Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 15:04
Behavioral task
behavioral1
Sample
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe
-
Size
8.4MB
-
MD5
05760fef1fd627d46931611dc620baa3
-
SHA1
44273abea6bc3e1a4c87baca2a46b8ee64186286
-
SHA256
14486854fd515f665f197df5240aea98b2fdce9a3240c4b81c464d69c6b511fb
-
SHA512
dfd641553d405e69a337ccdf2ca55f97ea2a470e4d715657eacf158ed44b7110899962ad90068d01461bd6e047451d9a3cd9ec9a1aace6561084ce98d9e9c27a
-
SSDEEP
196608:Ta9+6Y7SOEibgRVghMa9+6Y7SOEibgRVgh:TFgREMFgRE
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon C:\Program Files\ReadBlock.exe family_blackmoon behavioral1/memory/2936-367-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon behavioral1/memory/2936-748-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon -
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
XMRig Miner payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x0000000000619000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\ReadBlock.exe xmrig behavioral1/memory/2072-308-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-344-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2936-367-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral1/memory/2072-368-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-389-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-496-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-747-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2936-748-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral1/memory/2072-749-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-750-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-751-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-752-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-753-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-754-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-755-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2072-756-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2072 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x0000000000619000-memory.dmp upx C:\Program Files\ReadBlock.exe upx behavioral1/memory/2936-367-0x0000000000400000-0x0000000000619000-memory.dmp upx behavioral1/memory/2936-748-0x0000000000400000-0x0000000000619000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\dplaysvr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\explorer.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpscript.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\msiexec.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntprint.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\RpcPing.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\AtBroker.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\typeperf.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\mode.com 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\perfhost.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\secinit.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrs.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\choice.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\drvinst.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\migwiz.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\dccw.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\netiougc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\recover.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdchange.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\cttune.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\PING.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\w32tm.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\cleanmgr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\findstr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\replace.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\sxstrace.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\calc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\finger.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\mspaint.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\openfiles.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\ARP.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\dnscacheugc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\msra.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\sc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\setx.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\tasklist.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\wusa.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\scrnsave.scr 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\cliconfg.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\net1.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\fc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\sbunattend.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\verclsid.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\wecutil.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\WerFault.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\ctfmon.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmmon32.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\ndadmin.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\powercfg.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskcomp.com 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\DVD Maker\DVDMaker.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Journal\PDIALOG.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7z.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\currency.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\401-5.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_6.1.7600.16385_none_8094bd7b62d2b435\ImagingDevices.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-17.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\412.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\servicing\GC64\tzupd.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_6.1.7600.16385_none_5269b9a9a14782a8\efsui.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_f9257e7aaa4290ce\ctfmon.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tasklist_31bf3856ad364e35_6.1.7600.16385_none_843823d87402ab36\tasklist.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-snmp-evntcmd_31bf3856ad364e35_6.1.7600.16385_none_b8db1dc46558b805\evntcmd.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-14.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.1.7600.16385_none_901eda10f3ab38d2\McrMgr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_6.1.7600.16385_none_9d299157e03ce00f\klist.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-snmp-evntwin_31bf3856ad364e35_6.1.7600.16385_none_b6a71a3466cfbde7\evntwin.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-4.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00_mpnotify.exe_bd6992f8 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404-2.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\ehome\RegisterMCEApp.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_6.1.7601.17514_none_81e99da174638311\dxdiag.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehshell_31bf3856ad364e35_6.1.7600.16385_none_95955bd51390781b\ehshell.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\setup16.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpenc_31bf3856ad364e35_6.1.7600.16385_none_a3fa8a7d892f3cc9\wmpenc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_6.1.7600.16385_none_7444913c36004801\sc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\ehome\ehmsas.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_02bb0612dc529329\diantz.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_6.1.7601.17514_none_e8657d02cbf5e4c1\schtasks.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_6.1.7600.16385_none_55d820d53d0a8fa3\wlanext.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\iissetup.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\PkgMgr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0246f6465cb859ba\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\shadow.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.7601.17514_none_b296f701dc00c582\ieUnatt.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d1240af48795ef12\currency.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\500-13.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-8.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\ehome\CreateDisc\SBEServer.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_6.1.7601.17514_none_f8852afc12f84e8e\nltest.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e9ea273bf74e2d7d\weather.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_cfcaa9124aa42f85\SyncHost.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_95f92198f65d354d\driverquery.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_82258a09c9170bac\flyout.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\404-15.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.17514_none_8664adc870f5633a\taskhost.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\user.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-diskraid_31bf3856ad364e35_6.1.7601.17514_none_67910dfbf63c4aae\diskraid.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f86c44a49a61f132\slideShow.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_e292664733bd5af6\ie4uinit.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_6.1.7600.16385_none_45fe6fe8a9201e55\comrepl.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_8b52bb03d4ea5d36\csc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f86c44a49a61f132\settings.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-19.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.5.7601.17514_none_b9a4b88eb4255dbf\wuapp.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-3.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018\lodctr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\SvcIni.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7601.17514_none_036ad230212a39ce\lsm.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\MRINFO.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7601.17514_none_2d1a84c49beb2055\wiaacmgr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\instnm.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 2936 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Token: 33 2936 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2936 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2072 svchost.exe Token: SeLockMemoryPrivilege 2072 svchost.exe Token: SeLockMemoryPrivilege 2072 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exepid process 2936 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription pid process target process PID 2936 wrote to memory of 2072 2936 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe svchost.exe PID 2936 wrote to memory of 2072 2936 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe svchost.exe PID 2936 wrote to memory of 2072 2936 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe svchost.exe PID 2936 wrote to memory of 2072 2936 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.htmlFilesize
16KB
MD5ed1191da9c4f74a60d695a25686f374e
SHA13a427657c16a716be332587425101653c25221d0
SHA256ab8cafd1958c27d70adc747259495e35592f8a06ae00969964f5f34f72896f3f
SHA51268098c1342f87939b3f57cd3e3a799ff316d2f1eb5c52f8d9c0c9e7c214281bff68a1260a91527b7175ad031798f42125cf9ee2e0d49772eb03b5836b67d9fbf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.htmlFilesize
6KB
MD5657eb3527d651515f97b960a67d19fda
SHA127404b587183bc2f3b3b6919fbb91892f505b60d
SHA256f301745232a72d84f277980ad53b65d94b02479369e8b73fe0e6717adcf11a35
SHA5121085550a8844de081a216bd864990e56fbe91498fb6186cce435173ab73e29932e7b8182078cd2876039addbdb7e3c9769d7d7923f7ed2a5422e6a2a36321b70
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.htmlFilesize
12KB
MD5cdea5d1cccee27144519c75bcf3015bd
SHA1c36862abb1ada006b3dd4c28adc8b393a92fd325
SHA2561184f2316c36648a2d457b602c713d5d5eb980e86e5e8ed388e94a47f8573dbd
SHA5125d0ea1cef2af7111098c19578c42bfdfd7bb00ec3259fe026df6dd867a24f9a94f3299b035235e3cb87b1c9010f0d1be434a08318dae0412e03ecfdb439edfe9
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.htmlFilesize
9KB
MD5bc3e199345ad8ba54e2fe4acad95433d
SHA1c93cb69c27e1c03069de3c952534a52f391e3fb9
SHA256462c197c83ee3d677b07fe000b2c4e64ac4be4ceaaea80c1c77a5e67d832edd8
SHA512c1941c9106ff0d665dfee1888afcdc3c54e4db8fdb11e3313cd92a147a1084264dba8f1f9cbac5216d3c5ce1f97ff7f8d7d7493826ec3538d5db57a933fe32e4
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.htmlFilesize
14KB
MD559e4add1732aef6b8e228ecfb880c299
SHA131a6380e878f89ec9d2c83716fe42faafdd828db
SHA256089aaccbf4c17d2a0163f13820e926f8ce3122c9ed87e7e040a77439795b8fc4
SHA512461240638f98f92a0df94a6a76470d7ed3a9bf45f845b545ff37355efd4fb3efdbe592e563b6624d2e42374a3bf7682a572c3bfd96c21be87fc96ec3b3bcfbaf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.htmlMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Program Files\ReadBlock.exeFilesize
8.7MB
MD5c8969490503c9b687b76fe03cca07a63
SHA17ba277300d2caf706afdf7e174052fb63fb392dc
SHA25684b535eee5295a2c77fda45155e9d493382959de6b1d3fee43192e77903d9177
SHA51236e2adf69778a4b3673047539aab00db903169c52e40257a14ddb52aab907ea18f61f8f470580c8ff6c86c2b16fc76e524c0c583e9dc9d661bcf578b27dccc56
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
82KB
MD54a0f7539c1ef8f22a197722910f41501
SHA1d7b0946023f10693da90eb32784440efdabeff23
SHA25649820ae214d698c2678ce5e21a15dc6451afebbf64f18d657b8907b3e7142e03
SHA5126dfd88cf04fb2fa476d698a5e322a5702afd5090fb1c9a613f403392711c328fe1a496086f94fd8f5100ebb136f71fce121fa999c86c7faf276b6ba18af08db2
-
memory/2072-756-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-747-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-389-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-368-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-754-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-344-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-308-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-496-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-755-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-749-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-750-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-751-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-752-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2072-753-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2936-367-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/2936-748-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/2936-0-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB