Analysis Overview
SHA256
0de89cecc7796bd58d2e4e370127ccdeb721e6bd887570ed8a856df52469bb92
Threat Level: Known bad
The file JaffaCakes118_55602e14b717de28ae519a8e86071e67 was found to be: Known bad.
Malicious Activity Summary
Detected google phishing page
Legitimate hosting services abused for malware hosting/C2
Unsigned PE
System Location Discovery: System Language Discovery
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-01-29 09:39
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-01-29 09:39
Reported
2025-01-29 09:43
Platform
win7-20241010-en
Max time kernel
150s
Max time network
155s
Command Line
Signatures
Detected google phishing page
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | sites.google.com | N/A | N/A |
| N/A | sites.google.com | N/A | N/A |
| N/A | sites.google.com | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3588A2F1-DE25-11EF-B66C-7E31667997D6} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ebff90c1e9a0745871ba78071abe30c000000000200000000001066000000010000200000007d80c8872a17fa915b62b70243366f13bb0a5a4b8cd2e9fdd160e70d79531567000000000e8000000002000020000000f4c183844989da903f31c4daf8192ea8d52d62cc42baad9db0dbdcd3e0b78d7620000000fde6a551281768e3ed60032ad2681f45d9587d7f71ebc791de56870fab2f181d400000003ec666bb20e56f7680fa63ea4ca90762af6865f3523c60ccdeb8d4e42fafb2300928b8546254cdcf6ae0e44358f57920be46bc3c2d5bf2e583121eea0cfe3845 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07f8d0d3272db01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{358FC711-DE25-11EF-B66C-7E31667997D6} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444305557" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006ebff90c1e9a0745871ba78071abe30c0000000002000000000010660000000100002000000045a8ebb045747563d7c6c26b0284aad6a7e88f35592e9038a870e01bf8aba0f7000000000e8000000002000020000000d69adf0eb000437142461ba9f0f0bdf32096e83c6a364117c5ad9c8f51b832a390000000883c3035f3655a96e68196ee23163fca6a366237b7aad22f83d12da31d341191d4c5ac09cfa098659c603ce3ed68bf52c4e70ba062c4b8a54b036f3c0a6711e754c9719b3e2045b6370cb2d0a8b5b6cc6c80372519a5590ad2c3c6298096940444a358e11ea3bf84234b1f52fc7d1315326b6d4835f6e811a5f2277c44be00c9189e5ce6d641c18983ac9a48f63e140b4000000027b1290e80a524714f22939b159065c74b7dd2f17af2012902127ef03d146a387b955bf15a77f399d545b4db38c04436147fa8b9b15a612f68473edf50aaaca4 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://cheatchit.blogspot.com/
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://cheatgamez.net/
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:275457 /prefetch:2
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cheatchit.blogspot.com | udp |
| US | 8.8.8.8:53 | cheatgamez.net | udp |
| GB | 142.250.200.33:80 | cheatchit.blogspot.com | tcp |
| GB | 142.250.200.33:80 | cheatchit.blogspot.com | tcp |
| US | 8.8.8.8:53 | www.blogger.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| US | 8.8.8.8:53 | kumpulblogger.com | udp |
| GB | 142.250.187.201:443 | www.blogger.com | tcp |
| GB | 142.250.187.201:443 | www.blogger.com | tcp |
| US | 8.8.8.8:53 | www.tabloidpcplus.com | udp |
| US | 8.8.8.8:53 | lh6.ggpht.com | udp |
| GB | 142.250.187.201:80 | www.blogger.com | tcp |
| US | 8.8.8.8:53 | blogger.googleusercontent.com | udp |
| US | 8.8.8.8:53 | opi.yahoo.com | udp |
| US | 8.8.8.8:53 | www.easycounter.com | udp |
| US | 8.8.8.8:53 | widgets.amung.us | udp |
| US | 8.8.8.8:53 | static.ak.connect.facebook.com | udp |
| US | 8.8.8.8:53 | sites.google.com | udp |
| GB | 142.250.187.201:443 | www.blogger.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| ID | 36.50.77.66:80 | kumpulblogger.com | tcp |
| ID | 36.50.77.66:80 | kumpulblogger.com | tcp |
| GB | 216.58.204.65:80 | lh6.ggpht.com | tcp |
| GB | 216.58.204.65:80 | lh6.ggpht.com | tcp |
| US | 172.67.8.141:80 | widgets.amung.us | tcp |
| US | 172.67.8.141:80 | widgets.amung.us | tcp |
| GB | 172.217.169.33:80 | blogger.googleusercontent.com | tcp |
| GB | 172.217.169.33:80 | blogger.googleusercontent.com | tcp |
| US | 52.1.22.171:80 | www.easycounter.com | tcp |
| GB | 142.250.179.238:80 | sites.google.com | tcp |
| US | 52.1.22.171:80 | www.easycounter.com | tcp |
| GB | 142.250.179.238:80 | sites.google.com | tcp |
| GB | 172.217.169.33:443 | blogger.googleusercontent.com | tcp |
| SG | 206.189.42.180:80 | www.tabloidpcplus.com | tcp |
| SG | 206.189.42.180:80 | www.tabloidpcplus.com | tcp |
| SG | 206.189.42.180:80 | www.tabloidpcplus.com | tcp |
| SG | 206.189.42.180:80 | www.tabloidpcplus.com | tcp |
| SG | 206.189.42.180:80 | www.tabloidpcplus.com | tcp |
| SG | 206.189.42.180:80 | www.tabloidpcplus.com | tcp |
| GB | 142.250.179.238:443 | sites.google.com | tcp |
| US | 52.1.22.171:443 | www.easycounter.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 172.217.169.35:80 | c.pki.goog | tcp |
| GB | 172.217.169.35:80 | c.pki.goog | tcp |
| GB | 172.217.169.35:80 | c.pki.goog | tcp |
| GB | 172.217.169.35:80 | c.pki.goog | tcp |
| GB | 172.217.169.35:80 | c.pki.goog | tcp |
| GB | 172.217.169.35:80 | c.pki.goog | tcp |
| GB | 172.217.169.35:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | infokomputer.grid.id | udp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| FR | 52.222.144.10:443 | infokomputer.grid.id | tcp |
| FR | 52.222.144.10:443 | infokomputer.grid.id | tcp |
| FR | 52.222.144.10:443 | infokomputer.grid.id | tcp |
| FR | 52.222.144.10:443 | infokomputer.grid.id | tcp |
| FR | 52.222.144.10:443 | infokomputer.grid.id | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 172.217.169.35:80 | o.pki.goog | tcp |
| GB | 172.217.169.35:80 | o.pki.goog | tcp |
| GB | 172.217.169.35:80 | o.pki.goog | tcp |
| GB | 172.217.169.35:80 | o.pki.goog | tcp |
| GB | 172.217.169.35:80 | o.pki.goog | tcp |
| GB | 172.217.169.35:80 | o.pki.goog | tcp |
| GB | 172.217.169.35:80 | o.pki.goog | tcp |
| FR | 52.222.144.10:443 | infokomputer.grid.id | tcp |
| US | 8.8.8.8:53 | r11.o.lencr.org | udp |
| GB | 88.221.135.105:80 | r11.o.lencr.org | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 173.194.69.84:443 | accounts.google.com | tcp |
| NL | 173.194.69.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | img34.imageshack.us | udp |
| US | 38.99.77.17:80 | img34.imageshack.us | tcp |
| US | 38.99.77.17:80 | img34.imageshack.us | tcp |
| GB | 172.217.16.226:80 | pagead2.googlesyndication.com | tcp |
| GB | 172.217.16.226:80 | pagead2.googlesyndication.com | tcp |
| US | 8.8.8.8:53 | www6.cbox.ws | udp |
| US | 8.8.8.8:53 | i642.photobucket.com | udp |
| US | 108.181.41.161:80 | www6.cbox.ws | tcp |
| US | 108.181.41.161:80 | www6.cbox.ws | tcp |
| FR | 3.160.188.14:80 | i642.photobucket.com | tcp |
| FR | 3.160.188.14:80 | i642.photobucket.com | tcp |
| FR | 3.160.188.14:443 | i642.photobucket.com | tcp |
| US | 8.8.8.8:53 | kendhin.890m.com | udp |
| US | 8.8.8.8:53 | whos.amung.us | udp |
| US | 172.67.8.141:80 | whos.amung.us | tcp |
| US | 172.67.8.141:80 | whos.amung.us | tcp |
| GB | 142.250.179.238:443 | sites.google.com | tcp |
| NL | 173.194.69.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | developers.google.com | udp |
| GB | 216.58.204.78:80 | developers.google.com | tcp |
| GB | 216.58.204.78:80 | developers.google.com | tcp |
| NL | 173.194.69.84:443 | accounts.google.com | tcp |
| GB | 216.58.204.78:443 | developers.google.com | tcp |
| NL | 173.194.69.84:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | kendhin.890m.com | udp |
| US | 8.8.8.8:53 | ocsp.r2m02.amazontrust.com | udp |
| FR | 54.192.65.12:80 | ocsp.r2m02.amazontrust.com | tcp |
| FR | 54.192.65.12:80 | ocsp.r2m02.amazontrust.com | tcp |
| FR | 54.192.65.12:80 | ocsp.r2m02.amazontrust.com | tcp |
| FR | 54.192.65.12:80 | ocsp.r2m02.amazontrust.com | tcp |
| FR | 54.192.65.12:80 | ocsp.r2m02.amazontrust.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 184.25.193.234:80 | www.microsoft.com | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| GB | 2.19.252.157:80 | crl.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3588A2F1-DE25-11EF-B66C-7E31667997D6}.dat
| MD5 | 359cf5971b7a56507567cb1b0e452616 |
| SHA1 | c50b9e24a349b0d4574b68e37fce981f9921fbc3 |
| SHA256 | 207e1f1613c493752641b68ab383b796523ee6ae0a4b20b0afed0cf5eff7aa5d |
| SHA512 | c459da2236e9ebe3240b467e75134570f6c7fdb116f870fb124c6b07f3b6e08189294e9099cc9369d813e35c141186ad7aa8f7ee058dbc43db16217adc764fd9 |
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{358FC711-DE25-11EF-B66C-7E31667997D6}.dat
| MD5 | 0c8aa77a7b909dacdb09fed85a441f2a |
| SHA1 | 85be75f7c72bcb81b1e13105d94cd48f295d47d0 |
| SHA256 | bb58507e762d1465510e91f019fc5d41bb8eea2d93c0080a7cb37a1e185a94b3 |
| SHA512 | 631ad29c4ee83e43c1772d4f8887a40ab5ee5f30f1e06be6be5a52f937f7eb35558c1eb0a9a4c078dac36117d7bb69f0bfdbcdd8e0457d4fc80625696fdb72ad |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | d62f401c6e1d5cbbcf730eb38c76ad9e |
| SHA1 | 77915a141605d38179391c78eac9cdbfdf383221 |
| SHA256 | b334d2d8067af43daa1fa1b46b005483d6933ba3ef9e4281493b9c7bfd06d485 |
| SHA512 | 45c0d35af2dd51171c59a695fbc620a56bf650d00ea7c76515c16f50c17b55bbed24ae218f19db460eb7298b49761a54231afd373cdb1916925a86074a29c981 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
| MD5 | 84d4223be59616e3b27111a32b2cffff |
| SHA1 | e5eae0dbdf8e0c857f4d90f263951c22dff77b81 |
| SHA256 | fc06854392449afa62eb5fd10033f805f89991b75e30e3023bd341acf321a1bb |
| SHA512 | b65157dd6764df857f0e2e7a23e000a9680e52625fd47e4ef6bab50faa5b8116c7e07db1e94b03363fbb921ae6aef00133e4f21bc2b7271d092d4eb5c8d4464a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
| MD5 | e935bc5762068caf3e24a2683b1b8a88 |
| SHA1 | 82b70eb774c0756837fe8d7acbfeec05ecbf5463 |
| SHA256 | a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d |
| SHA512 | bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
| MD5 | 55540a230bdab55187a841cfe1aa1545 |
| SHA1 | 363e4734f757bdeb89868efe94907774a327695e |
| SHA256 | d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb |
| SHA512 | c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54 |
C:\Users\Admin\AppData\Local\Temp\Tar7F74.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\Local\Temp\Cab7F70.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 68dd6d696236bf49cb6db316a65c9f01 |
| SHA1 | 47f62ac3510cd50049faec737bef45747f001c18 |
| SHA256 | 90cc1c7603e0592068de6d4314cf1ce02d5bbfe5e7ab31cc48a058b84e5cd95f |
| SHA512 | 6cbf1cba758836f09f3a0c0740d6a5fb0a3504d9855df6b1a07c781321ac593278b72ac59e04acbadb510ac6ab0ced518bfcc7d9006bd4ef3c661632bd3f020b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
| MD5 | 7c4e8d72d6088f133a32308ba2a47454 |
| SHA1 | 260ff5a15b2a770d4a8773aac3df4373c451edb2 |
| SHA256 | e824fc52cdd8f537d941eb265be2eb77795cd952c2fbb28037f75eec41c0c3cc |
| SHA512 | 5fb3f1c5ca3db675a035b400a18bad6445b0a50386f4126c4d63c22caaaea3a343334176ee182f0497b2b81e76b7cbff033278356b0a8f600da2546824bf6524 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f0a7c479a2b0b0bd83cd0e08b023f5e8 |
| SHA1 | 48d53147b570c613fc155a3355ef72fefed8a77b |
| SHA256 | 31cda1faf67209f82c058ab6dcac3bd4fe0e5f7180651554b139da10dea69160 |
| SHA512 | 984c014908ecc3bc2189e381850edcf2ba41d322c7d7eca767e7d85c7edf7186109b8c92285f28845bbf94f7b098a38649a78356244d571d9549768aa0abe580 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b8412480952da1fd09c2cd57403fd969 |
| SHA1 | 685b0d635ed4be6e398912d44bd0fe4c1e186348 |
| SHA256 | 93d8e7402fd3b8961c47a9df09fec6a3634c4c8e8dc9590b04193cc85bf9a9bb |
| SHA512 | a6fa0eca1320206a4ddb0c7c74798484d9b67f79f29fec0f5f0c9311ea91b4b4e6664779dbfdfe0f1338b5fffdf782676200ab3f3d84dd9e76a8211a42e689b0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 86b744d611ba9db33c5ec2514897b8f8 |
| SHA1 | 5cd21bd0f585a6f5d67970c1609a46db46020456 |
| SHA256 | e69fcbb2279a2d4372494cef821cc7fbeccbacb4341bb5b4dc45c8cdf963a4a0 |
| SHA512 | beeabf65407570065e60759b91e20dad6cf207c0bf2ca0c0b30afd433da3d0a0719324d51ef26953bbef03db1a45b08190d3aa6d69fefb4f55351f9fa1df133a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cb57042bada2b9e21decf98ddc85a454 |
| SHA1 | 9b784400971446d803d00df9a54ec130c5bcb4c4 |
| SHA256 | 03ea34689463f72c0c521a6e90e35daa5e8e3c1b3394c68840b75933b2f58be3 |
| SHA512 | d131f1c6df270c592a79f548d666c783cb5c5a9ab6fe65b41aea5fee444939dcee39f84dd5f19466bf13387916aab2c5d39045b2675888bd57e3b5e30965c675 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\dam[1].js
| MD5 | 18a5ebbb9b9da1cff4de40fb1385d301 |
| SHA1 | f62e73aa5f9fb3a8c7c27230c98f8060ff4698f3 |
| SHA256 | 693ffde224523a247b0d2290b8bfd7c8f35a41ed317bdc80c5ac1c26baf6ead1 |
| SHA512 | 01f370dba0ad9a3e7eb81aaa326d6f63051f221799d3cc8672f60f587edb3b9eb265a79672b9e62b524aa8051307c892b09f5d8e13d2c5913b70e223c9c433cb |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d9038ec01454f77c289dec54b4cefabe |
| SHA1 | 2a8a84085644bd180819c47d0afcd4480db7fc0c |
| SHA256 | de2e9aa1a045d206ee1b4277d30f8db2410ae41a0c8c922b570e2c8a088802a6 |
| SHA512 | c9f675c95769f86ab9967df232c22404a9cf53edad50e95c9f1a9ad28731116988141f63d257193671a6b651c942ba64f02d69b982ab7633aab17f5309a25ba1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5f1d17ab616df4fc39c72d7f7d810c97 |
| SHA1 | 0c93cee471d4228a0b415f4219cef1f3a189b643 |
| SHA256 | 446f1793972d523b2358f9f884c577cef6b11825de15822a442ec6c0bbb4dca6 |
| SHA512 | 70e4b1a66d5ce588f2f85a7f8bec7b32c28cf8e64066a4fa4a5226d14021cb435d40410bc28f12cd899b6cfffa18db083d0aadf534789410af66978a8c53d82e |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\pingjs[1].js
| MD5 | 12ffff4acbb9995507a036f0ab434943 |
| SHA1 | 5552f524dfff06eb2dec29c483d6be85bdd64a28 |
| SHA256 | 0901f11dacbfb21cfcf98a8553ed0687171af2526c6648f71280a8e073122ffc |
| SHA512 | 13524800a01e5de3abb977f4f1eb0a3de82e4c09b1a0f7d2f4aa4e67f8f4894d4ba7fb70746b479488c8a4cfe5aa123710d81eb57f50b3ef4247e93a4cc51617 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8f1902c9def1ae58b7bd2814a863d87d |
| SHA1 | b4ff166aa23bf725d2a98157e5d46cf06ed9da48 |
| SHA256 | b4c0c28ee5d80cd7f1ec92316c68e6f2acd65aa2f61507ccd822eb2382578b85 |
| SHA512 | 9079f5bc929f951c1116d5deae2396860f848ba17568910ee0a7b5a3b5d8c811fcec4c461df024af9a048a8dbbf9bf3421239ca5e0e6c59d938961634baf392e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6bd30ae91ba9a295df39aef7880f8a5e |
| SHA1 | 46e995a2c025e8a95d4b5f0fe14774d58318394b |
| SHA256 | 7d235019ef967305092dbbcb3d28705cfd1cc30676734550d61c9ef06aa66800 |
| SHA512 | 23ed919ba2e3e5d99b88c6ce38e41599b4ac9c82bbfc47d3980a818becfc5666e2877849cc8f369511d803488621a41d7c029b2b6e44d43842b8503f9728d900 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fd5c68fcae35ee1423132e8c1c54f110 |
| SHA1 | c888cdeea66b454dc21227f89aa8229e3e22ac98 |
| SHA256 | 134ec40a419d85f91de911de5c2cf997abb2fb8a873240f8994e9e721d4ab56a |
| SHA512 | d0fba685c0fae2e7c4a08e9a0dc5975a7fed2e2e4c5baed1facb1b82e824fe27c8df70313f2857bf0da5fbd014113c6f366eaa39a91e2da7ab3b187c2e017623 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 470b488802cf68aaa34a5befdd958bbc |
| SHA1 | 852331b60f846050081fa8560886ae97ca79eb1c |
| SHA256 | b552351800d2781c050de5092c6d01343fad303093e372f87619895b06e3238e |
| SHA512 | 05948a9d929ac205f2b2d721a4666a1dccb597f0b2af0d26b7a5f6aee69653c1716a764f367e9bdbe3849513dfd637e61e4a897242e4e34d7b107cb7cc66b2ab |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
| MD5 | 082063b39241d4f19111727a371f60da |
| SHA1 | e89ce43228581fc9d42233f544750a3333b883af |
| SHA256 | c3c04a7cc36d83bcab5af08bbff5d5afc3ee51abdb73504c35b95a93b61d41c5 |
| SHA512 | 4ba5ecd60fd1f55b15385cc722d5319eaa372f92fb50556ff320956f61f15c0bf08c69dae42fa23a1783e49c404c941d5abe6a3d7408dd154466e0e6cf012330 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
| MD5 | 9889995807159b735d383174b8fef75a |
| SHA1 | dad5888404cd5c7439a642e8763388cd2d4a69bd |
| SHA256 | 3fadffbc2d58323e52014adcf164a2c99d5325017537d4414af398b1839e0e70 |
| SHA512 | c9a0b928dc3d4134c5030fcb47a7708a66f0e6feeab5a794478c7ce97f6128d0b2c060f4d4759bda71b5596793de332ee90c93d9278a89cae9ac4c0eccf0a485 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
| MD5 | fa160463211699f08e887c93fc377028 |
| SHA1 | b3b22e0eb8dad0f93b26e336af30cdabda576a9e |
| SHA256 | c294a1652b523cd7d80912655a86bc0d2c8479d8b0f65293724ba8367df36915 |
| SHA512 | 4e0e7cdeb53f0f257b99441463f108c1a3fc73b511777c4e8f126d543ff97af076f41d81b6dc2b68e7baf53e69d8975239caab2127dd62cc56b061a0dca4a842 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
| MD5 | 500a515fcc3fcd80107716836de3702e |
| SHA1 | c632d42563b50616453b1f475f45a9f02fad3c06 |
| SHA256 | 2c1e0c0df3a57354c1253ddf16cb68aec76d010b2945d6891a46ad7dbc3922c9 |
| SHA512 | 0d02f4689ed7077bbad76bb5a630359b0714a6c16ae44fefdb8bf50198b52cb92ed02c98af024a9c693e2710b62c6f097c7460dbc4443f0c8132e163f9554418 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
| MD5 | 4ceed1cf75d332402b6297ac484e30a0 |
| SHA1 | 4807b8fdf3b15b2baff2cbecc8b22e2abe68dced |
| SHA256 | 15b69f6761509d4e0a11e30fd6d0eae7c5c1979699afb49422cbca98f84061e5 |
| SHA512 | 375557e6318b1559e00ff8038c5b727625cb924b0459abf38f67968b5b3d7476d4ca28a3dd58188e2c37db9dc6740f5faf3b444480f63cb27d470cabd8f2d3bc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656
| MD5 | cbc83b7c2c1e1c8a21b32e7477e820d1 |
| SHA1 | 756f80a1095751db85322dc1785f7ae0715322e6 |
| SHA256 | 34a8cbe828401a1bdfc0817697b250ae6bd8622be95edd0451d7f4b38e6d17a6 |
| SHA512 | cc7cee04784122ee7767beb23aab2a8dd0789a8204a4fdd0f78530d27937e820bda5707603536254ac772c32b4363a8a9304ed55b1a6067b698264ee826affb5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656
| MD5 | 822b2212b6b0b2ec837eb9df8e97578b |
| SHA1 | 8dceca51f9018f03ef053804f44000398b7f36c7 |
| SHA256 | 5d204049bfcc882ce30803703760e5ec7a59ff0dcf7656a4c4770b7635f601eb |
| SHA512 | 66934e7f89097dcd09467bd5a66db0cec9f3e3bce3bbb09e30ea0eaf14793354f5a6bed81da4f83a38a198318269ab1bdd3a0e3da269ccbb5cc9481d37de062b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F53EB4E574DE32C870452087D92DBEBB_0D9533D1089967059733D0587353BBCC
| MD5 | 5c99255335a3c145a03b96ab30e308c0 |
| SHA1 | 9545a733d927786ae2dc8de9c075c24702689238 |
| SHA256 | aef61b6af9863c990ac6e0bb370c73211df7b798871d30619642edbb1a5d1b6c |
| SHA512 | e6b64fe786a54c2554c1decde4b4ec969e5e2affdb5915c52e17dd9db0c6f171c0c5faa11492ee62dbb8facd71db1bb269a122dafe495933e493e39a8f4a9270 |
memory/2288-1239-0x000000006D300000-0x000000006D308000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7f5bfdb43581e7827f407593a6a7ffca |
| SHA1 | 3c48386a701707afc9319d59c31fe542e734ff10 |
| SHA256 | bfe329be1bf23a7b3dd229c0d887a37d0a7014681503ab88cd9e73ae74a75a52 |
| SHA512 | d3b88a644a41b76237f56f9ce73cc575f46d33d302c641ffe35a5856f69d040c77cb330fba0a2d72f6f24ef75bed5602af432ad1013d58d16d997bf91917e7ac |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 04846e11f3651f99936255071b464186 |
| SHA1 | 742944cf780f73bdce370848d3b264c117c7489f |
| SHA256 | a4edc9eeaffaf95d6d9fc2e570bcc9927284d929fed6a8781758e0ffd96e9cd9 |
| SHA512 | 22e834a6982709ff79bc23d0010358005e1e8a529ef1b10e4e36ddcbf3eae166e2914cba444a4f0af366262dc9e218bcdc8afbdefa870b82147f7fb67aa77947 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 197a08860f31aafde3d9ebfd4d8f8408 |
| SHA1 | 03123584bf63f20fcad67dc03e53539f716d3c74 |
| SHA256 | 1916adeb180f20821fb82ce67ccd8ade5b4d8918e63b4c7be7c5f92db15e4bf6 |
| SHA512 | 0bb892d471d7e64eb45cbfa02709a12901de83de1c9a7c3cc515788ad7ca9a8275c54c9d3d90191f9581ef545c947fc749a67159f3205c3bbb2cd8e054d96032 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dde0e51048252f2d21afd6c2a40a2bc9 |
| SHA1 | 08b6291320375077491417293960e2e265e025b2 |
| SHA256 | 02ab2fcbcf2af0e384c117a2b6008774911bdb1bc0dfc5b83bdb291a64db31ca |
| SHA512 | 2b10033778762060b03c9c37a4b8766d9b87d32945b2ac4762ffc8368526b2ab4f4f76b239b830db17733f9ca1c8552f9e398d372dd09c01c1bb3b1d69a5cbc9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 388afd753848bbcc928a5f7674e3fc79 |
| SHA1 | 9919a66d64a7e97fdb78922eaab6a023cb99730d |
| SHA256 | b16790694f0f462eb847e240b3724eac448bcb0d38b517825a54afd4c4aa9a5a |
| SHA512 | 154475374d813660ddc8186c2d6ce7f921ff11760f9e60ef2e1b7603f1d7325b379b9dea1fdc6e085b6b16f198d8aec1603df9a602cf7b5031d3d80d8eb57d4d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | fcab269c3d469aeba4c6c96a047c3635 |
| SHA1 | f25d10df80f0fa262541315016c8e9a0e7ccbfdc |
| SHA256 | d2b9f000c68603af684de9f1fb95ba0b32cca22c42414b0b6204e2a7733e5201 |
| SHA512 | 58bce2a079c5d80c83ddf755c810ad2c9ca091164e1d9fd6f7736cc546fdb0d4a07d249b299e5835782b27015a60999dd5f78a9edfe2bd3dc444f194ca64a34a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | afa9a1b125941e582bd3e8adf37f6873 |
| SHA1 | 95367a5a069a2dc1cb8cda1513d0de443a433500 |
| SHA256 | 56978144b01c9c4a1ce24961cb20aa3e652f311f8d42b29a215cfb438486c83a |
| SHA512 | 4a92395078e7fe51625bdf9f6f6f70751ca7caa814d16fcd94cca53369750821c85dcb22bcd541607e583c5bc0f74b3a20ee476f3545a099e53578f4844b9420 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 051f684ac78b4f924edf56302493921f |
| SHA1 | ac394e4cb006a9c7857a428ba5efdc3f789e573a |
| SHA256 | 3651c134ad5f81a99a7979bcc1c0f2adcb93832811b08e0ce976ad0fc474323a |
| SHA512 | 0178ff8bb7771779308454f1a0ac69069a3561dfdc949f9e1f3c12b65fa20fa756a8d8eb006f84ba44465efa16da716bd42a79349d969bc310a4f61520cfa5ae |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6ee9cdfa14febcdef99c7a5841863b14 |
| SHA1 | 33215248cc87aaa217eb04eec695defb792ebb41 |
| SHA256 | 0ce05431bd676d90365a5ce424f7703271e7b0ede7f54d4e0d91a7c326e90f2b |
| SHA512 | bd3ff846bae7d55e8a53c369b0a313671ca954398b03fc4cad4765fbbe52360c66c04d1ff9798c48dce59c5b0db129388095cf71f070a7c0008e79c21f86ba3e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 87b251fa66f225d6a906378119a43441 |
| SHA1 | 0f0ffda7135f7ea827d79bb812cbea3ed875ce5a |
| SHA256 | c975d7add7fb8844f2f164be14e4a7a253628b763b7249a07cd6e750fb39ea8d |
| SHA512 | 19b75fc3d7131aa54b2fca31d6533c533a280ba3b85dfe7ffb169594cb62bf30364bfe0805b2a499072a8b1fe4cf7fa76cdc4d62d2709e481b6c21aab89f2c32 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cdd1c6a0530eb7bebbf5772ea0be5138 |
| SHA1 | a5b7f06bbf310b6055333d8b022b731a74434f16 |
| SHA256 | eadcf71909dd477107b42e1a1e227878dae8ad0abaf62c43d27aa15761e14abd |
| SHA512 | 3612897cabd096f2de6045db0870f407548be89bb091cc266ac21360feb1a7cb49844b24f4882f16dc0729356f63cfac0f20afe082eed8fa7687924375894490 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e76a561931177b5b0a44732105fd91f8 |
| SHA1 | f71c6790c597b6da5399dc9b950294a1c13f0b0b |
| SHA256 | 3d2ac2f2b7a60530a41b8863cbf6e9910588377baff990f5de8a43f18951ba36 |
| SHA512 | 11f709810c751965db953961bd2c2d32469302431fe529a457251f81385b1d7a27de31517821f4e4d449098fc42b5c1e34f77f5f87503180d73d48f9b12c3aff |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 34a84161b54cb5a81e2e6e3b2617c684 |
| SHA1 | 38355ae54a6585fe14a0274f7803cfbedb0e6b81 |
| SHA256 | dfdfdc14e7afa736e893281c2993781617139d304f368a9ebe4b71a623f4c00c |
| SHA512 | 82cfc33533c8ebcdef5aaad33917e7ccb76f54a32a42c27a04fc033eed3b002b5a25edd20bde0070f7860e28181fae9627b0e15f6f47011ea9fe7b67ffc32670 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 74c9c791fc0697191cb799993377d788 |
| SHA1 | 721b16d1fb8514e4f4618b0644f9b440504835cd |
| SHA256 | d4a0d60b602c5cce60c21225cd716c6e3a23a89097a2ead47b7d922fc3c25a50 |
| SHA512 | 56e33b1c765a2f057097c9ffe77c85c3f739328f07730c87cdc188fd747233e72754ca87c2242f16673a573007120b63d267f50a55e3813bc458596988879cca |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f633e7c34282498b23262865b6f98733 |
| SHA1 | 7058e9367da28a4e48afec5e4ff1c650eff80f64 |
| SHA256 | e9535bb0659575cfc238b2edaf8c0be4d011359b55ba613b20f7b1ecb5f31528 |
| SHA512 | acbad4e418e68cb102a9701d232320e4152bd6724c20bb27750a01ae2e99972ef82b5e84a73056e60375935f6f19829f440466d7319f8cc977766eea9f9be48b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 307404451c37b2d76d518589da0ecde3 |
| SHA1 | 2113868aa9c5724f08d8575c2d00313ab58ef639 |
| SHA256 | 48cb0175eeb8cb1ad6c859ebb6ea0b2f0d27c39495627b799cc6c899c61c0887 |
| SHA512 | d217c9781a5f0a963b508bf8e227ad283f7c283a7807a468701d26cd01d78d531a91d826b51681e55044e4fc823d6d7c920098c6395e02929abcb168224c2983 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2d1776eaf107dd943ccd94e86c218ad0 |
| SHA1 | 0e661dc983e2b9a584c583de908995a020691974 |
| SHA256 | 7bb459d140b0b84e4075ad45dbe63f6e516228026eee70406711f8f0c29d8669 |
| SHA512 | 010eac234ce265784a4c7cd1f857c4627608ec18f8fcc42d1d54ac557a088e86e6ba2f8e9c22d4bc29452342d1d2f82d1bd44465bd657e40f54c43a90fcca037 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 99921da8b211774b9d864420f1f9971c |
| SHA1 | b27d35c768246a5e7992d48812ad75d3d01d852f |
| SHA256 | 2aa7ad28a43d36abbe4af962b1755380a32361492aed3998930acd2beeb87c0f |
| SHA512 | 79ec50abe07fe0647a65cfd5ee5c2a3f7e010ee84a712f362c58447987a4580a1fda7a7df12655e41a8242462b573b9c2fc231ac9db2e342a74a460d962e8843 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 38df46045cf654d6558d54cd66de5c94 |
| SHA1 | 0fc6fee4438a16d221e9360a773004fce3de3b4f |
| SHA256 | 29a1ccd9e270d88ac4600d0cd95714fad0c07728e59887c5689b6d489ff47ce6 |
| SHA512 | e5ede0e39a9a3d2039af168dddad0a45167b3272f8f06d9ad012fd892a3548f1094af21b53099fbe830837331ed1885cb86d699c5107b1918f3719e5237dffb1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 76af8bd0738b774ef8cfa14b86eae1bd |
| SHA1 | 8e2fdc9e648991dff550f15d56abfe316dd18f0c |
| SHA256 | 9671366d824ce941e538a1cfec0dcc10b0f4a9935bc5351612d813dbef38cf9a |
| SHA512 | 0314f216f67ca523679cbe8e73e5010f73116586d32d037bd06f41b95480583389bc32ce613fad9b187506cca68db87c8e828fddbdea5aae62573d99457a9420 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e093fa117339a2d1d107f767b10857b2 |
| SHA1 | 3fe688639d1c1cc070058f75d3cb4928df7a6d35 |
| SHA256 | 36cdc3973ce62328f55e976c9a290ae3ad53d0a4bc0d7ee845fad5558fb23855 |
| SHA512 | ed2ed8cb32f4c65d6e7c0930f3b589080b3c00cbd5439a61de96c4f330fffb1705eea94f56078038fd5e8bc9eb3b206bf6118ddda305dfb465254812742bd649 |
Analysis: behavioral2
Detonation Overview
Submitted
2025-01-29 09:39
Reported
2025-01-30 11:36
Platform
win10v2004-20241007-en
Max time kernel
140s
Max time network
123s
Command Line
Signatures
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4796 wrote to memory of 5032 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 4796 wrote to memory of 5032 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 4796 wrote to memory of 5032 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55602e14b717de28ae519a8e86071e67.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.153.16.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 167.173.78.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 132.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 166.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.130.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.153.16.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
Files
memory/5032-0-0x000000006D300000-0x000000006D308000-memory.dmp