Overview
overview
7Static
static
3a7a01d4e31...18.exe
windows7-x64
7a7a01d4e31...18.exe
windows10-2004-x64
7$PLUGINSDI...SC.dll
windows7-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/nsBR.dll
windows7-x64
3$PLUGINSDIR/nsBR.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDIR/nsURL.dll
windows7-x64
3$PLUGINSDIR/nsURL.dll
windows10-2004-x64
3$PLUGINSDI...pt.dll
windows7-x64
3$PLUGINSDI...pt.dll
windows10-2004-x64
3$PROGRAMFI...ll.exe
windows7-x64
7$PROGRAMFI...ll.exe
windows10-2004-x64
7$PLUGINSDI...SC.dll
windows7-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PROGRAMFI...IU.exe
windows7-x64
1$PROGRAMFI...IU.exe
windows10-2004-x64
1$PROGRAMFI...W8.exe
windows7-x64
1$PROGRAMFI...W8.exe
windows10-2004-x64
1$PROGRAMFI...32.dll
windows7-x64
1$PROGRAMFI...32.dll
windows10-2004-x64
1$PROGRAMFI...on.dll
windows7-x64
1$PROGRAMFI...on.dll
windows10-2004-x64
1$PROGRAMFI...xy.exe
windows7-x64
1$PROGRAMFI...xy.exe
windows10-2004-x64
1$PROGRAMFI...pi.dll
windows7-x64
3$PROGRAMFI...pi.dll
windows10-2004-x64
3Analysis
- max time kernel
144s - max time network
50s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 01:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsBR.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsBR.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsURL.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsURL.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/tkDecript.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/tkDecript.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PROGRAMFILES/BrowserProtect/$PROGRAMFILES/BrowserProtect/uninstall.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PROGRAMFILES/BrowserProtect/$PROGRAMFILES/BrowserProtect/uninstall.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PROGRAMFILES/BrowserProtect/BrowserProtectIU.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PROGRAMFILES/BrowserProtect/BrowserProtectIU.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PROGRAMFILES/BrowserProtect/BrowserProtectIUW8.exe
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PROGRAMFILES/BrowserProtect/BrowserProtectIUW8.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PROGRAMFILES/BrowserProtect/Interop.Shell32.dll
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PROGRAMFILES/BrowserProtect/Interop.Shell32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PROGRAMFILES/BrowserProtect/Newtonsoft.Json.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PROGRAMFILES/BrowserProtect/Newtonsoft.Json.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PROGRAMFILES/BrowserProtect/proxy/myproxy.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PROGRAMFILES/BrowserProtect/proxy/myproxy.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PROGRAMFILES/BrowserProtect/proxy/zlibwapi.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PROGRAMFILES/BrowserProtect/proxy/zlibwapi.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe
- Size 843KB
- Sample240614-b9762avbpp
- SHA256 e09d287da02d0f416cd389cd7ae620c9497b396fd5eb9b0340f2a8d13bf0379f
- MD5 a7a01d4e315bfc29e1508b7b4f27e908
- SHA1 1eb5d96fe61422419a5645c891bf86d690f2a2f1
- SHA512 f60a72c0378d86513bbc1ed069db2618e1cc55fe4c6264ac3058cd8f3129f8a82b95f66195af04153f10a97f9bb417be762304463c6ebcb1005a2ea2e18ab141
- SSDEEP 24576:XodoXzjRDuiDiNTtRw0JhkdsTezBMOQtBf2SBd:nuyiXasTmxQtYsd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2128 srvBrowserProtect.exe - Loads dropped DLL 24 IoCs
pid Process 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 24 IoCs
description ioc Process File created C:\Program Files (x86)\BrowserProtect\Interop.Shell32.dll a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\translations.xml a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\search-with-eazelbar.xml a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\BrowserProtect\BrowserProtectIUW8.exe a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\BrowserProtect\BrowserProtectIUW8.exe.config a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\BrowserProtect\BrowserProtectIU.exe.config.old a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\srvBrowserProtect.exe a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\config.xml a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\BrowserProtectIUW8.exe.config a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\srvBrowserProtectW8.exe a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\Newtonsoft.Json.dll a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\BrowserProtectIU.exe a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\BrowserProtectIU.exe.config a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\Web Data a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\BrowserProtect\config.xml.old a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\BrowserProtect\proxy\config.old a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\proxy\exclusions a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\BrowserProtectIUW8.exe a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\proxy\myproxy.exe a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\proxy\zlibwapi.dll a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\BrowserProtect\srvBrowserProtectW8.exe a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\uninstall.exe a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\proxy\config a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe File created C:\Program Files (x86)\BrowserProtect\proxy\matches a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 2 IoCs
pid Process 4660 taskkill.exe 2308 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A3763B95-7EE6-4C2A-A095-0B053F2D29B7} a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A3763B95-7EE6-4C2A-A095-0B053F2D29B7}\DisplayName = "EazelBar Search" a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A3763B95-7EE6-4C2A-A095-0B053F2D29B7}\URL = "http://en.eazel.com/results.php?id=AAA876ddde21e9e884ce1d224cf713a8243&oid=13&cat=web&co=&lg=en&q={searchTerms}" a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections srvBrowserProtect.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2308 taskkill.exe Token: SeDebugPrivilege 4660 taskkill.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 392 wrote to memory of 2308 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 82 PID 392 wrote to memory of 2308 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 82 PID 392 wrote to memory of 2308 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 82 PID 392 wrote to memory of 4660 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 86 PID 392 wrote to memory of 4660 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 86 PID 392 wrote to memory of 4660 392 a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7a01d4e315bfc29e1508b7b4f27e908_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im BrowserProtectIU.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im myproxy.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
-
C:\Program Files (x86)\BrowserProtect\srvBrowserProtect.exe"C:\Program Files (x86)\BrowserProtect\srvBrowserProtect.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\BrowserProtect\BrowserProtectIU.exe.config.old
- Size 2KB
- SHA256 ef3b901a33306fb93a00fcaa23765d614dcb918be12394f7fec9b33dff1bae30
- MD5 15de144b7f43fcbd9a290cc16fb63d36
- SHA1 03b8ef69a3d505d2221687116da657cf3e15c22f
- SHA512 5a18b7d32cd04e16a5a018bd8e48725d7320b24cbd586c35d867dd3090c133b37ddb0729da394572acbd7e8174799e4f10455017dcde2bd001f4ae73d35248f6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml
- Size 1KB
- SHA256 cd9fa471584f8fa125f0653284c60797c4702c0200354da3e672b84c97799f92
- MD5 de68d7e6fcafe0624a6f9b6b34e27015
- SHA1 be67f250316f6b6868c6525148756e5b14931976
- SHA512 03935ed456198b2c6301a726565fc94cceb00ad18971443952a3afc238a248324736512b8634f7296b4c15e34c052a20b53838f146c6402dff9835c368c4a509
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 43749ad8c1027dca29d35b86784a4540472aef6e1f93f6a696e72f7d05bcaec5
- MD5 5cb53a53e411b392e34994d2e9ea072b
- SHA1 f3412e1a667a78fd3b07fd442e98095c3441f6e9
- SHA512 eca2fc7063149791db1cd131967918afca57f40ecf7ac054269ef1fe07f5892176af561e00a56846d809aeafa5ed29dd19db175dc9aaf8e4fc7e7c1fa2eb1043
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 725535144b0c008821124951da12d08091804f4377357dd9e48589637cb31a09
- MD5 f1e498360bdf0b5612bc393b2a4fb31e
- SHA1 37153687859ced9a16e635d2a5eb19bb5ad631eb
- SHA512 a5475640eea769482a4687264eb58a0c41ca2ef3f18cca7dff6684fcf56eeed01889526bacbf3eb6addc5edc98028decab960e59816f5473fc09ef15674ea9ca
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 4eae8080d035d9e9019eb4760cfcc04630de179402c47f614589de89849c0a87
- MD5 914eb30bb439affc24febc5d1cb25b59
- SHA1 e23cef450deb6eac88cd9e13f324943d30610c3d
- SHA512 29ae7d80598bcb1bf6558d309527c444600b9aceee1097b2b22c49145024aa1bc6378bdfd8c2ccab290e4213db12dbb9b818f800494be0f4932baba2ab354d5f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 98d2f942227081ba47c35a38aab43dd682c137759a13b104f4c51df4c2f8e227
- MD5 f34db0979ad6d1dd25558c18f4f94b87
- SHA1 f40e538ebecc98004ba255d680460885a26caf3c
- SHA512 5f0db9f77bda8ab3c0fbf0b8b47a141842602b0d09a59b14c3919efa8e2e901f7d0eb7f5c4a14b26ecd030cb1b002bf920866be3f89572eba612e75d905b2315
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 e018d22a0c8994d465195e9ea2ce5cc1f684357d3093b0963733dd8b802f4a69
- MD5 42bd6e032cbf835e44d68aa68ed48bdc
- SHA1 fae284496de15bdb627989ab814654423dbe3942
- SHA512 d374b35784d92691b0bf6b900f9fef0661802296848e450b86e8e827407f94a0c853bf44468c59d58436644b927e316a35a5a0d1ccd375d342dd64a604f9ef25
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 1f0ac3cd56a4cd44801574ce72e0166bc1044017aca8bb356a61b7a8bb444e13
- MD5 7e646214df32182ebcd53746391918b6
- SHA1 eb158ae4b65a0ddf6fa7537f571b98c92e13f13a
- SHA512 68b1d28215ead1016cf20deed9a77cfb20c41502b539ac75a46366929ffa2cdd03ca97af0772aaa306dc6b9692fc68c5cafacfe74c30ca4159523092a3eb1db9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 498a52e7d7b1134f82fb1d3c37c0275b57f53275356876fb42d04d65dd139d49
- MD5 827260238d4691ac049c00e48a089f83
- SHA1 e7fd380fd2222906fe5e36efdde91ad6c1ae664d
- SHA512 bd0d33105b6b1d3f09c8732229414e79f283ba946ee6e6154f74f0cd4a8632d8a07932f033ae44092436cbebad5b8903db63dbf8408a227aee1bb3261bd17156
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 85b817aff7b92ff271fd296c10d20918254c65473f614a510d2c9e4647f44721
- MD5 f5d612bd899b49222e551be005becb85
- SHA1 0c1fa9650243c3d6c0bf73d754119a2dd444425f
- SHA512 2ad9a5df715673299db03382dbbe12af9b9f7be650212364ada4bcd47101814335ded11c3ab372193323e957cfe420dd73947e5cbe166b9e2028c8e4b5c4cc70
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 f2d03cee38d4ad5d2436b31067bd0ba97cc6d1cb724003ac56961407ac3cd5c4
- MD5 06cf8e142a30b407149670c86d5a5fb8
- SHA1 189c5585d9c82e191ff37e4519b845f4a78b250c
- SHA512 3de78a69fe01902797250a222b1c00001266eaf99e1c2a8706b64ad875dc29d4ce9068a983c392bdb27207736436153e3751fa9c01f54d725abc82978267e95c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 26548923eea5d8e8c1a5d0a996ff7a7d1c13e265b3a71166e44199fe856514ac
- MD5 c0d46309902dfb9df12eb1f9f68c4d1c
- SHA1 64df5838989cb6fbc78db551b324c00fb20154b9
- SHA512 5b0c63c7940a9e0c6282afc3bd295d53ac9f39f1ac1dd83ce699a74313137a1387f8b7b34c59a04dfca4196faa55883c27f88b4c2da529ee3227b2460717a5b8
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 1f04d3b317ede2921846d43f7deccf47dff73d7edb9a4fd4bd2522e8bd7b3943
- MD5 76da95915a7571739e6537a40703e7e4
- SHA1 657f2bdb04a6c6852e6a9a6c18def5fdaff173fc
- SHA512 59523ef90be77739d951e37d8d8b3cce04e9f0af9f654b091f6cd36a8b13fd81241129ffdaef56f036386c73385d5e18292bf54f006c5192017209b6d17419db
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 026620d5facbb5a73d870fc026def74935e2bf28d10ba6de8bc001f767c5277c
- MD5 3d6b0873b0ef9445370aa404deb10bea
- SHA1 221664d889666d7238e027de8d2b1e24e6bf2b86
- SHA512 754e41c746152bb8ef8f220ea2bd9d7011f867da3123cf8786bbc89da346b7f5c13f024318183f165b14a4f34fc4fee3f5b45c1a7a09eabba229323bb7500eb1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 28005d2bd44272a34e00e6d160bbbfcec8db734c6c1961b10be7e1d41340da15
- MD5 5c09fe55b5404c2c5ffc7ed66ae9622c
- SHA1 ee572cd1885017f3be865431bf92c515ec4de829
- SHA512 78f59b9e970c42bbf65af7924d24ffb96e4f4ad5b9b82481309d2ea680d6b9ec7332b0ec5fb2c2fb42a9d3da77f4dcb0b65036df11c28a6cde1b10b38edc5a94
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 b57b19661128e85b3c270b285d4e7ee1545f01068422ed83cda7924299954bfa
- MD5 f5fd5013c161280cd8d8d79580092435
- SHA1 f77fcd6d947ad655332281f2158e85efdfdbbc2a
- SHA512 dd4a002557ed36b029b37dcfb773054994907ca161106aa1eed4c7ce82a0126e4c8f85e9e7a7b7cb844274a449cbbfa15db7523f2d1518544240abb3783d2e03
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 79845f718453c8eaec435cb71bafb0935fd7d9b0b1f5dbc0f4c37b348188bc5a
- MD5 30e5f26e94641905e9988c303f7feee0
- SHA1 45b573cd15e53761bb0593413f6d1b963724ceb2
- SHA512 9d268151e048099880ca7b9376a9ede5c7d3550fd48dcc43574e8dd0658427188c50fe07a30724ed4cd1bcc6868d8d651697041641aa7981a12b2b30b291d1e6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 298ba8f979d18b504698cfcef4e0ab961a441f270838c101e9663dc44624c8d8
- MD5 0e8f85b91c000479cad28f142c1bedb5
- SHA1 4314068e2434435cabe01a42e123b76acc116266
- SHA512 f159f028e3dac795670f577087aea7efe48edb0b6e4deca7ad83e809c52ff60910a41314495c57d7097cea4e2b095c8feb075fb08e2ed031da197c89e0a7072c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\config.xml.old
- Size 1KB
- SHA256 64f9a1859341d2040e0010ab8c54769f0b1958a6455a697fe2e2273d6ed0d0ad
- MD5 ed80265a292ee02a2bd4d990ebf7c06a
- SHA1 3af0cd708a893f6cd48150018f92e41980ebc3f7
- SHA512 4ac525610e1b7ebd3a4851f16771966165d46ef11dd36a18cbb7dc09eca3375b701523fdbc3d15666137d182529265183f95611b8c640ef0f1a88a1b1956112e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\proxy\config.old
- Size 148B
- SHA256 e8a722c9389588456dbadc4d58c86372e2338dd15a1345e2ed1c5a6b5f7eb8b5
- MD5 9ae43ae699c2807d5f292e3f86aea006
- SHA1 2b4adc907cb451bf38179b9e4489c9e3f88f7ef3
- SHA512 de6b0c50c507907f536f02ef01b96bf35859760bdafa35d1b491ddcbaa8d62c78ce65b692ed4411ef1047116ece5740a3bc4445a7e6516d2f31a51fe020ae3fc
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\proxy\config.old
- Size 137B
- SHA256 3d716282c3c4ceee1cb7eae5c4ea69478b8cbb17bd7dcde59c70be07619e310d
- MD5 d4066b4bbd83f5e14be651464740f252
- SHA1 8805e48c1b7d858177ef91ee807f46055e785efa
- SHA512 131b2cf97a0d9c36f4fa8dcb249092a54a0143d68ac4b7ed02df6aa675d664cb1418bea69f3ac1fa1722f7fbf307578ae345fad74e6b823aab4c987f7e18f943
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\BrowserProtect\srvBrowserProtect.exe
- Size 131KB
- SHA256 68c47ffe774c98edd923c93e722f3d5b68476256d01402600797f350b533ecb4
- MD5 c47332b18a48cf81240594db31b4511e
- SHA1 b727f62dc28c5aacd120098f1fffca7f10b75d06
- SHA512 4aa0766d9f83d06c739046914976c911a029dd766a396abe0f673b60339f0e00b618655d98a675fec58317d99e9c2d2599f427c1bf2ae31ee9ad76fbe5aa618d
- SSDEEP 768:aGXIEx0Sr2albPknkhNwxR8QHqitKu1666D6stMktczzSc+JeQOaScA9DGRoGsP9:xrXL41woB9ibkIE8fbq/1T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsu468F.tmp\SimpleSC.dll
- Size 61KB
- SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
- MD5 d63975ce28f801f236c4aca5af726961
- SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
- SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
- SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsu468F.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsu468F.tmp\nsBR.dll
- Size 202KB
- SHA256 99378990a56718900816dcaf66c377e89216e8165cafafc0593b24b5262de5e6
- MD5 b505e79e29bd52d8d7d153d7a228dffb
- SHA1 9b7e08eede7e30eaf192ae1515e13cc8dd3962f0
- SHA512 9388211085d47ddad412d9d00b6454b086c0deb088272f6377deda90e08df1e5cfc7a754117c1a6bedea3bde66c9a63b5634bf82a8201e53255c538a4724c739
- SSDEEP 3072:7xZ5/bNy3DpLei+D3NlRSOykAIw+M3Y9igDjfMRg:tT/bUleVNGO2EkRg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsu468F.tmp\nsExec.dll
- Size 6KB
- SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
- MD5 acc2b699edfea5bf5aae45aba3a41e96
- SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
- SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
- SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsu468F.tmp\tkDecript.dll
- Size 222KB
- SHA256 0ae09d65f5284409e6d9a2d40d7aaa8cbf1dd1815e67a9c12a9557f5de1f7832
- MD5 ea79ad436f5e54ee5dc2aba13fe1b15a
- SHA1 66e248962bfb1f370796dac393621367638c21b1
- SHA512 dbd40403126c6ef6f5747c900809140c8897376f03696247cd8d10431bec7abb0c7191761e8ea551cfde2234059ec087ffbca54510ddf0dc78b8329f598fab2e
- SSDEEP 3072:db0IC6Lh2wWcNA5ZX9VZo6w+ck5yUbTIQ2npANCrYJ5+S+cHOZjvqte36wI1:db0GLhqa8ZorcyQiTrcwZjiu6wi
- MD5 SHA1 SHA512 SSDEEP