a663c747622cc5888d09d2664b722033fe8e044dccb9ca510918eb626d37fc32

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe
Size

531KB
MD5

25169f1bb91480ade7e199647e85f60b
SHA1

15f91dc1b0bd697d11268d924c11e86d921a2ea3
SHA256

a663c747622cc5888d09d2664b722033fe8e044dccb9ca510918eb626d37fc32
SHA512

27ee8ddb6a26268e92d9fea6b4b560ed953f1397bd9d6b1a4bd72c307566147bdd38835e659d4f0c44b33a7a6ddd11005226de52a6ebb720d8104dfebaecd540
SSDEEP

12288:JZigw0DdDV0YPp4ZFwr7WNs8m4C6R91p4s/xioS:JZigw05V0U4Zyr7Wax6tp4Q

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2664	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2136	smsa.exe
2636	smsa.exe

Loads dropped DLL 2 IoCs

pid	Process
2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe
2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\dvzAZc08QoRQcmA7yoRfhaItvOo.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\jZnZ33DA_uDhotnaIsXNbY1za-s.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\background_gradient[1]	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LI6CzlNYU7PeZ9WzomWpS4lm-BI.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\jk2F-rpLS_Gysk7hn3CVhA9oQhY.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y806JrL6RagU8tqNI_iN1M1S1mA.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NnFHhz2jL6yzChtIhaB5IIVKY5k[1].svg	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ln5TQq6AIWfcBlduDk-5bnaJMpY[1].jpg	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\jk2F-rpLS_Gysk7hn3CVhA9oQhY.gz[2].js	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\wg-pUtVezL3gQL1YtqrPMojM8W0.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\sbi[1].htm	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\yjXVFOxf6UdoTA2BOwEH6n4ClfI.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PgVOrYqTvqK49IEnVEVlZVYfA1U.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\XPMY79CW.txt	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\pXVzgohStRjQefcwyp3z6bhIArA.gz[1].js	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\YUVSZDEN.txt	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\search[2].htm	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\http_404_webOC[1]	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\fHuyi8cU3N_FKljgNDAU8JiBqx0.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4xAIx2Px9QXAJnm8t8uPp3CmNSM.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NRudXMsXYtnM1BQyD6xvAZoudZM.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2MNFZoUV19wQglFaxwi8z4iyQlU.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T216orvW6yyZuj72fNrfvtY47FI.gz[2].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\httpErrorPagesScripts[1]	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\background_gradient[1]	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\4ORTYNX4.txt	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\kzHfYwAwahpHm-ZU7kDOHkFbADU.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9Jq3Ns7baG5VrIipcpUcjk_s9GY.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQQTu0f9ldw9QQHZ9i-TAYjSeD0.gz[2].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ihC7RhTVhw2ULO_1rMUWydIu_rA.gz[2].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HsCou58SDvv-sLUSbqxcvzTnbfo.gz[1].js	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\8AXX85KL.txt	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\httpErrorPagesScripts[1]	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\89A47T3R.txt	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CrmTxQ9X-RHbrTT30VBInDn1eVI.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\we5MTeTkjiic9oaBxzZpmSWxZ5k.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\rEyf5r6GntWGoi90dN9CzUTNUOc.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YZk8JWO0h-B4ClAA3BQlzKOiVLs.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\uIb67AAMNs7MKLB7-TYTuX5F-zA.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5g-N9K-X1ykUl3QHEadPjpOM0Tc.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\95z5wMy4UcfbSSSlSw780vQ5jKA[1].jpg	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\CB11CTP3.txt	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K59yR1AD9pXD4Qp7EsPhFjZsOjo.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5c9FUCmY63yWNgxKxOq0sA1uDNs.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\43BJuM7qM_8Wd1WfIZM2_oK9zrw.gz[1].js	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\89A47T3R.txt	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\dWoBZo5dRP3bgmUuN5Vqofu8kbo.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EbWMC3sa1kqKKLU2JpggRmK8hjs.gz[1].js	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\errorPageStrings[1]	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Ymz2b9mIH-9i430DH6_cbhGPzdE.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[1].svg	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\yjXVFOxf6UdoTA2BOwEH6n4ClfI.gz[2].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\fDgf7Oh5R8mPygWLQcaNRoJGj5Q.gz[2].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\down[1]	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ihC7RhTVhw2ULO_1rMUWydIu_rA.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\w1gdrM6p5Kmzh4Gi9fKcTaefJ1s.gz[1].js	smsa.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W8bLYGpay8IFp3H_SrUDKaBAn30.gz[1].js	smsa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\http_404_webOC[1]	smsa.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\KBED240704.log	smsa.exe
File created	C:\Windows\KBED240704.log	smsa.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	smsa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1601 = "0"	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	smsa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\Navigating	smsa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{822F5F2E-9447-4FC2-9826-69DCB4956D38}\WpadNetworkName = "Network 3"	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\Navigating\.Current	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	smsa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	smsa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{822F5F2E-9447-4FC2-9826-69DCB4956D38}\WpadDecision = "0"	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps	smsa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-bc-26-6c-29-8a\WpadDecisionReason = "1"	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	smsa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0109000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	smsa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{822F5F2E-9447-4FC2-9826-69DCB4956D38}\WpadDecisionReason = "1"	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{822F5F2E-9447-4FC2-9826-69DCB4956D38}	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	smsa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	smsa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	smsa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	smsa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\06-bc-26-6c-29-8a	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	smsa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	smsa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smsa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	smsa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{822F5F2E-9447-4FC2-9826-69DCB4956D38}\WpadDecisionTime = d0bd6b79e2cdda01	smsa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@ieframe.dll,-12512 = "Bing"	smsa.exe

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	smsa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	smsa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2636	smsa.exe
2636	smsa.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2136	2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe	28
PID 2336 wrote to memory of 2136	2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe	28
PID 2336 wrote to memory of 2136	2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe	28
PID 2336 wrote to memory of 2136	2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe	28
PID 2336 wrote to memory of 2664	2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2664	2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2664	2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2664	2336	25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25169f1bb91480ade7e199647e85f60b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336
- \??\c:\Recycle\smsa.exe
  c:\Recycle\smsa.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\25169f1bb91480ade7e199647e85f60b_JaffaCakes118.bat
  2⤵
  - Deletes itself
  PID:2664

\??\c:\Recycle\smsa.exe
c:\Recycle\smsa.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\25169f1bb91480ade7e199647e85f60b_JaffaCakes118.bat

Filesize
224B

MD5
250837a2e5a1a08e777548ee2b5b874e

SHA1
3b2d7adf9e52ed4c2794c1349861f5f877ee4a09

SHA256
57dd125dec82d4dc606d149b57f70836a1017e339e63c1783b8a6968992cf084

SHA512
b3636374a61763dd6e37ae1e82930d9479a4222666bc2ba2557f1bf4e0d1d5e8ca484af9bdf4c4672c019357df017fff5030a4b3a2d17960b074d08afe48c663

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

Filesize
579B

MD5
f55da450a5fb287e1e0f0dcc965756ca

SHA1
7e04de896a3e666d00e687d33ffad93be83d349e

SHA256
31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

SHA512
19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

Filesize
252B

MD5
41536a7a5042b94484a9578c976704d7

SHA1
f4ec75ae292a7154402b4f7a26d8eacf96a7affc

SHA256
a462f0593a9f7e528a7271dceed63adeb24b9ee3131bef7cf916a9cb915acb3e

SHA512
8788604af97d8a4648fb9f169015c56a836f0fb82ddac9604ea187e0016a688a3f0f501676c240895022973132f0b10fa950d14b006f2c01c5a50e13581958cf

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a65d49e638ac2bc7ec165101bdf1fcc

SHA1
60f228122a5955cea46d2ef5e2b5a0695e04a99f

SHA256
d74b098774a7df1d4771b4c90951d54cd98c6254a193b2ac31fc84ce80e34ac9

SHA512
4c5cd36cd486dced7f64671d204cd3ec548e0cace639b0c65546bd0413e472ecce61abc89b77e08969ceac248264290bdf70fead61a6abdca0c69d066f776871

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5f32a1686901fa7080cf487dc2a57fb

SHA1
b4e9e5f6b821f46f2ff2515d9012a48de50eac1a

SHA256
e5bea28f6c6208aaa966d1c77361ff9f457923592edeb54b49a366fce82a00a6

SHA512
8e3d69d302a3f0efc0cb85530e2bb311d66a9d51cf3acc0d1d92eecbe6fdf4b59739109da95cdbe4c1fea71231b3d739e098a41be1997f08469ed914d41acfee

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cc950b6b02fca190fe6562764ba312b

SHA1
ed1e7201eebc2f7323764e6c2a7c1a67c161ec5b

SHA256
30df6aa75af0076aa7fe5189e8c6287adfab2b8de20ff853078e2c0473e41e70

SHA512
183c82b13f848e6b4da19f320cb325c5e8febed16a530af0f47142f95d93128b68cd670eeabbcfa989d26feb5b68360c40cd769c7220e55802845e6f6a723a92

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cf3d18571acbc4fa37ec772e045dcf3

SHA1
d598b491ea5ac7cee41fba786d88d4ad054bff51

SHA256
7b84cc87e0b9a797b556a9c4b5853c5a7f6d1a7e2fe00db60291a835521d1b8e

SHA512
ec05c132ccb5d4594939c26b0bf863f064076672ed69d6ee5e3dfc11734ab1609a5dc0d1f26ff13aabc1df70b67930cbde7ad3ccc42f3a053cf8a4e6a197f6a4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1538da1898f0d9f4fe183083ef051504

SHA1
1dc072e51ac0250a799c0bfb82ba82b6d38f4ab7

SHA256
c115ced8f0570e096c80590df12360a9f34293fae7ad47669072eed8061f473f

SHA512
af28ce434317618671a20798e3e6f2d19c87d7db54f58b426389089ef61b4de44d407b996ab291125dc6ca2f525f35ffdd66b6009bb362f9b2cb64463317c1b6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
206ba7d081aba61d4b51f1f735c30594

SHA1
a4fb99e8b079cc1204a70d7bdcefc43a48f45693

SHA256
8adc18cbf0e1f648bac642c07e496e02979efa8cf5efbc521f3b9d630396755f

SHA512
066fd204bc89da6adf92da77168aa8f9d7a49cb035c279730e666609175599081129ca453e53be700f4dc5507738b7ece4b6dc4291445da376f8dc0d98bc62ca

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35ea62cdf4f4c437781f06ac10c0af61

SHA1
445c24c6aa5779a2bc455e388069d26a6efe5ea9

SHA256
8075012183e8e1896e1380aa1065eb5fdb929c13240e3b25dace738d48e4c0c4

SHA512
d35ee30426905e4ea84eb596aff19e4af79e9f1c1887b7abd1854a259a2abb24ef56436744c32955e6b5f59c1690e06f6f8816cc4439a871e1bf1462b890c2ae

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64b98091d52ec6d3790f82ae9df672fd

SHA1
857dbd4dd8b1c33e11c9228e1bb226b0f2728de4

SHA256
a18993b58e5a50944bb63a788048e6c25c50d29821951030bdd4c6525a96a08c

SHA512
e5443e893783283f89604ca4aa8f6644680ad8146e06ce26dfbfef79d63c6ab1975b629a1f6979b4406e3572cef0c2bf3781f0d34a6595dd3e79cf4bce8a0917

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
77dac7e040a0552a8822bc16a540887d

SHA1
32b7766a3d88a15f9e17b1e0352bae3cbb72588d

SHA256
0e156c9ffb52d6ee2d4a35ed41bc0bfd552047c3cacd26060603c8699cfcda6f

SHA512
fd942193015e78f443a28435c7adfb77b7dcef9727e4cd56470f5a6ff72b4730181ce457a0fe3676bd3034a9133486dad02e9e6bcff5a4ec4b82e85a2c17f81b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5g-N9K-X1ykUl3QHEadPjpOM0Tc.gz[2].js

Filesize
1KB

MD5
f4da106e481b3e221792289864c2d02a

SHA1
d8ba5c1615a4a8ed8ee93c5c8e2ea0fb490a0994

SHA256
47cb84d180c1d6ba7578c379bdc396102043b31233544e25a5a6f738bb425ac9

SHA512
66518ee1b6c0df613074e500a393e973844529ca81437c4bafe6bf111cba4d697af4fe36b8d1b2aa9b25f3eb93cd76df63abfc3269ac7e9f87c5f28a3764008e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CrmTxQ9X-RHbrTT30VBInDn1eVI.gz[2].js

Filesize
19KB

MD5
1ca51e9050f85757917cd83ed63649b6

SHA1
7ce957beef79f6ea090f6796dbf3dbe51c344715

SHA256
c535be6a940ce136ebe20c950466771c21fafd9038669110474a62da112a3ecc

SHA512
3bb2214097a559070fb840faabdf4c566ab777f5700e0a72b999c619b4b34dfb3a30acd382125a742ed1dca40689b80c0be751950f802e300df4f65c5ceacf1d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GK9SuRKiu0QbKYnVgoAlgmuWrNU.gz[2].js

Filesize
2KB

MD5
17cdab99027114dbcbd9d573c5b7a8a9

SHA1
42d65caae34eba7a051342b24972665e61fa6ae2

SHA256
5ff6b0f0620aa14559d5d869dbeb96febc4014051fa7d5df20223b10b35312de

SHA512
1fe83b7ec455840a8ddb4eedbbcd017f4b6183772a9643d40117a96d5fff70e8083e424d64deba209e0ef2e54368acd58e16e47a6810d6595e1d89d90bca149a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LI6CzlNYU7PeZ9WzomWpS4lm-BI.gz[2].js

Filesize
1KB

MD5
56afa9b2c4ead188d1dd95650816419b

SHA1
c1e4d984c4f85b9c7fb60b66b039c541bf3d94f6

SHA256
e830aeb6bc4602a3d61e678b1c22a8c5e01b9fb9a66406051d56493cc3087b4b

SHA512
d97432e68afdaa2cfaeff497c2ff70208bd328713f169380d5afb5d5eecd29e183a79bec99664dbee13fd19fe21ebae7396315ac77a196bfb0ab855507f3dacf

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PgVOrYqTvqK49IEnVEVlZVYfA1U.gz[2].js

Filesize
576B

MD5
f5712e664873fde8ee9044f693cd2db7

SHA1
2a30817f3b99e3be735f4f85bb66dd5edf6a89f4

SHA256
1562669ad323019cda49a6cf3bddece1672282e7275f9d963031b30ea845ffb2

SHA512
ca0eb961e52d37caa75f0f22012c045876a8b1a69db583fe3232ea6a7787a85beabc282f104c9fd236da9a500ba15fdf7bd83c1639bfd73ef8eb6a910b75290d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T216orvW6yyZuj72fNrfvtY47FI.gz[2].js

Filesize
7KB

MD5
e51b7eb6cb390c2123c4fb6beff38fe0

SHA1
e30f700b250bb6c43c07ff2a654b7c5a464c6d5c

SHA256
3350bf7fb98eecb656369997de56fb9f8a8c97c28780cae0e64b70e5e7575604

SHA512
c03f314a5d882bd94843bf9f651bb6d9150f6580a78ab14d470ae7c2be54c9ab3e68196d889b27ec590ff87ab0151cae7655d80e1efdb1c4a43d9d2afaeef3ec

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y806JrL6RagU8tqNI_iN1M1S1mA.gz[2].js

Filesize
891B

MD5
02b0b245d09dc56bbe4f1a9f1425ac35

SHA1
868259c7dc5175a9cc1e2ec835f3d9b4bd3f5673

SHA256
62991181637343332d7b105a605ab69d70d1256092355cfc4359bee7bdbfb9c6

SHA512
cbb43000a142807ff1bb3bfac715cef1240233117c728f357c824ce65b06be493df2306c7b03598817f09b02e9e36ec52314f88467679c5bef3ee1504a10c7e6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\cJksCHwhB_Z32I0ytWPMUDsybak.gz[2].js

Filesize
226B

MD5
a5363c37b617d36dfd6d25bfb89ca56b

SHA1
31682afce628850b8cb31faa8e9c4c5ec9ebb957

SHA256
8b4d85985e62c264c03c88b31e68dbabdcc9bd42f40032a43800902261ff373f

SHA512
e70f996b09e9fa94ba32f83b7aa348dc3a912146f21f9f7a7b5deea0f68cf81723ab4fedf1ba12b46aa4591758339f752a4eba11539beb16e0e34ad7ec946763

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\fDgf7Oh5R8mPygWLQcaNRoJGj5Q.gz[2].js

Filesize
622B

MD5
3104955279e1bbbdb4ae5a0e077c5a74

SHA1
ba10a722fff1877c3379dee7b5f028d467ffd6cf

SHA256
a0a1cee602080757fbadb2d23ead2bbb8b0726b82fdb2ed654da4403f1e78ef1

SHA512
6937ed6194e4842ff5b4878b0d680e02caf3185baf65edc131260b56a87968b5d6c80f236c1de1a059d8158bc93b80b831fe679f38fc06dfb7c3413d1d5355aa

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ihC7RhTVhw2ULO_1rMUWydIu_rA.gz[2].js

Filesize
1KB

MD5
cb027ba6eb6dd3f033c02183b9423995

SHA1
368e7121931587d29d988e1b8cb0fda785e5d18b

SHA256
04a007926a68bb33e36202eb27f53882af7fd009c1ec3ad7177fba380a5fb96f

SHA512
6a575205c83b1fc3bfac164828fbdb3a25ead355a6071b7d443c0f8ab5796fe2601c48946c2e4c9915e08ad14106b4a01d2fcd534d50ea51c4bc88879d8bec8d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\jk2F-rpLS_Gysk7hn3CVhA9oQhY.gz[2].js

Filesize
824B

MD5
3ff8eecb7a6996c1056bbe9d4dde50b4

SHA1
fdc4d52301d187042d0a2f136ceef2c005dcbb8b

SHA256
01b479f35b53d8078baca650bdd8b926638d8daaa6eb4a9059e232dbd984f163

SHA512
49e68aa570729cc96ed0fd2f5f406d84869772df67958272625cba9d521ca508955567e12573d7c73d7e7727260d746b535c2ce6a3ace4952edf8fd85f3db0dd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\kzHfYwAwahpHm-ZU7kDOHkFbADU.gz[2].js

Filesize
3KB

MD5
fabb77c7ae3fd2271f5909155fb490e5

SHA1
cde0b1304b558b6de7503d559c92014644736f88

SHA256
e482bf4baaa167335f326b9b4f4b83e806cc21fb428b988a4932c806d918771c

SHA512
cabb38f7961ab11449a6e895657d39c947d422f0b3e1da976494c53203e0e91adfc514b6100e632939c4335c119165d2330512caa7d836a6c863087775edaa9f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\pXVzgohStRjQefcwyp3z6bhIArA.gz[2].js

Filesize
924B

MD5
47442e8d5838baaa640a856f98e40dc6

SHA1
54c60cad77926723975b92d09fe79d7beff58d99

SHA256
15ed1579bccf1571a7d8b888226e9fe455aca5628684419d1a18f7cda68af89e

SHA512
87c849283248baf779faab7bde1077a39274da88bea3a6f8e1513cb8dcd24a8c465bf431aee9d655b4e4802e62564d020f0bb1271fb331074d2ec62fc8d08f63

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\yjXVFOxf6UdoTA2BOwEH6n4ClfI.gz[2].js

Filesize
1KB

MD5
a969230a51dba5ab5adf5877bcc28cfa

SHA1
7c4cdc6b86ca3b8a51ba585594ea1ab7b78b8265

SHA256
8e572950cbda0558f7b9563ce4f5017e06bc9c262cf487e33927a948f8d78f7f

SHA512
f45b08818a54c5fd54712c28eb2ac3417eea971c653049108e8809d078f6dd0560c873ceb09c8816ecd08112a007c13d850e2791f62c01d68518b3c3d0accceb

Download Submit
C:\Windows\Temp\TarA421.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Recycle\smsa.exe

Filesize
531KB

MD5
25169f1bb91480ade7e199647e85f60b

SHA1
15f91dc1b0bd697d11268d924c11e86d921a2ea3

SHA256
a663c747622cc5888d09d2664b722033fe8e044dccb9ca510918eb626d37fc32

SHA512
27ee8ddb6a26268e92d9fea6b4b560ed953f1397bd9d6b1a4bd72c307566147bdd38835e659d4f0c44b33a7a6ddd11005226de52a6ebb720d8104dfebaecd540

Download Submit
memory/2136-11-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2136-22-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2136-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2336-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2336-24-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2336-9-0x0000000000360000-0x00000000003E6000-memory.dmp

Filesize
536KB

Download
memory/2336-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2636-50-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2636-51-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2636-23-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download