12a7088867b3413fd09af61234ea7be5d9fa8199641dfa1cd87c7050db1bf479

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe
Size

101KB
MD5

ec268fe6210af8b0054cda01f3ed56aa
SHA1

e2789f4d6b25065fd6019f67dea77bfa42bd9194
SHA256

12a7088867b3413fd09af61234ea7be5d9fa8199641dfa1cd87c7050db1bf479
SHA512

ea94ca9dcd3276fa656c0412227211ebe5955b60bd510f22f5a436c9a7388a4b234200bdd6b63447803be1efec3e2f94ecf4de5eb45ed812e0a6608f72516c6e
SSDEEP

1536:13cpyORJLuB4P4AJJad0299MJjifEJC2k+9Ritsv2FB:13c1fP4AJJadz99SjRYWE6v2FB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1636	explorer.exe

Loads dropped DLL 7 IoCs

pid	Process
1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe
1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe
1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe
1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe
1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe
1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe
1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 1636	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	61

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f0717d988bda01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000d1101e95ce46a77651d13eaaf9d152c708f494987b8b2738727f9dd5a622340b000000000e800000000200002000000025396494a6d819615b40895246741d93f3409aee0b6f0feb0d1011ff7b25850a9000000041d8d2ec0daa550a6198934bfcb69508393e04b7339ae3f780e119c50a3eb97ffd5af5fcb40646810f11fc864d82bdd7527e25cb707dc87e45fc3405df886c1475622fd720950524b2dc07bf0556048fcb0c19ad727f603484d4170071d26a414ecc045ffef3a50ccbeedd2ed0a79db9bfca1d11b739b74391bdef81e3978359830108ecea1b451f4be064ccf78cc09340000000b445b5ff02e92267918f2f4421103a323323490c0b033a14053e118f9b8d86d83f1e6ba1cb8db8a9075c8836ce75920170ae1e47465af03b7f08dd44d936b868	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3200000032000000b804000097020000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff4b00000000000000d104000065020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B65E2CA1-F78B-11EE-92E0-EA483E0BCDAF} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418950860"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6400000019000000ea0400007e020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B65BCB41-F78B-11EE-92E0-EA483E0BCDAF} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2936	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 50 IoCs

pid	Process
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2628	IEXPLORE.EXE
2628	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
1000	IEXPLORE.EXE
1000	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
1000	IEXPLORE.EXE
1000	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
908	IEXPLORE.EXE
908	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2944	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2944	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2944	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2944	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2944	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2944	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	28
PID 1728 wrote to memory of 2944	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	28
PID 2944 wrote to memory of 2936	2944	iexplore.exe	29
PID 2944 wrote to memory of 2936	2944	iexplore.exe	29
PID 2944 wrote to memory of 2936	2944	iexplore.exe	29
PID 2944 wrote to memory of 2936	2944	iexplore.exe	29
PID 1728 wrote to memory of 2720	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2720	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2720	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2720	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2720	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2720	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2720	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	30
PID 2720 wrote to memory of 2608	2720	iexplore.exe	31
PID 2720 wrote to memory of 2608	2720	iexplore.exe	31
PID 2720 wrote to memory of 2608	2720	iexplore.exe	31
PID 2720 wrote to memory of 2608	2720	iexplore.exe	31
PID 2936 wrote to memory of 2628	2936	IEXPLORE.EXE	32
PID 2936 wrote to memory of 2628	2936	IEXPLORE.EXE	32
PID 2936 wrote to memory of 2628	2936	IEXPLORE.EXE	32
PID 2936 wrote to memory of 2628	2936	IEXPLORE.EXE	32
PID 2936 wrote to memory of 2628	2936	IEXPLORE.EXE	32
PID 2936 wrote to memory of 2628	2936	IEXPLORE.EXE	32
PID 2936 wrote to memory of 2628	2936	IEXPLORE.EXE	32
PID 2608 wrote to memory of 2512	2608	IEXPLORE.EXE	33
PID 2608 wrote to memory of 2512	2608	IEXPLORE.EXE	33
PID 2608 wrote to memory of 2512	2608	IEXPLORE.EXE	33
PID 2608 wrote to memory of 2512	2608	IEXPLORE.EXE	33
PID 2608 wrote to memory of 2512	2608	IEXPLORE.EXE	33
PID 2608 wrote to memory of 2512	2608	IEXPLORE.EXE	33
PID 2608 wrote to memory of 2512	2608	IEXPLORE.EXE	33
PID 1728 wrote to memory of 1568	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	35
PID 1728 wrote to memory of 1568	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	35
PID 1728 wrote to memory of 1568	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	35
PID 1728 wrote to memory of 1568	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	35
PID 1728 wrote to memory of 1568	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	35
PID 1728 wrote to memory of 1568	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	35
PID 1728 wrote to memory of 1568	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	35
PID 1568 wrote to memory of 1508	1568	iexplore.exe	36
PID 1568 wrote to memory of 1508	1568	iexplore.exe	36
PID 1568 wrote to memory of 1508	1568	iexplore.exe	36
PID 1568 wrote to memory of 1508	1568	iexplore.exe	36
PID 2608 wrote to memory of 1000	2608	IEXPLORE.EXE	37
PID 2608 wrote to memory of 1000	2608	IEXPLORE.EXE	37
PID 2608 wrote to memory of 1000	2608	IEXPLORE.EXE	37
PID 2608 wrote to memory of 1000	2608	IEXPLORE.EXE	37
PID 2608 wrote to memory of 1000	2608	IEXPLORE.EXE	37
PID 2608 wrote to memory of 1000	2608	IEXPLORE.EXE	37
PID 2608 wrote to memory of 1000	2608	IEXPLORE.EXE	37
PID 1728 wrote to memory of 3048	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	38
PID 1728 wrote to memory of 3048	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	38
PID 1728 wrote to memory of 3048	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	38
PID 1728 wrote to memory of 3048	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	38
PID 1728 wrote to memory of 3048	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	38
PID 1728 wrote to memory of 3048	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	38
PID 1728 wrote to memory of 3048	1728	ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe	38
PID 3048 wrote to memory of 2220	3048	iexplore.exe	39
PID 3048 wrote to memory of 2220	3048	iexplore.exe	39
PID 3048 wrote to memory of 2220	3048	iexplore.exe	39

C:\Users\Admin\AppData\Local\Temp\ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec268fe6210af8b0054cda01f3ed56aa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://dsdc.bestdfg.info:251/?t=410&i=ie&f3e28dda63733d08e0dee63e15bd1847d487e159=f3e28dda63733d08e0dee63e15bd1847d487e159&uu=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://dsdc.bestdfg.info:251/?t=410&i=ie&f3e28dda63733d08e0dee63e15bd1847d487e159=f3e28dda63733d08e0dee63e15bd1847d487e159&uu=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2628
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a1&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a1&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2512
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275464 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1000
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:406550 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3032
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:1848335 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2332
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:1324051 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1352
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:1586204 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:908
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:1455151 /prefetch:2
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2772
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a2&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a2&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:1508
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a3&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a3&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:2220
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a4&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  PID:1292
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a4&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:1268
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a5&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  PID:2220
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a5&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:2088
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a6&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  PID:656
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a6&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:1168
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a7&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  PID:1388
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a7&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:1812
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a8&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  PID:2940
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a8&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:2476
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a9&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  PID:2448
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a9&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:2176
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a10&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  PID:1788
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a10&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:3000
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a11&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
  2⤵
  PID:2240
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://ac.bestdfg.info:251/rfrfrfrfrf.php?gg=a11&tt=410&ur=JaffaCakes118&f3e28dda63733d08e0dee63e15bd1847d487e159
    3⤵
    PID:2232
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9e07bdc7a651c1952af4932eb49ea2d

SHA1
3c2f3009cf60e5263e584eac9d9b01e8a00ec05b

SHA256
b622762354f6bf146935684abdd71bf615a986ece7fc452685115f79346eca0b

SHA512
e9f2d2a96aa2efcd03b72286b457828932c9dffb1d58528ec240b999bc83ab5c72930b78449965f524f7e75680b169956071ff16b9211326f9b9e34b9eee7e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc483617637257cf92791e55684522b5

SHA1
2ff995cc8daf098292829045c7ae5ccad8ce1bde

SHA256
2616d109ff22709fc53af38ad8a83bf765452e3cffbd2fdcdd6ed72127f64dae

SHA512
9d1beeb4f5a6d221e3ca6e2df1b8df505d9b6ee3010009a9dd741e2e7a301742f74e19c68cbefa1ea7e09258f6a0bcc1db9add390272ec1e0224300e08749eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a73506465f8187982346f82e0ff862b

SHA1
0962b4ba6c8d530b724546cf04afbaf34518ef28

SHA256
170f5b9d1ab525d15f4581059494ddf7ec2faa105665620f2825a47607e6a8d1

SHA512
7ffac444d33c2ecc1393eda9a3765f547f5a1a9d287ab4608393696e1d40dad35af442ea6b7e1e4877c1408928b76ead0c915e921a9f1f35d8a6ecf72f4b9606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
948dc0743729b58d1dd96dffbb1e30f9

SHA1
48f4e539b100f3e693262fbeb5d744283ddf4bd6

SHA256
9e40b84c3ead2e838b8de75172fb7073766be5ca277356f8f00df3f3ed1eea5f

SHA512
9184277b9368e75bad4a0786eee19a3bfeb449ce08e73ed9c02afb43271ed3b5d2cee6f3ac9ae40629a723695883a13eceb3eb3d9e2f85cb1be0df9314f56f87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8758f65c3f5a877902a5a8c0e2d90d5

SHA1
7149154ab4f7352115bbbc540de8127373834529

SHA256
9379790a24a2febd38917bbfbd57eabd2eb20800b3fa061e37eb530bdf6f0438

SHA512
a3a2c509c7844bf5721a9fea7baf2a2153b986a9777517aa630769cfa058746229e79af8ba025463a0f322828eb3cc411bdfea173c5fae44754d6283fa16e2f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
348ea5ca255bea38a2b9086d1fed6142

SHA1
efce550ba8a91857ff2b797f086ecccf7cff0f7e

SHA256
cddb27cf040021b7a745d5753794983ad136442957438d10768b9c06dde55e09

SHA512
71ce1d8bfea1c9de6752b507437d6d787dcfc4a27cb08fb669e696851947b2defca5000b45338bd5ed212233acf8a4be98d59270452bbec7d7ec02bbe089b020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d139dedd948243a8ae63cc2d9de2417a

SHA1
7f15158f9499efc8ef1afc01e1baf32dfead87c8

SHA256
9dcb9af086c806677cbc8fc9549cf64997e4b7d37e3a6dd0162404d8f2966864

SHA512
3b18311d6c322faabd2ccbb8272a5a1555d13be78f38f88ba5a7b66c850a7796112af332946431c500b5b8a6a346dc0a0928bfbafb11c2fa5532067912ffe6c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d5179271994caf117eed33e0d104028

SHA1
c87241d672cf4b96c6bfb1ba8b3c77f00e74d5db

SHA256
11377cb2d8e4f33b950037c7349be97fa6ee8a35c3b8c69e7559ae1add659141

SHA512
024a14baad3f58edcce1273a4470fc03fd71e3b1b658d47ef0d6313185e294afe5f412207245ef4ddf8ca5ceb5839f9ed9c07ccf655aafa80f1298b385f6af68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a1b3a28e4ad7b1b83c7608040ce710a

SHA1
11e84397dec91462f2280db56f23196a97d074d4

SHA256
245e7c832be0b6c7fee8ec2ba1817773054a6f3b00007955c2e94604b8d7231c

SHA512
d12a71ede2d22f6e421c005c7a482e78dfe438fcb0b15498506e399c9437fe2e943fe5066d41e5da0c12c6f2f1af2e3c51a3ace7aefbc27c736f29c03005bbcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b8a42111e6991fa76cae03176b5e66f

SHA1
b8061ae6a710547afc34544065adb6818ea78bb7

SHA256
e8b3034b6e6e035de0d37f930d77bb82c9e9e0625f67b21e67bf1f23d08d4737

SHA512
10799a1d951b9dad6e66463672052f77d3a0ac34044afede3cc59b20327217f41a41ea2b73600af8672fdc87eecfc66bce736b815316ac4ac5d318ac0de1cf5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abda33ae5f4b971b19159a51784b9f42

SHA1
e37910b66f15373177827cd3e668d59453be6c14

SHA256
6bcebe1a0e0ef6b57333845e0bb50871c5ac46679ce7f3221db76df82eb944e4

SHA512
c92e6bf05e8920d6c5c226da0973917f34073f52c8af4df5163aa3ba2a71596fb669b25e7628f3ee23868bf518a464408d9d6c70589ec3c3725fe17c47bf7326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e9ad55cd29095296a104ee474abbc02

SHA1
8bdd76ad0452517653ee3a22278f1c57157cf6dc

SHA256
8f1626f8c58edd845a68a2dfff9429fb0d89504a0475ea7854a49c6c3c79f7c4

SHA512
71e13b69953bb4ccf8c360671cd3696102ee680b92d73c18a72af0d59eb1a074eee0a5b0f3054e2a2b9447721e65730f400e4217c236f4a2f441189bd0ae9986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af050f2eeba8e41751266210dc0366b

SHA1
607d5c3ee1cda7daa1fe5cd2e14fdccf2f758b68

SHA256
7be8a9e0c927cdb72d90bac4c459d79d7c6d903d23425092ac23fcd4160cfa0b

SHA512
d7e00f8b1f13bad94d12fa1468257c7ef021749d9da497bbbc6c64681ff890c65f17575729238745791c222e2037841d1456c25f2d0162cfdbb168aae8a4c7ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
943db091837a2ddee339200c0a8c59d2

SHA1
392debc41cc13dabcd254daad86153acb1a0806d

SHA256
15046c478f58af89dd690a82d09518cade66eec4f277954d6afd5fae02af3f59

SHA512
15dc4a363b77483d1f5341c69aeca55d971aac9bf303c140fa6e465cb45e9edfe86acd090ac6bb34f1311d37bf5bb53efe2b80c2367a37043a07729fe373343f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c980701190236309581eae7911773ff6

SHA1
d8c50a916400173be99bb1a5e640d84588637ed3

SHA256
f97d3311fed423e7af2240d13bd0b05a74b5cbbf5e61cc28116dfc87cc22cb6b

SHA512
2b773cb7e3d02b8eb2a608f74ee1d37e8788a498c2c9128e8fddb59cc29dbc19296d33374031fc82a7c6ffd82d7de4db84ac93c6a36f223a22d84b593f718412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a07d04569a3195d28ab8bf0555e371b6

SHA1
d8b27084bd847e1938a6fb2abeb83593f4b9be16

SHA256
763258eb484e793f0a0ef9c04fb018f767e80715412072ea6c966f7e73bb76da

SHA512
15a9a14c989d4a340fb5c56c208c76e020abca772bc3326566370262cab7f0dd5fe9ed2a524e7e62bbcd65657a19d9d0653c16ccba97c72f44df12bf3b17fddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1004e9f9d81c91714ae2cb05941a7d5

SHA1
3f2e5cc8643f895203b23c0eb8563ca1710957b5

SHA256
0edbd388dc2d17a262277f30afe54fa7a27de419d77110c43a663a40c049229e

SHA512
7e2226ad5fa8cb4d8f9d82746e09bb7662d2201099eb2f5499d6e3e776cefe5fb3f3ce56be848a46c30e982799cf748911c3cf917743060e2295c0c74799795e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a96708ba55b439b3115db96e07b083f

SHA1
cf58c24f0019405f12e9be13b28ffc52212f6860

SHA256
57498af7ab9eecd66990dc9cb3ed6a7c42b727395063c81bd8686b44aee901ec

SHA512
af53446565d19485ac557f2720688d14a1b3d79feeaf91371a291486ee58fe2f62f91cc9e7e993521fb2b7b292c9ff94659a72555f74e10d1b4d267febc41c2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4ef1c36c2ff3885ed42a80927d22ddb

SHA1
947f740d5b0388b069971da2f83d73dee5a271c1

SHA256
bff66ce88cbccd97e715f8dd4916e8f9bb88cd59bea15be3e789e13ceccfa220

SHA512
eacb6fcf7d43676afe7b88ef2d893de4bbd6b309c9c05fbfdf5cbc77247b98bf7804d9781da3322179f7075f1dec4fce2d54765b1c021e89cd85815ab63d21b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B65BCB41-F78B-11EE-92E0-EA483E0BCDAF}.dat

Filesize
5KB

MD5
eac3463631d9d178cf6ce1e23f2714ca

SHA1
24157ad44aacbdd68cec47255d981c1e80de9d47

SHA256
094d02dabcab47b3422fab178f94632764ffa7e13f751e193cbf8fde3a86668c

SHA512
1f71ee97db87bf44fd47fdf986da688d059aead3ff2d03363f25e43dc329e8109baf938bd89313748dcd69e2ec741e446c41dac21a82530561b96313eca61477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B65E2CA1-F78B-11EE-92E0-EA483E0BCDAF}.dat

Filesize
4KB

MD5
1156cff78c2f3a92330cd65be986aa13

SHA1
1158c07823e7cfdd1977b1fb7a3d187517d4819a

SHA256
33a0db27c995c90efb23e062543411b2103988c8d9f1b819d86b8f55fb94d702

SHA512
8340044aaa306e94a7168b379b597cfc0b4e75b0bdb07c87ae66c74bd312317b300bfec36c5f30bbad5e8f3a5796c43f711a71f9db90a80566db3e910a5f29d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\NewErrorPageTemplate[1]

Filesize
1KB

MD5
cdf81e591d9cbfb47a7f97a2bcdb70b9

SHA1
8f12010dfaacdecad77b70a3e781c707cf328496

SHA256
204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd

SHA512
977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5OCCPTL4\dnserror[1]

Filesize
1KB

MD5
73c70b34b5f8f158d38a94b9d7766515

SHA1
e9eaa065bd6585a1b176e13615fd7e6ef96230a9

SHA256
3ebd34328a4386b4eba1f3d5f1252e7bd13744a6918720735020b4689c13fcf4

SHA512
927dcd4a8cfdeb0f970cb4ee3f059168b37e1e4e04733ed3356f77ca0448d2145e1abdd4f7ce1c6ca23c1e3676056894625b17987cc56c84c78e73f60e08fc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B1014REI\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\httpErrorPagesScripts[2]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B67.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C48.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\nso1316.tmp\InetLoad.dll

Filesize
18KB

MD5
994669c5737b25c26642c94180e92fa2

SHA1
d8a1836914a446b0e06881ce1be8631554adafde

SHA256
bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c

SHA512
d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563

Download Submit
\Users\Admin\AppData\Local\Temp\nso1316.tmp\Math.dll

Filesize
66KB

MD5
9eb6cecdd0df9fe32027fcdb51c625af

SHA1
52b5b054ff6e7325c3087822901ea2f2c4f9572a

SHA256
54cf1572ed47f614b0ffb886c99fc5725f454ef7ff919fbb2fd13d1cbe270560

SHA512
864742ec6f74f94057b54cd9b09707c0125ac8db4844fa80af201e8b72a811bb68276c993e75bce67e5ece4f83644572edbdee5e963634c5a37839615faea97a

Download Submit
\Users\Admin\AppData\Local\Temp\nso1316.tmp\SelfDel.dll

Filesize
4KB

MD5
5e14f6774c43bdff6ffe0afb0d51c47f

SHA1
fb1e7b6e63afa6db6aa2033b5e7e90f1f4ba5e27

SHA256
7cb51ccf21655e9590a6c3232920b16a3dfef15ffe9df7b8e71f487ca8c24da9

SHA512
6ac533c0485156a68bd1460d8219acf7539b766590910cd646f4d7d4572c072f45369712d88d4e698f4e94aead8082abcbfacc3d6fe890046898f6c6d85274e3

Download Submit
\Users\Admin\AppData\Local\Temp\nso1316.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nso1316.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
\Users\Admin\AppData\Local\Temp\nso1316.tmp\time.dll

Filesize
10KB

MD5
38977533750fe69979b2c2ac801f96e6

SHA1
74643c30cda909e649722ed0c7f267903558e92a

SHA256
b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

SHA512
e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

Download Submit
memory/1728-9-0x00000000003C0000-0x00000000003DA000-memory.dmp

Filesize
104KB

Download