Analysis
- max time kernel
142s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 15:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02cabbff47b4a547c15cebbc76619cef_JaffaCakes118.dll
Resource
win7-20240419-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
02cabbff47b4a547c15cebbc76619cef_JaffaCakes118.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 02cabbff47b4a547c15cebbc76619cef_JaffaCakes118.dll
- Size 483KB
- Sample240622-tdh65starb
- SHA256 f2e9375f210583dc3f2c06400a4deb996f8b9b80cf518169aeebe60a48c33fbb
- MD5 02cabbff47b4a547c15cebbc76619cef
- SHA1 23c7977c567200c5fbb2c114473263c2874adc78
- SHA512 b96cf8ba8dad3c9155fb52ab0fe49001dcae0fd9e22c1eea5f96d491524f3b8faec23f3416d1cbe0b8f2ebb3b095dff185835efaba447d1d11b3a32491823510
- SSDEEP 12288:ZUCQo26AdqG+SDrFnDayij1XpzWtdTvsH:ZUcAqByrVRe1XpzidTvW
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ebnshuhpgvny = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\02cabbff47b4a547c15cebbc76619cef_JaffaCakes118.dll\"" regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{059AEA46-EAB0-9FE8-CBF3-7526400A9597} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{059AEA46-EAB0-9FE8-CBF3-7526400A9597}\NoExplorer = "1" regsvr32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425836762" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b5680dbdc4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009825f8bcc4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a00000000020000000000106600000001000020000000eb8270a9b158dad9fcd31b6b010c43193e158a9f8b976e8a9be445b60290c0c7000000000e800000000200002000000014f4d55eb386e758869c52fd5fdae26743b783a13ccbe22a0e22ae49e7861c5d20000000738ff4d609dc14d8b4962566d72272608c28ebf93ea31e14aa234e27a9accc3c400000004485d386a3f62cdb4d70ba669f2b4dcfc00c5c58919158bb1bddf323913dde103308dc060c2dd17836a9bfe83c214a473602a59455529dd3992e9124a15df515 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31114428" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31114428" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3495247100" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ea13d1bcc4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a000000000200000000001066000000010000200000005bf604cb9cb82a7705eaae859a85516d2df06e9d1d9852f948a0f32794ea5828000000000e800000000200002000000008413d88a5b68a20fc49b7c4aad08f403b26a7a8c171ebc995e75b2f1bfd6872200000003c7d098c2c5f8fd15b57862cb60361567b5309cfa4928c2120d3564eb3252466400000003061653d717e5949273b8f5f7b05801124a4744a4b23be4c13b50d2620b6f8c53a80b8c1c58f1ca9e55f1e71906ea7b8343619134c016812e23a0e9deea258b9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31114428" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a00000000020000000000106600000001000020000000df73ced72836921b02f100eabd975c78d2dfeca66a6f86fe9302fb1d7c6b038d000000000e80000000020000200000001bca62a6c7415b135dd1f93c39b041c2cacb1a374ba0a927b76d4d8599e9bcc7200000006e220f9b2cbb5cb78e7d45179dd6a2aa891e0e81184c69bfc48c5072d03d1311400000001d84dd59b4cbedd5d9e89cefeb2cfe5dc88d84cec5c2d1e09cf893a52875ec235f7c8eee4244ea697dcddf64319b510185dea46c5629431e35f4643dccbd0dab iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a000000000200000000001066000000010000200000006e0e95e89a92e8cac7296a4c88fa03d2a6f888619c85b16ce17c7b5ef0ac9104000000000e800000000200002000000024e3a0ed8584dea0c20b28fb88b5d51e0e47620ddac1bc4c9b937e3f9281ac3f20000000f3df768119cf654b67a0224a470d80c85594f58cb6f214a6791362ac4f0941ce4000000017d4cc72a63d49766cf59f8ae5fe75b94e608635ac19349557930be932b040fbb218bc9f1839b61c0b1164ad6e2d28d8b3221f0b6dd6a539cdf086ee891937be iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3495247100" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d11fd1bcc4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31114428" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a0000000002000000000010660000000100002000000049babab7443f44fc0fce879748d7d9fa240a3d91c2f5f7c8533ec5e4c7e8b0f5000000000e8000000002000020000000b9fcaaadc2c469f99d1df9e44003ee1d5f7d7ea5d6d50b51745e7bb9b18a0f5e200000007e41be953940622dc57969b1346d2d9b087c62fbf5bab5a279098c693716edfb40000000845050870b5351749a73279ecdabe1a182278c68e6d417162a2c41913cdb7db17b83a1947127b79c8eb169076c7b1bfbbba3e04a2aaef0dad2940c7a538d9fa7 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3497121970" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60488ae2bcc4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e1efd3bcc4da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3497121970" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a00000000020000000000106600000001000020000000550417b33d5ace1331383aaa3e95c57a84696b7e9bb6339478b372e8482a0924000000000e8000000002000020000000cbaba015abda144de83365b870db87e4dc31ce85103a33535ba16e2ecdb6f4dd200000008e084d916137f4952d55ae76ea6de67985a3b306ab7d75f4cad03d8dc739563c400000007b2aa46876ff9492ba6788520405c8ab66822a2d1fa4c48b0c3d52eaa0b664cbd9d11669cb1f008706e5099ef21529bf354da2717eec3517275d566757cda003 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FBDB00C3-30AF-11EF-B1BA-5AE3054E25D0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{059AEA46-EAB0-9FE8-CBF3-7526400A9597} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{059AEA46-EAB0-9FE8-CBF3-7526400A9597}\ = "rightonadz browser enhancer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{059AEA46-EAB0-9FE8-CBF3-7526400A9597}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{059AEA46-EAB0-9FE8-CBF3-7526400A9597}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{059AEA46-EAB0-9FE8-CBF3-7526400A9597}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02cabbff47b4a547c15cebbc76619cef_JaffaCakes118.dll" regsvr32.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4092 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4092 iexplore.exe 4092 iexplore.exe 1248 IEXPLORE.EXE 1248 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2552 2920 regsvr32.exe 83 PID 2920 wrote to memory of 2552 2920 regsvr32.exe 83 PID 2920 wrote to memory of 2552 2920 regsvr32.exe 83 PID 4092 wrote to memory of 1248 4092 iexplore.exe 86 PID 4092 wrote to memory of 1248 4092 iexplore.exe 86 PID 4092 wrote to memory of 1248 4092 iexplore.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\02cabbff47b4a547c15cebbc76619cef_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\02cabbff47b4a547c15cebbc76619cef_JaffaCakes118.dll2⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2552
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:1064
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4092 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 7e65804748310831cd8d58de2c6c1917cd75ee004ffeb74b6b876dc8aa840f83
- MD5 39789013e9648787db5932ed94566836
- SHA1 eadc0fa76b355ff12c1c740cb36963d6c0b46ade
- SHA512 014945d6958c8866dd112feb5c9f47434e81c4f675f02f7d52063a2944f3c1e1c6bce81d014f7e5ca60323bbb1a52dd8fd41f30279b80d356e2213338ccd348e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 aaf4392e459990a40e3ba2c21cbb75fbb35e1fcad42eae9753ea107c31c3438f
- MD5 d82ab7889db104dde3a116481f08ed3e
- SHA1 34ec800b99aff1d21b58a30de355ca1f075426f6
- SHA512 cd1bf04a5f010f39274c2d04cdffb394941d3d79f9876a0353f25ab984d63ba400e494d83a4bd9f7244c28a4e3e19406f547d068fe66eb9a84052519e96faa05
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC5F0.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\httpErrorPagesScripts[2]
- Size 11KB
- SHA256 65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
- MD5 9234071287e637f85d721463c488704c
- SHA1 cca09b1e0fba38ba29d3972ed8dcecefdef8c152
- SHA512 87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
- SSDEEP 192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\errorPageStrings[1]
- Size 4KB
- SHA256 a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
- MD5 d65ec06f21c379c87040b83cc1abac6b
- SHA1 208d0a0bb775661758394be7e4afb18357e46c8b
- SHA512 8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
- SSDEEP 96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
- MD5 SHA1 SHA512 SSDEEP