Analysis
-
max time kernel
140s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
General
-
Target
04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe
-
Size
23.6MB
-
MD5
04b3e58bcb0b43fa1317e54788102484
-
SHA1
6cbd0a39cce5c11b814b391353b78401f552c930
-
SHA256
c7d868c31d644792f44a209af33ef66e17a069b474ed02fb812a4bd57e2d45ac
-
SHA512
3d24841355820a077b2fd79df42f4f6c8a844d8b049a7ce72641e32129486fedb0ef6dc21ff85603423eec86c7705ddc80cacbf94be5f728b0bf9f3abb1fd910
-
SSDEEP
49152:XYgph7GBfWLHQ+V8tgJd8oDkYOMjJDkYOMwwnMb4PmyVPsC1:XX77GBfWs+CgaVYO2GYOXwnS4rVPsC1
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\extrac32.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\iscsicli.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\SetIEInstalledDate.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\AtBroker.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\shutdown.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\control.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\user.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\attrib.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\auditpol.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\chcp.com 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\Netplwiz.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDCT.EXE 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\prevhost.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\systeminfo.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\certreq.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\msdt.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\mspaint.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\tree.com- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\w32tm.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\at.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\autoconv.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\help.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskcopy.com_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\verifier.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\instnm.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\net.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\ocsetup.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\waitfor.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\dvdupgrd.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\fixmapi.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\more.com 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\bitsadmin.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpapimig.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\autoconv.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\format.com_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\psr.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\srdelayed.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\ipconfig.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\MigSetup.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\mshta.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\cipher.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\dnscacheugc.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\iscsicli.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\psr.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\relog.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\tcmsetup.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\msiexec.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\SysWOW64\netsh.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\updater.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\rmiregistry.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Windows Mail\WinMail.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmprph.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\klist.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\pack200.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmprph.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\ktab.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\MSBuild.ni.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\Narrator.ni.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\PresentationFontCache.ni.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\SMSvcHost.ni.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\ehome\CreateDisc\SBEServer.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\ehome\ehtray.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Panther\setup.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\dfsvc\bb4a1994db088e84b9d383271b082250\dfsvc.ni.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\ehExtHost\ad37b6e3a1cb1081592f1c5797ae9dad\ehExtHost.ni.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\WsatConfig.ni.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\2bd538d545e15452202ef3b41080e2ce\ComSvcConfig.ni.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\bfsvc.exe 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\ehome\MediaCenterWebLauncher.exe- 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe_ 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fe23ea8be2da01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1384B4E1-4E7F-11EF-8507-5A9C960EEF88} = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000d0a81817d5cc5626def0983766defcf41038baaf22d95b5af830c0d3fccf084b000000000e8000000002000020000000d8876d61b45edeaaca3f16b3ec24a9cf39be036dfb65d761c9b962457b76de7c900000004fe6d861b2d707727790fc6948e148e2e0f76a6304254f05f980171ae62bf46275792144471a94e22040762cc4467613099df3a719b78d85be8344fe5628216001a3cd93821017b8c687a7ad96a5526e4ba2b78abb2b27a8fd0410fc1c0f1b99a7173a0370a4aadbccbb86a3fa39fe0730bd9fb5d5fed79f3ac8a952c56f0e9cd4481c37be58e55d438b194736acad56400000007a38c47f971a34008abcbcbecca4c5fd887b988a54232ff99615c0be1fe00a8fd8b062e83f0a6446829ac142f3874839e73db45226333bf7f6c304bf874f0da7 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000028431d4c973656f939d8385eb83834c9b1379c56373d4a7cfc240c1d371248de000000000e8000000002000020000000891bc93f9024f2000128f9c6df893b5ef0b31fe5d5abe68f3b15cb4d0dcb18fb200000003da310cc3a3e5a20133af9255d570e046f2031b7bd9e2b80ad3292818a4f2c2740000000ac07b6e4f2d8173f1f5cd75b573df55a38b0d91893ad30e5338a72736cb2eba058b323ff0c79d954dcb0014b8f0afc4ef784d4ab76e37e4bb471172d9e38ac21 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428511191" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1232 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1232 IEXPLORE.exe 1232 IEXPLORE.exe 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1816 wrote to memory of 1232 1816 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe 30 PID 1816 wrote to memory of 1232 1816 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe 30 PID 1816 wrote to memory of 1232 1816 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe 30 PID 1816 wrote to memory of 1232 1816 04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe 30 PID 1232 wrote to memory of 2720 1232 IEXPLORE.exe 31 PID 1232 wrote to memory of 2720 1232 IEXPLORE.exe 31 PID 1232 wrote to memory of 2720 1232 IEXPLORE.exe 31 PID 1232 wrote to memory of 2720 1232 IEXPLORE.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04b3e58bcb0b43fa1317e54788102484_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2720
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.8MB
MD537c50316cd3c3dbcfc0e9c58ffe5c2d8
SHA147f32bd981fda431b26b7f75f342df2ce284ac5d
SHA25681fc3fa3b87c543e5a1ebed551c32c6891e2cc2999fb6b1809abd9db6cfdda79
SHA5123299e9f17670cd8bece0b4b53797c04a141c46b15ea509f422466aa2483404943d6d874a7f61087131a95fbd7bb1f38cb7c2dac4d882da20d5059fc2bce41196
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543243e6cec4c36812e13ce0af1a17b75
SHA17c1022e71579649b765101f080663fb14c41ea72
SHA25671d9ad6cca8be38cdd432805ef9b3d849e23792af24a1aa63f306448b0db4894
SHA51267d4d64ecb57f64f0c5125ae650d9023f54c378d7860bbfcdc8424177690d2ce3ef09e1b8222c240f47522e3781516ae8958dc199f111dcfcbb501a1de3d38f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5851f36eefeb562eae003d0f6c7749308
SHA18542f3dd0f9725f5042fb12b3ba1cb4ebb7bdb86
SHA256074eb29a1ec478cb7ace534e65d4b882b9cff76ea16cb194cc2bc8bfd971f068
SHA512f61f0d136473ec3f7c033cb2477ec687292acaa770dfcd0c095b42698e351045c870dc21d8e45b58127d30d83f21211cc8cd6ef22fdb227f51e71333eac3089e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50abf27659b2da27739143d8c77099ff2
SHA1532e5a1fef656010badffacfb72a8fa266d8dc9d
SHA256b82bf4190d44e01ca1a5b95c9cc2879588d3da004da96ba909cb5ec00c120998
SHA51273a988b9ec91982ac576916387b9b29593328b9122b1dac69471deb5072efc0bfcaa2d17378c54b210974c523b76aa2cf6e23f039d0aa29463ee891aaacb0b46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e78f2e9bd299092a0c03d2e26debe0e4
SHA19e13094b52b91419160bc7d271473f3e95c8a6cb
SHA25649b96bb98cecd3988d901c9d005fc41f065ec891f6a822580167b6b15e01ad60
SHA512158e74e41c304704e7258fb55097660ec988db372f3e5bc87450cbc0bf76a6a0b86a2869ce11129cdcbad668387e843cd1b8513b9fd50147445b795b9737cc0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b25afec680441b9fd43c6070e80605a8
SHA179189c4d51f7b995d682c2b108abe5b827b08d58
SHA256eff2a8f7855f3eae2829631ecf86132fdd9800e559dbd5703ae88ab69b60db90
SHA512b666d6391bce9a6b19a2e25e3a6133746e89d5fc168c056a29eba0b7a07119b3eea40e4e08ba5dd8d66f8a321c5ab4dd1737d40d326dcccd8e054161e3a4421a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5359c9e475b2a75f9268520411c3400a6
SHA14d2596b822b1c0c60bb14ef3cb58a4e574e1d7b1
SHA256dd8491b52eaaeb6ea961f4d0d43ce0cfcbf978609135ee85e47b96935e3d399e
SHA51204552011fd06f8ac95428ece6a0927008820f913d3d4ce12e05de533b0ef06ec2b702ebe6706bb1e1d84a99447404d7ea193db5b4dcbaa0d7c1e0dc8ff263748
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8153aef21ef55fcd4db6d8d9b8dfb39
SHA198b60ed8ce55fb4487586d674bfbb853c719ba2b
SHA2566fbc6ef378e2704938f898df236c171df117ababb32094b83a9705db0f757759
SHA5129f7bd9a89baaeb6882571e3da90807c1ac6b7c52ee4b68ff0c652475a247982253b9f275d9ef08fd7bcdffa093ed14c743988841404c762a233e301ee6eeb66d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5053b63e6a8e0043bc627ca0b80eaa1e4
SHA1c35a0d984a07a2edd7504c452052842f06536206
SHA256fce7965257ae0ede0047e01ad5daa135e70e8b79881646e3a323b44e9a5ae9e2
SHA512c61878e755f0bd9f2219dbed5d44e9c93d665260b0b036f14175334cc85f902671e296288636145f116bb308fb7dd3b2086f588549453f79499dccc5d1a8d7fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516dd3a913867170cfe9cc0bbb34a58d3
SHA13df4b5a37804d3632e50e5cff37dddc0ffd7bc85
SHA2566b3f0eacfeff48fc491f5280fc920d0442969ecb9e3adf5d2f2a14bb4c9c6aaf
SHA51277fcc56eab12e215a3658f7a195afc8f65fbb262c23ee9fe00ab43542bb4180ed11798ad49273a47a77758b9472e3b019b73089802f1f2e97f6588c189d761ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5882529b7fb247b28f7a12f3700d902a4
SHA1b75b0a558fdec4af81c2d79ecf657265ed112e9b
SHA25626d66857c864f032ba74b2ad9144518b0baa9471580763908145770cfbcfda21
SHA512b7409f3a57b66b2365121a85f14fa62ee9c2e33ca76dc09fb4d9c2081ae10de7e9a659b880df337bd5d16d1906081dd23929167ea9a8744350837d2dae4699d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c478435c2b154176471b1f03791c3a50
SHA1e24b17df543ba622884ec785bc5219eccca0d599
SHA256051c522660130a12cf7d7a87f4d0b5f2b79c9061e448dab35e5e9826b865c90b
SHA5125c8024d16970b8cd5a1b52e021c42ffa69e02dd9992988d6351a7c4bf6b365ad731877563469d2d1f1f0cdbdd1651ccff0512f1c2643146bc10799e38dabe423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52daaec1868739792ada2a5765c36e919
SHA1405357b11a1cb722ae0dd9a2355fa732db56e5c6
SHA256212eac2f03c03a5993c75d4bdb0e49cec239291dc58682de5fb8e342748bf269
SHA512e70807c435f89847c4c0cff6cb21e6bad4012239e124b46bafc44deb989a88270872d77a07dc0b02f04cbe7f4b28c65cc9e02b78cce13eb630cdae74a6ea7667
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528f28c5307ee3f29d9c67132a37002ab
SHA105464a048a8d64e6288be596d10f8580d0f71c9a
SHA2561a66c7824fdf6f03297772c393161582fb913541d9967c0f54b8391c129b852c
SHA512fe4ff2a11db720874717c6aa9dedf2fdadc81a19d896a810e084aecb41c4d61e79bc7f20ae84112c78ec1a45100e36bc1f94c59be6884c177ba608f4dba19b31
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b