Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe
-
Size
25.5MB
-
MD5
8ae30c8be4625767a1073a1912136e2c
-
SHA1
227fe088986be2a394fc3ba9e6f4a992a08759e0
-
SHA256
8f6722c6c0a66019a2c43bfe55fac96d32195b7ae295cc848fa1205b8ce2c649
-
SHA512
3f87ded5e2d481dc5a0ec0445dac0afe2aaf004e3b0aff3b0edacf70b602011cf8f215757edcd2516a39715358f4672c0f27e235e9035b860247ee5ff1639c45
-
SSDEEP
98304:XX77GBfWfaOCzIDQOl/1sYOXwnS4rVPS9mKV:vGBfWYuQo1BIBmKV
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDCT.EXE 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\SndVol.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\diantz.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhost.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\systeminfo.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\label.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\timeout.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\bootcfg.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\cscript.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrshost.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\dplaysvr.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\unlodctr.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntprint.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedit.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\sethc.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\Utilman.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\migwiz.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\Robocopy.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\drvinst.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\mtstocom.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\dxdiag.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\mfpmp.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ftp.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\prevhost.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\Bubbles.scr_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ditrace.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\msra.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\proquota.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\subst.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\chkdsk.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\eudcedit.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\schtasks.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\setupSNK.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\srdelayed.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\tracerpt.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpscript.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ktmutil.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\notepad.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\BrmfRsmg.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMESC5\IMSCPROP.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\isoburn.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\mountvol.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\cttune.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\fc.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\Bubbles.scr- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\tcmsetup.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\SysWOW64\ctfmon.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\jabswitch.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\WinMail.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\jabswitch.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\pack200.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\rmiregistry.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\misc.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\DVD Maker\DVDMaker.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\servertool.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\unpack200.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\javacpl.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\7-Zip\7zFM.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\javaw.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\kinit.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\WMPDMC.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\7-Zip\7zG.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\rmiregistry.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpenc.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iexplore.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wabmig.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-international-core_31bf3856ad364e35_6.1.7600.16385_none_459f562ff37206dd\MuiUnattend.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-lua_31bf3856ad364e35_6.1.7601.17514_none_047062a1736af5b9\consent.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_25d85b4a3e4a7709\SystemPropertiesDataExecutionPrevention.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-charmap_31bf3856ad364e35_6.1.7600.16385_none_f230138205aebc59\charmap.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_caa8f7c0e409a91f\ntoskrnl.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-directshow-dvdupgrd_31bf3856ad364e35_6.1.7600.16385_none_7d9cbcec3df8da86\dvdupgrd.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\typeperf.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-terminalservices-theme_31bf3856ad364e35_6.1.7600.16385_none_d5bc65ffdc22ec35\TSTheme.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-wtvconverter_31bf3856ad364e35_6.1.7600.16385_none_a8464accb5a91f59\WTVConverter.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-driververifier_31bf3856ad364e35_6.1.7600.16385_none_1660ccbeb66c6cf1\verifier.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\PATHPING.EXE- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_6.1.7600.16385_none_6d0100c50efddc3c\RunLegacyCPLElevated.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\SystemPropertiesRemote.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPDADM.EXE- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_6.1.7600.16385_none_975df0a6f5a54628\gpupdate.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-vault_31bf3856ad364e35_6.1.7600.16385_none_4d5e025e54ba15f8\VaultSysUi.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\posix.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7601.17514_none_cd93efad202e5fb6\bthudtask.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_61573ee0c2c4be2b\wecutil.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wordpad_31bf3856ad364e35_6.1.7601.17514_none_963528f4b7e5d0fd\wordpad.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_6.1.7600.16385_none_3020274b22e8a90f\help.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\migwiz.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_7dfc94f7357c56d2\IEExec.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\mofcomp.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_a907fb2af12e5dc6\PATHPING.EXE- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\ehome\ehtray.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_6.1.7601.17514_none_ed7ce39bb395c4e0\DataSvcUtil.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_caspol_b03f5f7f11d50a3a_6.1.7601.17514_none_403307e9ac829b13\CasPol.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_ce2d22115368db7a\WerFault.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\TCPSVCS.EXE- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.2.9600.16428_none_b436382b203656be\ExtExport.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.2.9600.16428_none_6ed450a8ee531df1\ieinstal.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\chcp.com- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\ilasm.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_6.1.7600.16385_none_fa057619380ff901\nbtstat.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-extrac32_31bf3856ad364e35_6.1.7600.16385_none_dafff0c26538f91f\extrac32.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_6.1.7600.16385_none_f71eddfb459a0155\SystemPropertiesAdvanced.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_6.1.7600.16385_none_77536d124094b997\TpmInit.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bubbles_31bf3856ad364e35_6.1.7601.17514_none_cca44baae0912bbe\Bubbles.scr_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-clip_31bf3856ad364e35_6.1.7600.16385_none_03d0d3c435b27637\clip.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mountvol_31bf3856ad364e35_6.1.7600.16385_none_0e4e6b146b2452a9\mountvol.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_7832a1aacb77df29\mcbuilder.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_4ffeefd67d89d45b\Hearts.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-stickynotes-app_31bf3856ad364e35_6.1.7600.16385_none_493ba8a4d2fc9697\StikyNot.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_6.1.7601.17514_none_85ac7bd736dda285\UserAccountControlSettings.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\WsatConfig\9683999d889dc0b8782c782e2fc1aee5\WsatConfig.ni.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_0c19cef0ed2a642e\setup_wm.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_6.1.7601.17514_none_e8657d02cbf5e4c1\schtasks.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-notify_31bf3856ad364e35_6.1.7600.16385_none_78e75d04c1b0c873\fvenotify.exe- 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7601.17514_none_036ad230212a39ce\lsm.exe_ 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d8c41938b4da01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045d0874fd48a444d86ae3ef80882fd23000000000200000000001066000000010000200000007b130e1baec078c1ea068bc0e3300ae9b13758eea6aa049578bf0ee7092afac9000000000e8000000002000020000000a03ffba8eb13558a80d3018c516065cee864564dc711958ddb0db79eb6652472200000006a02bfb27c1042dee259e95638d7dec0f053f8f7e555671d131437a96c8a69da40000000b642d5f131f2707169708609b85a1ea11d4f081a54baaad66d7d4bad70e6387f788358fa5b2d70f95d2b5ebd36e60fba7398ecfed1dcdbbf9c1bfbc39a8bc41c IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423417434" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43319461-202B-11EF-9969-66DD11CD6629} = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045d0874fd48a444d86ae3ef80882fd23000000000200000000001066000000010000200000005673ff2d8e1316c011c1d72297772865d8b52f1ede41bd068d5f5ad8b989ce1a000000000e80000000020000200000000e91bfcbbf126fd25c3b28714b0ef7f1cfdb7d18422cf9f275aa46450dd537b890000000c04bd770e9ef277b66048bf71bcca98bd67a4c7846dc2fd88edbf746d75647c2e9b299228b86f36b103e04129a060072069e08f86c47263ec0d97f0e22a89b73586c0085dc0fe448a9c464e120089683ddfb4cd5cddf3b75fd3d58f6a82ac7d0ea0c0169dfa13154ff241f3d4182db2cea742e8073b9f1d1d7de965fb092d4b56806997679b57f55d5243d30f2b4d6f8400000000048a8583639685e0b56f3683e2cb59dc706b43ec8a64ab7439587aa4b225580c23158e51ab6d07c0b1f2a7b86e8f072f69da52d3d29ceb2dde2b0d6ac38be21 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2960 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2960 IEXPLORE.exe 2960 IEXPLORE.exe 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2960 2964 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe 28 PID 2964 wrote to memory of 2960 2964 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe 28 PID 2964 wrote to memory of 2960 2964 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe 28 PID 2964 wrote to memory of 2960 2964 8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe 28 PID 2960 wrote to memory of 2920 2960 IEXPLORE.exe 29 PID 2960 wrote to memory of 2920 2960 IEXPLORE.exe 29 PID 2960 wrote to memory of 2920 2960 IEXPLORE.exe 29 PID 2960 wrote to memory of 2920 2960 IEXPLORE.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8ae30c8be4625767a1073a1912136e2c_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2920
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25.6MB
MD558b260dd2c2dc2646a6197bcfdffb0d5
SHA1e765ef13d3ec7e6b65df553d2b90094b6be16595
SHA256f52ebeaccb389e2ac01d572418acd3897533dbe76c6fad8fc0b0b5ede5a3c3f9
SHA512b160797782b9c08fb1ebb8808d53a5528b3bf0986fc291a409ef850e12ed9c94eaab616e8f2f15efb0e663261c6ab7c4aa9d7a486695821b75640222160f7575
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521a7ae50c037b8bb4322050d070c9861
SHA14df836d2fa4231745b3277f1b695054014d07107
SHA2569a7fa5096f05768b195dc7484c53126ee08d21324565d42b9f5be6324cb607f6
SHA5125b9cf909e3c426979aa547fca95bb9e8849fa1011aeb16b3aa1322e947f7f7654d52c332223b76bd2d40cd5d9760841c8c28bedfa1e6ac477b348cd93a414944
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb6abc04242f1342e13d354659a435b1
SHA186462b611f5a9b0e534812fe5ad7050755b7cb0a
SHA256aa141171544ee39825ff99577c1e91d83e08fb72a9eb18d5b5ccf7dc7c8f9bad
SHA512d94183d4451632dd7a75861e5b6b82619b96049e0a532bd9a0a77923edaee19496106444b7c3fe105df23d99025aab4aba7b8045e2ebfd29626753cc67cfb19e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509e110a703f6fb8887260b7c3bd8c912
SHA1ce7e2dcce830139bbcd254f2e4a5fe92858fae6c
SHA256503459f1becf85d0b3644a22a63bc9fce5e53abe6ea464d3de57ceb82c1827b1
SHA5126c9d6d74b3177e050d45a3f790052a0c4c9c95be184db6eeba04a1e73c3469eae18688c56f3d8c364ea57668eeef0276d54e2577bce2f9189dbecb17633a3e23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a33b9e4a4f6c4923b4e3e61caab76bad
SHA1df31559f908a4ce11b538ec41533a08e7981c68b
SHA256e9e175e7d78aa55c6baefd619feebabd7b67bc396eff8b1a6569079f101dc5f2
SHA512925b8d521eeafa69486845a088b082d9c1fdbe4f1f512a5a79492a10b1a05c9bc69bd1417786dd3cba66931cae7ad1f3f492bdc6e4c4230753b8e13ec28f6cd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549a66f4357d1b8294ebb4787b13cdeb0
SHA1cc5a2d6bfac4f90bda4d7ba833b4e02f8282ebd8
SHA256f00699f65300f5a0ef82a1e231bffc7a15de66e70000bef6f9a164b862704482
SHA512731073d753e456d83177c77ddc413c99f9d060856f22eae7580137e239615380112ddbbd7b17c8becc23a7aa7a553e9529b40375ef6d48b6f3d3073828ac1145
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56eb8705647bc37f6fd68b0e7c5188a44
SHA137f2ce625de6a96bd745fed36d9d4f6c4747a8c5
SHA256baafc04e7b5c1a51eefa7f02f186c18316549e3e0c5d2e051feeb4991f9f67c3
SHA5124eaca4f14ab46a0463889dacf131a667670c5cdf0c67fe55791c22e598292785979e734d01bcd9c3cf11744a7ce610e5c51671b01bfb3471682f969e4b56d8bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5093d6eb765715094041c15d1f765c094
SHA170f2db6bd27642e66be5ec1feb26498439f27e50
SHA25648b6544b0844a78fed515756a4417cf590c68c64a4c2829dd3e5661fbcccd11f
SHA5121545c72c66cb969948bc5e5fe1cbafe3bf28e06ebf9e376e8b6ee93ee2edc55f09c7401b86a7846021ada7c1d561496d52d85b9a8a026d5f78cf6f28daa2a573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce0dd8ff3a2419c5b5667a72a62865b2
SHA1ac7adb3d8a28644adbbf2540b051484eec9467f1
SHA25657a8ca1a9ce80aa3145531cc7ea2447fca568c63fbe6fdea7d63e44213c2499b
SHA51228436693350a217ef9c1c49c1ecd1d5ef556ae14597b0c15b1870683843d817721d1f167b7832befbd705bb1e2acb473dc0a3fcd11597f555eda8a91effdf04a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dddbdaf383544f9331043335ef987978
SHA1f5345c115b6cb4035a26f9e9be85343d425f8621
SHA256eea0196d12597ed99859a5f68d43c46148176c8261cc30b873c5e9a4fe46e3fd
SHA51291dbd48f0001c757082efa1691787146625fddb2014b55d5eea7bbce539dc0ab961258f5c48772970ebe7f44f902b3390dac4a62d5fa3e87e73cc9caf8e68e2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5770543a9c01b1b4dd625c250d50adfeb
SHA1f49ef7fd3e93b61bd5cc6c673ab1d87425ecee30
SHA25668a7644eacefb9d9dd2cc3623ce68054ed425a7be5930087ddf0e9059ccbdbc0
SHA512be1f90d8de28cf5e84959fd5bde18b69e1aeaf2005e6af6b735626caf72b484e0ec90dc0403843ac7139d7c83c5fe740822f2b2e5140b32aaf475dc48e09a2b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ec0a9f5fdbcf29fb3184fa0a35e93f8
SHA1581ac41087276176d4bc00fae974cdf40731e486
SHA2564b65f862ead225dd08afb65138bf780358a792eeb0a64567adaec859cdea68de
SHA5123e70014dab0b0f2f8a480ee1c5a4d64afde047f73dd12b066ae5518eee00b309729773a8aa2b27942002abcba87b1f4158bffc85af1ea11bf6486cda2f9b9db0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596d67d9ffe0a947cf99372d49fb2a180
SHA1aa9830db60a3f26cf7341045d2b102014394cd8a
SHA2565454509218fbb2837ecd05ff49db41f8bd4aa53f56be680eeb3ffd716284b3fe
SHA51209c2bec7a59d3b5d1098d438c11fdb98048ab32112605698fd8cebead21ffa3b70b2062975170aaba33a3a4426d89cde6306041337ea388325309f7c1f556266
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b238ab82c976b8947e2d577a79102cd
SHA198032be15062ed136c2f32b8f1deb659ad3dfa02
SHA256aee04fcc40b8adfd71f6f06bb56a37588fdfb3d2348c83b59ba87a7aa96cde30
SHA512204e494cc271cc6bd04d953b99e0a1a6af000a86935ced08f4bac9d380fedc61e1c92d2d9bbabb3287aa6f2bad80ad32996aa51501670da3b10fe405b89060b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a88c7dc4d36080dc0e63a20ee5ec9464
SHA1d4fd4eccc5def5940401fab952ed311c60c74358
SHA2567085e4e0fee252718fc5a15613bd0acdfbf02a320d7de5554a2e29be58cc970c
SHA5123ed184aeea126c8a9a3f3e6294a37396ac040f8a85edcf492828abf610fc38b0ef36210d107068d1fd5bdaa59a3f93ffceec40a1608dcbe6b4b6af1ac28f7360
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd2529f85fa087545fef523233bf45eb
SHA10c07671bf566cd14e9d1b570530cb78c52cd4db0
SHA2564cc11e3c310fa293a2d75aef34e61b2386717e96a700fab9042cd5ea04010029
SHA512ae51ca3130de7a8b09130167298d666475ef6f5ead323a55d45964ad2c729d158fe42b37eefb4e5f3c81d37759d540aa06c8f72047d2acc8f5ede9139100cd00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58284bdced70b1b47e90342fb0eb2b2c5
SHA1ead4f0cabff558edfc2800444bab96e590ac0357
SHA256780abfb4f662345fb3aa7e5e172251394b09041b0fb056981bc21d1d8913d9a5
SHA5122f33d2cf0f1d370464296cbbd09be58e67f017e713d3b6ac91b2d1fd80ea9d38f22c0a28e9dde5b33140311032551766d36411deda071082352e9a03a11afcd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eed5f358d8adfd3abb353a536898880e
SHA1c1f331ea2d963f5149c6c0de10664dd7e78ebf7d
SHA2564d5d456ec784cc392fbcd0d8f01cf9c677be93324c3eb794695a34b88d52e74a
SHA512f69a0221b8c199943c0697152cf26c7924a9ba121f4394936f2713e9ba5559a408299e4d0358124fb8042e4c79db5eb5e274da3e85f16ad4849e795a56bea044
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59636b38f959819568fa476010d562b8d
SHA168e1aff804c097cb7f43b140c5fa8376812dbda2
SHA256124f1b44a154ace2a828517ba7452d66d28d71c380fd1708c9bf0960b7226a07
SHA5124e30806b56b692fcebe9d5287564fa85e0bea809bb8e5640c4a7a5bea52926bb96b1e0c665bc8aa2b56ca3c13e52015deefa6dda0a1c6be488e7b717ebb9fa0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543fac1fb91f30e894f0f55e9154686af
SHA117579a3f098ed5fbdb58c4b4f29223f05659376c
SHA256ffcef37cffb91b9b2932a3510cc094d7f7dbb25a4f54bc2177d50b75b945c6dc
SHA51276fec0a42776b35f52bf5be37bee4ee2e731c89a9e5bfda2cbd9a1856f12d7cba134c44b1ef38fe25483997c9083e2cbaa3a2f50faadbc3777d40b1a93099477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5160157d4231bb19049b089e478c0d6e7
SHA16b22fabf80032474a35ecb13b86db8365d41070e
SHA256600bfee885819d072c02b332424d72d552f4e0e1c6fd1c65b1c10152168cc016
SHA51223d5c66240bf3018167b50aae4b5b7b8d7778011fa9710156fd04cc29ba5551b9a6b1c9a7bc273439749c955173397db498cde2bbc0038c966c6d482ff789971
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b