Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
General
-
Target
a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe
-
Size
23.5MB
-
MD5
a8aec689cf6aae0e648435068829c7fe
-
SHA1
7b1d56e86a26e49ce311ef2aab4deb56def23aba
-
SHA256
7a5394bade4582b9826a436abfe3bc3233a8e857146a28fd70539da8c5450924
-
SHA512
790e6b60f583764c4b30ac492a5098026bad46b4edc34c3c0fc0aadafa1f8b67687636f994af2d06b0dc756020311b74dc97e7aaa07bd0ae4606e339bda1cfe9
-
SSDEEP
49152:XYgph7GBfWiHaqCGXDkYOMwwnMb4PmyVhV:XX77GBfWr1GIYOXwnS4rVhV
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\hh.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\OptionalFeatures.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\RegisterIEPKEYs.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdiagnhost.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\wininit.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\dccw.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\odbcconf.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasphone.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\ROUTE.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\Utilman.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\wevtutil.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\icacls.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\dxdiag.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\efsui.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\instnm.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskmgr.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\TSTheme.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\xwizard.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\control.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\poqexec.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\srdelayed.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\mobsync.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\msra.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\netbtugc.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\PATHPING.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedt32.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\bootcfg.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\SndVol.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpapimig.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\MRINFO.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\Netplwiz.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\regini.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\eudcedit.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\ieUnatt.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDCT.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\proquota.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\icacls.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\srdelayed.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\more.com- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\sxstrace.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\cacls.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\MigAutoPlay.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\mspaint.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasdial.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\SyncHost.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\unregmp2.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\user.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\newdev.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\AtBroker.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\esentutl.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmc.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\efsui.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\user.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\diantz.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\Netplwiz.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\7-Zip\7zG.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\tnameserv.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\DVD Maker\DVDMaker.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Journal\Journal.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wab.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\java.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\javaw.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Journal\PDIALOG.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_6.1.7600.16385_none_4befc8eb38093bb1\cttunesvr.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_6.1.7600.16385_none_a0d95afc49c833b6\dispdiag.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_6.1.7600.16385_none_ae2743278c281682\net.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_6.1.7601.17514_none_0b0882245933a065\nfsclnt.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.17514_none_8664adc870f5633a\taskhost.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\ehome\mcupdate.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_1ddb4b87a6618437\chkdsk.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\NETSTAT.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_6.1.7600.16385_none_1426830c3ebb712d\telnet.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\msil_narrator_31bf3856ad364e35_6.1.7601.17514_none_e18f9f5aaa2eda72\Narrator.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.2.9600.16428_none_856219b9f734bb75\iexplore.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Boot\PCAT\memtest.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a\rasautou.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_288b7acec3a75696\WSManHTTPConfig.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-taskkill_31bf3856ad364e35_6.1.7600.16385_none_25545528bd642170\taskkill.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_7dfc94f7357c56d2\IEExec.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-migrationengine_31bf3856ad364e35_6.1.7601.17514_none_5aaf419e398215df\mighost.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Narrator\4cc02fad33053737088d4c18267ca0a0\Narrator.ni.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_0adc1fc1cb6f944b\SecEdit.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mspaint_31bf3856ad364e35_6.1.7600.16385_none_ea12784c0842bfc1\mspaint.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-osk_31bf3856ad364e35_6.1.7600.16385_none_06b1c513739fb828\osk.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7601.17514_none_0d44b8d3df1c79a9\imjpuexc.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-winre-recoverytools_31bf3856ad364e35_6.1.7601.17514_none_d7553e5fcf6b6373\ReAgentc.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\accicons.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_8b52bb03d4ea5d36\csc.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-autofmt_31bf3856ad364e35_6.1.7601.17514_none_e7fba6c91d7030e3\autofmt.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ime-upgrade-results_31bf3856ad364e35_6.1.7601.17514_none_21de7e134213566a\WindowsAnytimeUpgradeResults.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_6.1.7600.16385_none_74b76d3fa1757c6f\chkntfs.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-iecleanup_31bf3856ad364e35_11.2.9600.16428_none_a03d6846a99c1c87\iecleanup.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7601.17514_none_7a2ff57a626c29fd\SpeechUXTutorial.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_aebd843e13122315\SecEdit.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\SvcIni.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_6.1.7601.17514_none_1229a6f0546e2346\lpq.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_3899b0ad2bb77a86\iscsicli.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\more.com_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx35linq-addinprocess_31bf3856ad364e35_6.1.7601.17514_none_8ebd3037635a8b2f\AddInProcess.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_9edcb4a706944d0a\autoconv.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\SystemPropertiesRemote.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\ehome\mcGlidHost.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_6.1.7601.17514_none_e6510234bbcb2a8c\bcdedit.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_17dbc2dd2d2552c7\verclsid.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_c1fead4e4bf85947\IMTCPROP.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-bth-user_31bf3856ad364e35_6.1.7601.17514_none_cd93efad202e5fb6\bthudtask.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\SvcIni.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..opycompareutilities_31bf3856ad364e35_6.1.7600.16385_none_3575d2dc8edf4a22\diskcopy.com_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\rpcinfo.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pnputil_31bf3856ad364e35_6.1.7600.16385_none_5958b438d6388d15\PnPutil.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000ef0a66cf1097a78df83cb7a3ddd5be2037e5bb3adce99c7e60c6e3e7d8ed1c33000000000e8000000002000020000000e1e11277414e521d002f0f4dd6a07e0c825d5a45fd7aff591ac88d61a3c8414d20000000a99ea53f9cd6ddfadb0ffc93b9c0c32e8b83eeee91cde1d5fc40df9aca4c3eb840000000680569e17502e099547d73c99348c9b342524c25cd0b8d71504c799ac570a47facd97d234def687b32ab5cf2dd04dd1aec956d4aa00c528c13a240be72a2f49a IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006fbd4cc7f1da01 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000d914e218099e6e07a669e2649a7b139b597c02749b6fba48e153386b8c84c20a000000000e8000000002000020000000735701111ebc8d558d7244c247328f5e9995f035b14f64e714b7acc639711db090000000ab76fb8297bf11539a52bbc56932b8c115ebcb53f5472b27784d00ee4548982ede8a54a573c907316f29e1467a881d81765aa8fb3162109df629d21f37c4fb001aceadcd0c215f672dc6dc46aa0af1c0e48b5cf099e9eaddfd60bda4bf00d375f6a963d277fbf43fd4e118ef21e470f0abb9262d3801e89731fd6872d154bb0c7ffd9d65ded99f015286a45281f33f4040000000862848d8c3e2bb4d3e2e7bc129c67a07ee8fd84643b0103bbf187bb50b9ec863bf4154efe2eb9b47b96d0c4ccc28a1e9e6635f9b976cf0048e4778c94f336114 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74B91EA1-5DBA-11EF-AFFE-C20DC8CB8E9E} = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430185955" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3004 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3004 IEXPLORE.exe 3004 IEXPLORE.exe 1568 IEXPLORE.EXE 1568 IEXPLORE.EXE 1568 IEXPLORE.EXE 1568 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2956 wrote to memory of 3004 2956 a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe 31 PID 2956 wrote to memory of 3004 2956 a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe 31 PID 2956 wrote to memory of 3004 2956 a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe 31 PID 2956 wrote to memory of 3004 2956 a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe 31 PID 3004 wrote to memory of 1568 3004 IEXPLORE.exe 32 PID 3004 wrote to memory of 1568 3004 IEXPLORE.exe 32 PID 3004 wrote to memory of 1568 3004 IEXPLORE.exe 32 PID 3004 wrote to memory of 1568 3004 IEXPLORE.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.6MB
MD5da8387dd72c077bb567e636a1e9968c9
SHA13e705eec3c72ff4711c828485ef6d25b115147ab
SHA256137ea1aa3f6fb64f49779de8602a8c8c9e5069756fe40ac7dcb9726e26f471f6
SHA512dbb598e6e7b9bcdf59dcdb8be3de2dcc443122ba16abd8c2f1ddc70fc70111c3e7062ac9b8bd0d3e2600fb89ac3191e6113acef28f79ca974e062ee3c121636f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58de94e1e2f00cee316709b7d89c297cc
SHA17e7d899979bfb3ab2fa67e977955a68a6018141a
SHA256716312306483eeadfe1fa901f32ad97f679f0bf791e68917377aef9166207857
SHA51278e76d13c842f693ec61f78baeff66d9bdaaf61c925c6681b88b1a43aec4a19dc62279ca1505470d912ffe2238cb28fdaa4aab6c57bf04eb1a5bd568139b12f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505fccb705f89d887de472fa39bfa0170
SHA1b3665bfe153bd0f899974815a0cc0065c752413e
SHA2564f36d830eeddaf2b2c376504514f98269b8f739f64d9b1fafe121510977f0506
SHA512f3684c8815a4850999ff6d0426f68c0b4025bc8042e0ac5d652fbe10e4fe97000c55dad2e6810ca7039116978b269fdf9443725ab1e584472b9ab4c366f13534
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5641e92c05a4542d95b2a8410ab31c025
SHA1cdc12642a6c795263897b3eee5a86070ff75d479
SHA256ce35371b02618ef4d85b47dc41a8f05e229987164d7a052ae69f7e5a5a485a72
SHA5126650251cae3f3096f899a2d1bf877c9e037e45fecdb91d191d62668a6b15530e21cd5af3ccaa8929e72982cf34aa7e5a2c7ab70ca8d7fa5181cbc356adf9e48a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a64b161d28ef65bf1a05042de8e49f13
SHA1a6e9d430074263c2c4638a3bd6c0f73ab473c01b
SHA25612e3cf741241b24eb466c3c23ed59d4248d46934725e898641892fa49a5a5d92
SHA512dc5ee446dd9bc0898c6010a414bb3474a895c753c7fd35b12c77bff9ca9b8745272a2ddbd52eead63fdd04b47b5c33181f644b52e3ffc5c722489a1891950e82
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b