5bc929f951c1116d5deae2396860f848ba17568910ee0a7b5a3b5d8c811fcec4c461df024af9a048a8dbbf9bf3421239ca5e0e6c59d938961634baf392e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6bd30ae91ba9a295df39aef7880f8a5e
SHA1 46e995a2c025e8a95d4b5f0fe14774d58318394b
SHA256 7d235019ef967305092dbbcb3d28705cfd1cc30676734550d61c9ef06aa66800
SHA512 23ed919ba2e3e5d99b88c6ce38e41599b4ac9c82bbfc47d3980a818becfc5666e2877849cc8f369511d803488621a41d7c029b2b6e44d43842b8503f9728d900

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fd5c68fcae35ee1423132e8c1c54f110
SHA1 c888cdeea66b454dc21227f89aa8229e3e22ac98
SHA256 134ec40a419d85f91de911de5c2cf997abb2fb8a873240f8994e9e721d4ab56a
SHA512 d0fba685c0fae2e7c4a08e9a0dc5975a7fed2e2e4c5baed1facb1b82e824fe27c8df70313f2857bf0da5fbd014113c6f366eaa39a91e2da7ab3b187c2e017623

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 470b488802cf68aaa34a5befdd958bbc
SHA1 852331b60f846050081fa8560886ae97ca79eb1c
SHA256 b552351800d2781c050de5092c6d01343fad303093e372f87619895b06e3238e
SHA512 05948a9d929ac205f2b2d721a4666a1dccb597f0b2af0d26b7a5f6aee69653c1716a764f367e9bdbe3849513dfd637e61e4a897242e4e34d7b107cb7cc66b2ab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

MD5 082063b39241d4f19111727a371f60da
SHA1 e89ce43228581fc9d42233f544750a3333b883af
SHA256 c3c04a7cc36d83bcab5af08bbff5d5afc3ee51abdb73504c35b95a93b61d41c5
SHA512 4ba5ecd60fd1f55b15385cc722d5319eaa372f92fb50556ff320956f61f15c0bf08c69dae42fa23a1783e49c404c941d5abe6a3d7408dd154466e0e6cf012330

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

MD5 9889995807159b735d383174b8fef75a
SHA1 dad5888404cd5c7439a642e8763388cd2d4a69bd
SHA256 3fadffbc2d58323e52014adcf164a2c99d5325017537d4414af398b1839e0e70
SHA512 c9a0b928dc3d4134c5030fcb47a7708a66f0e6feeab5a794478c7ce97f6128d0b2c060f4d4759bda71b5596793de332ee90c93d9278a89cae9ac4c0eccf0a485

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

MD5 fa160463211699f08e887c93fc377028
SHA1 b3b22e0eb8dad0f93b26e336af30cdabda576a9e
SHA256 c294a1652b523cd7d80912655a86bc0d2c8479d8b0f65293724ba8367df36915
SHA512 4e0e7cdeb53f0f257b99441463f108c1a3fc73b511777c4e8f126d543ff97af076f41d81b6dc2b68e7baf53e69d8975239caab2127dd62cc56b061a0dca4a842

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

MD5 500a515fcc3fcd80107716836de3702e
SHA1 c632d42563b50616453b1f475f45a9f02fad3c06
SHA256 2c1e0c0df3a57354c1253ddf16cb68aec76d010b2945d6891a46ad7dbc3922c9
SHA512 0d02f4689ed7077bbad76bb5a630359b0714a6c16ae44fefdb8bf50198b52cb92ed02c98af024a9c693e2710b62c6f097c7460dbc4443f0c8132e163f9554418

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

MD5 4ceed1cf75d332402b6297ac484e30a0
SHA1 4807b8fdf3b15b2baff2cbecc8b22e2abe68dced
SHA256 15b69f6761509d4e0a11e30fd6d0eae7c5c1979699afb49422cbca98f84061e5
SHA512 375557e6318b1559e00ff8038c5b727625cb924b0459abf38f67968b5b3d7476d4ca28a3dd58188e2c37db9dc6740f5faf3b444480f63cb27d470cabd8f2d3bc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

MD5 cbc83b7c2c1e1c8a21b32e7477e820d1
SHA1 756f80a1095751db85322dc1785f7ae0715322e6
SHA256 34a8cbe828401a1bdfc0817697b250ae6bd8622be95edd0451d7f4b38e6d17a6
SHA512 cc7cee04784122ee7767beb23aab2a8dd0789a8204a4fdd0f78530d27937e820bda5707603536254ac772c32b4363a8a9304ed55b1a6067b698264ee826affb5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

MD5 822b2212b6b0b2ec837eb9df8e97578b
SHA1 8dceca51f9018f03ef053804f44000398b7f36c7
SHA256 5d204049bfcc882ce30803703760e5ec7a59ff0dcf7656a4c4770b7635f601eb
SHA512 66934e7f89097dcd09467bd5a66db0cec9f3e3bce3bbb09e30ea0eaf14793354f5a6bed81da4f83a38a198318269ab1bdd3a0e3da269ccbb5cc9481d37de062b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F53EB4E574DE32C870452087D92DBEBB_0D9533D1089967059733D0587353BBCC

MD5 5c99255335a3c145a03b96ab30e308c0
SHA1 9545a733d927786ae2dc8de9c075c24702689238
SHA256 aef61b6af9863c990ac6e0bb370c73211df7b798871d30619642edbb1a5d1b6c
SHA512 e6b64fe786a54c2554c1decde4b4ec969e5e2affdb5915c52e17dd9db0c6f171c0c5faa11492ee62dbb8facd71db1bb269a122dafe495933e493e39a8f4a9270

memory/2288-1239-0x000000006D300000-0x000000006D308000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7f5bfdb43581e7827f407593a6a7ffca
SHA1 3c48386a701707afc9319d59c31fe542e734ff10
SHA256 bfe329be1bf23a7b3dd229c0d887a37d0a7014681503ab88cd9e73ae74a75a52
SHA512 d3b88a644a41b76237f56f9ce73cc575f46d33d302c641ffe35a5856f69d040c77cb330fba0a2d72f6f24ef75bed5602af432ad1013d58d16d997bf91917e7ac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 04846e11f3651f99936255071b464186
SHA1 742944cf780f73bdce370848d3b264c117c7489f
SHA256 a4edc9eeaffaf95d6d9fc2e570bcc9927284d929fed6a8781758e0ffd96e9cd9
SHA512 22e834a6982709ff79bc23d0010358005e1e8a529ef1b10e4e36ddcbf3eae166e2914cba444a4f0af366262dc9e218bcdc8afbdefa870b82147f7fb67aa77947

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 197a08860f31aafde3d9ebfd4d8f8408
SHA1 03123584bf63f20fcad67dc03e53539f716d3c74
SHA256 1916adeb180f20821fb82ce67ccd8ade5b4d8918e63b4c7be7c5f92db15e4bf6
SHA512 0bb892d471d7e64eb45cbfa02709a12901de83de1c9a7c3cc515788ad7ca9a8275c54c9d3d90191f9581ef545c947fc749a67159f3205c3bbb2cd8e054d96032

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dde0e51048252f2d21afd6c2a40a2bc9
SHA1 08b6291320375077491417293960e2e265e025b2
SHA256 02ab2fcbcf2af0e384c117a2b6008774911bdb1bc0dfc5b83bdb291a64db31ca
SHA512 2b10033778762060b03c9c37a4b8766d9b87d32945b2ac4762ffc8368526b2ab4f4f76b239b830db17733f9ca1c8552f9e398d372dd09c01c1bb3b1d69a5cbc9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 388afd753848bbcc928a5f7674e3fc79
SHA1 9919a66d64a7e97fdb78922eaab6a023cb99730d
SHA256 b16790694f0f462eb847e240b3724eac448bcb0d38b517825a54afd4c4aa9a5a
SHA512 154475374d813660ddc8186c2d6ce7f921ff11760f9e60ef2e1b7603f1d7325b379b9dea1fdc6e085b6b16f198d8aec1603df9a602cf7b5031d3d80d8eb57d4d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fcab269c3d469aeba4c6c96a047c3635
SHA1 f25d10df80f0fa262541315016c8e9a0e7ccbfdc
SHA256 d2b9f000c68603af684de9f1fb95ba0b32cca22c42414b0b6204e2a7733e5201
SHA512 58bce2a079c5d80c83ddf755c810ad2c9ca091164e1d9fd6f7736cc546fdb0d4a07d249b299e5835782b27015a60999dd5f78a9edfe2bd3dc444f194ca64a34a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afa9a1b125941e582bd3e8adf37f6873
SHA1 95367a5a069a2dc1cb8cda1513d0de443a433500
SHA256 56978144b01c9c4a1ce24961cb20aa3e652f311f8d42b29a215cfb438486c83a
SHA512 4a92395078e7fe51625bdf9f6f6f70751ca7caa814d16fcd94cca53369750821c85dcb22bcd541607e583c5bc0f74b3a20ee476f3545a099e53578f4844b9420

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 051f684ac78b4f924edf56302493921f
SHA1 ac394e4cb006a9c7857a428ba5efdc3f789e573a
SHA256 3651c134ad5f81a99a7979bcc1c0f2adcb93832811b08e0ce976ad0fc474323a
SHA512 0178ff8bb7771779308454f1a0ac69069a3561dfdc949f9e1f3c12b65fa20fa756a8d8eb006f84ba44465efa16da716bd42a79349d969bc310a4f61520cfa5ae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ee9cdfa14febcdef99c7a5841863b14
SHA1 33215248cc87aaa217eb04eec695defb792ebb41
SHA256 0ce05431bd676d90365a5ce424f7703271e7b0ede7f54d4e0d91a7c326e90f2b
SHA512 bd3ff846bae7d55e8a53c369b0a313671ca954398b03fc4cad4765fbbe52360c66c04d1ff9798c48dce59c5b0db129388095cf71f070a7c0008e79c21f86ba3e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87b251fa66f225d6a906378119a43441
SHA1 0f0ffda7135f7ea827d79bb812cbea3ed875ce5a
SHA256 c975d7add7fb8844f2f164be14e4a7a253628b763b7249a07cd6e750fb39ea8d
SHA512 19b75fc3d7131aa54b2fca31d6533c533a280ba3b85dfe7ffb169594cb62bf30364bfe0805b2a499072a8b1fe4cf7fa76cdc4d62d2709e481b6c21aab89f2c32

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cdd1c6a0530eb7bebbf5772ea0be5138
SHA1 a5b7f06bbf310b6055333d8b022b731a74434f16
SHA256 eadcf71909dd477107b42e1a1e227878dae8ad0abaf62c43d27aa15761e14abd
SHA512 3612897cabd096f2de6045db0870f407548be89bb091cc266ac21360feb1a7cb49844b24f4882f16dc0729356f63cfac0f20afe082eed8fa7687924375894490

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e76a561931177b5b0a44732105fd91f8
SHA1 f71c6790c597b6da5399dc9b950294a1c13f0b0b
SHA256 3d2ac2f2b7a60530a41b8863cbf6e9910588377baff990f5de8a43f18951ba36
SHA512 11f709810c751965db953961bd2c2d32469302431fe529a457251f81385b1d7a27de31517821f4e4d449098fc42b5c1e34f77f5f87503180d73d48f9b12c3aff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 34a84161b54cb5a81e2e6e3b2617c684
SHA1 38355ae54a6585fe14a0274f7803cfbedb0e6b81
SHA256 dfdfdc14e7afa736e893281c2993781617139d304f368a9ebe4b71a623f4c00c
SHA512 82cfc33533c8ebcdef5aaad33917e7ccb76f54a32a42c27a04fc033eed3b002b5a25edd20bde0070f7860e28181fae9627b0e15f6f47011ea9fe7b67ffc32670

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 74c9c791fc0697191cb799993377d788
SHA1 721b16d1fb8514e4f4618b0644f9b440504835cd
SHA256 d4a0d60b602c5cce60c21225cd716c6e3a23a89097a2ead47b7d922fc3c25a50
SHA512 56e33b1c765a2f057097c9ffe77c85c3f739328f07730c87cdc188fd747233e72754ca87c2242f16673a573007120b63d267f50a55e3813bc458596988879cca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f633e7c34282498b23262865b6f98733
SHA1 7058e9367da28a4e48afec5e4ff1c650eff80f64
SHA256 e9535bb0659575cfc238b2edaf8c0be4d011359b55ba613b20f7b1ecb5f31528
SHA512 acbad4e418e68cb102a9701d232320e4152bd6724c20bb27750a01ae2e99972ef82b5e84a73056e60375935f6f19829f440466d7319f8cc977766eea9f9be48b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 307404451c37b2d76d518589da0ecde3
SHA1 2113868aa9c5724f08d8575c2d00313ab58ef639
SHA256 48cb0175eeb8cb1ad6c859ebb6ea0b2f0d27c39495627b799cc6c899c61c0887
SHA512 d217c9781a5f0a963b508bf8e227ad283f7c283a7807a468701d26cd01d78d531a91d826b51681e55044e4fc823d6d7c920098c6395e02929abcb168224c2983

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d1776eaf107dd943ccd94e86c218ad0
SHA1 0e661dc983e2b9a584c583de908995a020691974
SHA256 7bb459d140b0b84e4075ad45dbe63f6e516228026eee70406711f8f0c29d8669
SHA512 010eac234ce265784a4c7cd1f857c4627608ec18f8fcc42d1d54ac557a088e86e6ba2f8e9c22d4bc29452342d1d2f82d1bd44465bd657e40f54c43a90fcca037

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99921da8b211774b9d864420f1f9971c
SHA1 b27d35c768246a5e7992d48812ad75d3d01d852f
SHA256 2aa7ad28a43d36abbe4af962b1755380a32361492aed3998930acd2beeb87c0f
SHA512 79ec50abe07fe0647a65cfd5ee5c2a3f7e010ee84a712f362c58447987a4580a1fda7a7df12655e41a8242462b573b9c2fc231ac9db2e342a74a460d962e8843

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 38df46045cf654d6558d54cd66de5c94
SHA1 0fc6fee4438a16d221e9360a773004fce3de3b4f
SHA256 29a1ccd9e270d88ac4600d0cd95714fad0c07728e59887c5689b6d489ff47ce6
SHA512 e5ede0e39a9a3d2039af168dddad0a45167b3272f8f06d9ad012fd892a3548f1094af21b53099fbe830837331ed1885cb86d699c5107b1918f3719e5237dffb1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 76af8bd0738b774ef8cfa14b86eae1bd
SHA1 8e2fdc9e648991dff550f15d56abfe316dd18f0c
SHA256 9671366d824ce941e538a1cfec0dcc10b0f4a9935bc5351612d813dbef38cf9a
SHA512 0314f216f67ca523679cbe8e73e5010f73116586d32d037bd06f41b95480583389bc32ce613fad9b187506cca68db87c8e828fddbdea5aae62573d99457a9420

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e093fa117339a2d1d107f767b10857b2
SHA1 3fe688639d1c1cc070058f75d3cb4928df7a6d35
SHA256 36cdc3973ce62328f55e976c9a290ae3ad53d0a4bc0d7ee845fad5558fb23855
SHA512 ed2ed8cb32f4c65d6e7c0930f3b589080b3c00cbd5439a61de96c4f330fffb1705eea94f56078038fd5e8bc9eb3b206bf6118ddda305dfb465254812742bd649

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-29 09:39

Reported

2025-01-30 11:36

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4796 wrote to memory of 5032 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4796 wrote to memory of 5032 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4796 wrote to memory of 5032 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 11.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 132.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 166.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 13.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/5032-0-0x000000006D300000-0x000000006D308000-memory.dmp