58d0f6f4d44eeb1f0c518e928948c3dbd69540bfdd84581ab91a94861ef5964f

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe
Size

500KB
MD5

045e9e9b6fd45725ac8bb9bddb2fbd9f
SHA1

ffcd0cf2e9b9b1df2ca274044896381da04113ab
SHA256

58d0f6f4d44eeb1f0c518e928948c3dbd69540bfdd84581ab91a94861ef5964f
SHA512

2d65054a3166e3b6de4d66725ea2ea4c08b7c236aeef5002b97d3f5b4999b63d5d7514e09f107b8f01f2fd3404ba5e585fac2388506092268c4f184109b6d5f2
SSDEEP

6144:f59UBzgPVwrzTiE/Hlf1ZMgqOaY2CGC8y2KyadiRsUoNCeULoS:GgUuEvlN6gjZZG7adi2UhfLp

Score

10^/10

persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+uwpbi.txt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So , there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: * http://t54ndnku456ngkwsudqer.wallymac.com/B44DBA3845E675B0 * http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/B44DBA3845E675B0 * http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/B44DBA3845E675B0 If for some reasons the addresses are not available, follow these steps 1 Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 After a successful installation, run the browser 3 Type in the address bar: xlowfznrg4wf7dli.onion/B44DBA3845E675B0 4 Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://t54ndnku456ngkwsudqer.wallymac.com/B44DBA3845E675B0 http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/B44DBA3845E675B0 http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/B44DBA3845E675B0 Your personal pages TOR Browser xlowfznrg4wf7dli. onion/B44DBA3845E675B0

URLs

http://t54ndnku456ngkwsudqer.wallymac.com/B44DBA3845E675B0

http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/B44DBA3845E675B0

http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/B44DBA3845E675B0

http://xlowfznrg4wf7dli.onion/B44DBA3845E675B0

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (381) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2564 cmd.exe

pid	process
2564	cmd.exe

Drops startup file 3 IoCs

Processes:

hsxacodacnsv.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe

Executes dropped EXE 1 IoCs

Processes:

hsxacodacnsv.exe

pid process

2908 hsxacodacnsv.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

hsxacodacnsv.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\uqixcaf = "C:\\Windows\\SYSTEM32\\CMD.EXE /C START C:\\Windows\\hsxacodacnsv.exe"	hsxacodacnsv.exe

Drops file in Program Files directory 64 IoCs

Processes:

hsxacodacnsv.exe

description	ioc	process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv	hsxacodacnsv.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\44.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\12.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\it-IT\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_over.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\km\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_right.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\35.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\fr-FR\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_settings.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\de-DE\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\ja-JP\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_ReCoVeRy_+uwpbi.html	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Internet Explorer\images\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\Microsoft Games\Minesweeper\en-US\_ReCoVeRy_+uwpbi.txt	hsxacodacnsv.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kk\_ReCoVeRy_+uwpbi.png	hsxacodacnsv.exe

Drops file in Windows directory 2 IoCs

Processes:

045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\hsxacodacnsv.exe	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe
File opened for modification	C:\Windows\hsxacodacnsv.exe	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420440276"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000027e01f3b5a7ea435de68f2286ff2939ff952e607c5ebdf7fc9c97376fc5c00ad000000000e80000000020000200000003a2b2d2c9997f73a3bc5c9df681a19d870e04d5452fafd92565bf59e5b5d865720000000c9e9d1bf19ae356f027a3f9a64a93449acca0e6e2daadfa96ed50bd2a17fd52c400000001f84466a298495e2f1bd02300ebf8ef6c9ac64f0264de4a90adfd79e2d719706be0bc6a7fe79db2b7e17d1d4f5c6c0c4b7eb96374b77a2b98aef9f0009f4c4e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87114791-0517-11EF-9A09-E25BC60B6402} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f046f65b2499da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003e898622f62ff060f28b06f5860b6a434c4ca087e786fe8f9f55718d25eed8e3000000000e80000000020000200000005fbaab5f8f82b37de7570d9ddb60bee0d42efffc61f5d840bb2ef85db70fe921900000006438c6b15ad2e3019c91ba1662ee61df01b6ccac04252e09534694e4fee79780364f8395cca76dd4d252477397bcebb3bb3753ade8a292c6fd64ec3c86d1066377fa2d480654b27239e9fffb0af90efd1e199543f5e187ec0c3f14cffc417d705057047babcffc4f6a5cf49e1379c9adc3e960878300f7503dc4f7ae83329d0d276b372325f0d60ee0d1a0403a06729b400000005c5a955331388b2b563d6c6e3e916bc094f66887a8acc972e46455a530409c748b4204025b97de886b2c722a667877d35b294f3a46707992ee2960adf61dbfb9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1100 NOTEPAD.EXE

pid	process
1100	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

hsxacodacnsv.exe

pid	process
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe
2908	hsxacodacnsv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exehsxacodacnsv.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3008	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe
Token: SeDebugPrivilege	2908	hsxacodacnsv.exe
Token: SeIncreaseQuotaPrivilege	2872	WMIC.exe
Token: SeSecurityPrivilege	2872	WMIC.exe
Token: SeTakeOwnershipPrivilege	2872	WMIC.exe
Token: SeLoadDriverPrivilege	2872	WMIC.exe
Token: SeSystemProfilePrivilege	2872	WMIC.exe
Token: SeSystemtimePrivilege	2872	WMIC.exe
Token: SeProfSingleProcessPrivilege	2872	WMIC.exe
Token: SeIncBasePriorityPrivilege	2872	WMIC.exe
Token: SeCreatePagefilePrivilege	2872	WMIC.exe
Token: SeBackupPrivilege	2872	WMIC.exe
Token: SeRestorePrivilege	2872	WMIC.exe
Token: SeShutdownPrivilege	2872	WMIC.exe
Token: SeDebugPrivilege	2872	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2872	WMIC.exe
Token: SeRemoteShutdownPrivilege	2872	WMIC.exe
Token: SeUndockPrivilege	2872	WMIC.exe
Token: SeManageVolumePrivilege	2872	WMIC.exe
Token: 33	2872	WMIC.exe
Token: 34	2872	WMIC.exe
Token: 35	2872	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2872	WMIC.exe
Token: SeSecurityPrivilege	2872	WMIC.exe
Token: SeTakeOwnershipPrivilege	2872	WMIC.exe
Token: SeLoadDriverPrivilege	2872	WMIC.exe
Token: SeSystemProfilePrivilege	2872	WMIC.exe
Token: SeSystemtimePrivilege	2872	WMIC.exe
Token: SeProfSingleProcessPrivilege	2872	WMIC.exe
Token: SeIncBasePriorityPrivilege	2872	WMIC.exe
Token: SeCreatePagefilePrivilege	2872	WMIC.exe
Token: SeBackupPrivilege	2872	WMIC.exe
Token: SeRestorePrivilege	2872	WMIC.exe
Token: SeShutdownPrivilege	2872	WMIC.exe
Token: SeDebugPrivilege	2872	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2872	WMIC.exe
Token: SeRemoteShutdownPrivilege	2872	WMIC.exe
Token: SeUndockPrivilege	2872	WMIC.exe
Token: SeManageVolumePrivilege	2872	WMIC.exe
Token: 33	2872	WMIC.exe
Token: 34	2872	WMIC.exe
Token: 35	2872	WMIC.exe
Token: SeBackupPrivilege	636	vssvc.exe
Token: SeRestorePrivilege	636	vssvc.exe
Token: SeAuditPrivilege	636	vssvc.exe
Token: SeIncreaseQuotaPrivilege	204	WMIC.exe
Token: SeSecurityPrivilege	204	WMIC.exe
Token: SeTakeOwnershipPrivilege	204	WMIC.exe
Token: SeLoadDriverPrivilege	204	WMIC.exe
Token: SeSystemProfilePrivilege	204	WMIC.exe
Token: SeSystemtimePrivilege	204	WMIC.exe
Token: SeProfSingleProcessPrivilege	204	WMIC.exe
Token: SeIncBasePriorityPrivilege	204	WMIC.exe
Token: SeCreatePagefilePrivilege	204	WMIC.exe
Token: SeBackupPrivilege	204	WMIC.exe
Token: SeRestorePrivilege	204	WMIC.exe
Token: SeShutdownPrivilege	204	WMIC.exe
Token: SeDebugPrivilege	204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	204	WMIC.exe
Token: SeRemoteShutdownPrivilege	204	WMIC.exe
Token: SeUndockPrivilege	204	WMIC.exe
Token: SeManageVolumePrivilege	204	WMIC.exe
Token: 33	204	WMIC.exe
Token: 34	204	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

1648 iexplore.exe
936 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1648 iexplore.exe
1648 iexplore.exe
2096 IEXPLORE.EXE
2096 IEXPLORE.EXE

pid	process
1648	iexplore.exe
936	DllHost.exe

pid	process
1648	iexplore.exe
1648	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exehsxacodacnsv.exeiexplore.exe

description	pid	process	target process
PID 3008 wrote to memory of 2908	3008	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe	hsxacodacnsv.exe
PID 3008 wrote to memory of 2908	3008	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe	hsxacodacnsv.exe
PID 3008 wrote to memory of 2908	3008	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe	hsxacodacnsv.exe
PID 3008 wrote to memory of 2908	3008	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe	hsxacodacnsv.exe
PID 3008 wrote to memory of 2564	3008	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe	cmd.exe
PID 3008 wrote to memory of 2564	3008	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe	cmd.exe
PID 3008 wrote to memory of 2564	3008	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe	cmd.exe
PID 3008 wrote to memory of 2564	3008	045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe	cmd.exe
PID 2908 wrote to memory of 2872	2908	hsxacodacnsv.exe	WMIC.exe
PID 2908 wrote to memory of 2872	2908	hsxacodacnsv.exe	WMIC.exe
PID 2908 wrote to memory of 2872	2908	hsxacodacnsv.exe	WMIC.exe
PID 2908 wrote to memory of 2872	2908	hsxacodacnsv.exe	WMIC.exe
PID 2908 wrote to memory of 1100	2908	hsxacodacnsv.exe	NOTEPAD.EXE
PID 2908 wrote to memory of 1100	2908	hsxacodacnsv.exe	NOTEPAD.EXE
PID 2908 wrote to memory of 1100	2908	hsxacodacnsv.exe	NOTEPAD.EXE
PID 2908 wrote to memory of 1100	2908	hsxacodacnsv.exe	NOTEPAD.EXE
PID 2908 wrote to memory of 1648	2908	hsxacodacnsv.exe	iexplore.exe
PID 2908 wrote to memory of 1648	2908	hsxacodacnsv.exe	iexplore.exe
PID 2908 wrote to memory of 1648	2908	hsxacodacnsv.exe	iexplore.exe
PID 2908 wrote to memory of 1648	2908	hsxacodacnsv.exe	iexplore.exe
PID 1648 wrote to memory of 2096	1648	iexplore.exe	IEXPLORE.EXE
PID 1648 wrote to memory of 2096	1648	iexplore.exe	IEXPLORE.EXE
PID 1648 wrote to memory of 2096	1648	iexplore.exe	IEXPLORE.EXE
PID 1648 wrote to memory of 2096	1648	iexplore.exe	IEXPLORE.EXE
PID 2908 wrote to memory of 204	2908	hsxacodacnsv.exe	WMIC.exe
PID 2908 wrote to memory of 204	2908	hsxacodacnsv.exe	WMIC.exe
PID 2908 wrote to memory of 204	2908	hsxacodacnsv.exe	WMIC.exe
PID 2908 wrote to memory of 204	2908	hsxacodacnsv.exe	WMIC.exe
PID 2908 wrote to memory of 2004	2908	hsxacodacnsv.exe	cmd.exe
PID 2908 wrote to memory of 2004	2908	hsxacodacnsv.exe	cmd.exe
PID 2908 wrote to memory of 2004	2908	hsxacodacnsv.exe	cmd.exe
PID 2908 wrote to memory of 2004	2908	hsxacodacnsv.exe	cmd.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

hsxacodacnsv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hsxacodacnsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	hsxacodacnsv.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\045e9e9b6fd45725ac8bb9bddb2fbd9f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\hsxacodacnsv.exe
C:\Windows\hsxacodacnsv.exe
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2908

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
3⤵
- Opens file in notepad (likely ransom note)
PID:1100

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2096

C:\Windows\System32\wbem\WMIC.exe
"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\HSXACO~1.EXE
3⤵
PID:2004

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\045E9E~1.EXE
2⤵
- Deletes itself
PID:2564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:936

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+uwpbi.html
Filesize
10KB

MD5
123d3629b624923cf21d570798d28c30

SHA1
28436efd28e77a3e99956e9ebd4be3d6c3326844

SHA256
4a1a3a7553716da37deca18e422831f2553ef0ad64527b1df35e64a63ef795c7

SHA512
846df4b60fc3bfbfc486af24e136335612e732a277b546f0b50a2e4fcd85524c60299d36bdf5684c250773bea42e26031f883d7beff54ba63c696902678897b4

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+uwpbi.png
Filesize
64KB

MD5
003a0fcc605f018afc0da41398954bb5

SHA1
83fcb94dd3e8867a5c67886b0dca206ca9f95fc3

SHA256
7d8dac158c1de1176e42219ced7b5521551ebe5424e9e762197a0604fc4724a3

SHA512
564d88a9f9434d7ff1a9839bb1210992f3442d00fc4b768a4d48bb5b3d86a358bc09347e807e5adab6963211b723d3e4074785a1690be596a4ab4b695b669f16

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+uwpbi.txt
Filesize
1KB

MD5
2410807fa0d0511efcde7000356acd2c

SHA1
3eda93135bdd1f15b62513bf486b8e665e74c72e

SHA256
e2413c56753e32293e09bcb1b6b80a90df3553e2e28eeb5d82bfe924a8888ea6

SHA512
5db9678b65d5f5eaa225399712ca1050f4b1c331b326e8386d2afba811445d917af213f46d70f37bea55c356c09a9b17f4bb6860b3a4c9820b97fb8308074074

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize
11KB

MD5
8f7f9b4fbb20354fdccab016cc7bd6a4

SHA1
168f24f9619bc41febd17dacee22b9768d26c415

SHA256
20e90c44f4bd0f320e66aa035eac076abab6ef6cbee16df74988ba22fc86a6eb

SHA512
e0508bdd6101e40347c3dcaa74ef951208cbd145a150329847810c6b1d141ad84e6b04c86decd2420fb68e9ba25b98aa11bd76029bf79cacb481bc0bb59a0178

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
109KB

MD5
b91fd363e5af80ced722f3e18b44b751

SHA1
9860466ceff84a5c74f1ee2fdba0fcf7104daab3

SHA256
a066b7dd0bcbad0cb5c3b57e5792ddb1d473efcf891464b615c59de2089e7083

SHA512
17c2a75b269e92e1ad8c89a6a89e984072584725c7253599e6bd755e41b179f4689fa1b2edc692d803026a59eac19d6615f7990aacb104b1b1c1fef9fd07b179

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
Filesize
173KB

MD5
4f1a4a38c0d4cd9bf56097f734a9a7a6

SHA1
d417b6997798e7cfcb949f95f38a2ac051e75ec7

SHA256
dd63e4b2612781675d74bcd605a2610d81769fe0f62bc840addf4c3f5f1092b8

SHA512
3d684e8ac5288eca2101770e28e8c219ecbebf2e3b70c8de6f5bbd540a2642eda961e5dcd4731e2cb6babde84da9c629b3e18ef2578d9a8568a715b9bf4e8748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9a70683b6694ddc29f4cde227ab30bfa

SHA1
5a2ec045ca4f08372b2fe6a2b31fb18535857e03

SHA256
529a9656efeb6fc52498d9575fa62e5a589d9a61c0ca3d5ccc39a81c1b356b7d

SHA512
c28c81fe5fd6c7488c35f35c5fe42138e24864882493faecf677a2aa310b1352c2a7e1cc4efd37a040f9e80c5514db3f541f8a08dbbdf84c331f08a60556b8b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
874617c32c786f2fa01f6f0455729063

SHA1
f759d0d5937533dec82d4f94bff391399a932f0f

SHA256
1b431c22370748de9936601c143eab34788406d18c7282294b940242812c9a1c

SHA512
21958afc123ecbdf21bbeb4641435c13e0a61b492430c793d468c0f8b3d5860db86d17cc5eeaf612f8851475a7e16aab083d616f6009f478eb344bb11a479a0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8b2a32cbdb03e6523c099dfca0f4ddf3

SHA1
379cb8cfc11ba5c03371a6eb963e1bc47e80c7d6

SHA256
c0305275782a40f635013688cb1c66ed136e3d7624e7cbff0035f341ce94431b

SHA512
93c00ae91e0b1053b277dc3dc6584311126482996d632534ba6dd6a6045e057affda7d4c1cffd98d8630a7441dec552c5c152292fed579a8fb296b7a49f3bf39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5f528f771c06e394e05055468ba08e81

SHA1
0a30dcd1f81b1e5c9fdeac5ce54002aafdd1597d

SHA256
a206d6ed9cdd6c35d1b4b5ceeea6342aeadfb2da8533006f771164926542b8e5

SHA512
de8a419514e452130b2df6b67f1c8831c111d109ff638f1499b6556645dee85a0e6e31424e3feedc6114608114bfe05d54fd7616d73e1aaa0ee47998b0feae5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d97e6e7b6c92ea70940b751e34a68260

SHA1
7b157267d68d9ac1ec098d9654a9b87f06baba80

SHA256
7b82fe1734fa8e0a1495d7467195af028fb2d4202222379e5f9c2997a59b6a0f

SHA512
f25617c8145948b158e633d7ba7ce7aeb53e3f483febecab56a3f57682c021d71955019cf7946fd00f75b3ed9638a08fc087cc2df5f0c48a84284e111b413652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b5ce739c9c5e632cc155282ae907747f

SHA1
81add6abfbf62e743f222d47e4c798e356402266

SHA256
c32f04b47407b75377dd47be372d39e5210f220f80fb3d97a88a37aba603b259

SHA512
ae2076e676fa1a04576a0618b66435f78fff32e7a99bd13526f27f998b845768f2c49ce32cc3a06b6772e5c258ab61bd460b5cf5772ec5b101e8deac6d7b8cc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7c471e5c140eeaabbe9516d94cdeb681

SHA1
7d267d9d33a5ca93dde5ba9ea845474c3d17b6b0

SHA256
987b999d23ec92fd61b3d734d9a446c5397525a339e87aca78fdcebe261f14a3

SHA512
f3f1510d1e23584f69f3cc83cd09115706b3a1c3e55234f26bad9e15ce57fadba14b0230df683f1f064d1d414bdeeeeaad38fd193f4ebc2a67207ce87aec9c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f23971e8aaa954e92ddbcd6231bbc510

SHA1
1c0df733ddee2c9e7173a8f37c2d0b0f1b4e3a5b

SHA256
72ac785c173232fe2a401ba4b8fedb5594487341df879dcad3cbf807ba4745de

SHA512
32a096d6c4d9e636e368802617a6ea4acc0c577405831433c9f015abd96681d398a5bfd204c3edcda4e14d8eceb519e1d1b2da73bfea88eb17d65c29636b42ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
203a150de1215af36b563d31ef7a9da5

SHA1
4aa94c4024f192798a484c43c76cc4f434728b2b

SHA256
640354a411aba543167b38738380c1aeced6cad587ca50edc5d36543d28f9bf5

SHA512
1a979c68e48dca3c33e678df56c6891262b40292a3899102308f0cefe1fd486698142b3d3bba46d15f3e28d0b563cfa8025c65658e237e0847881cc914774a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
91acbe70d9ca3df4a94ca4e262edbe17

SHA1
33fd207898ba3951910ac13bbe5bd39ecfff2dff

SHA256
e3591eb8ded58e065bb68897192d68323945f0cbfc6e7957729224a848a514f7

SHA512
c02d5170fd352cd1f624a7b1ce022b287305f942aa3295033551e727021981c482a487f30c349b163dd2312f406b3985303e28f085ac8ce0022322072c655dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cdaed4c67300cf7a5edcda72c0017511

SHA1
f7d834a93b64c645ea1cd0184aff6f3c352ba430

SHA256
6990b3c99b069cbb5bae435f9714701def268a325e7ca176e6b556c3aaf9d51e

SHA512
be8c2f07ea52adbfdf4fa67343b3d4854a0e712b1198af6a641c8c6d95e9a305d1b8af67888d74060a3e9e4a170c57aba1700fce9af0847fa78653843ee3f029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0e0ffe5c6ddb0a220bd4c590be0ff035

SHA1
19f8716a163a1b2a5f1305e40f10d55133d53ef1

SHA256
40f1c126ee6349e5a6d7039ae774e4ad30081ddffe215768efa16fb7ece736f3

SHA512
fc471cddd06c8e6b5e27eab0884d2c5883ae81dda036e09eb0ea98288cce4674678bf1c7bffa9b9e7f5899783bd2d301740021526d0799fe8fc51a7277dcb834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b86f3d2bb4a96796e8c5010fa4b81487

SHA1
fa83e1b510e9cddad361b1435ea5d15ab86e6546

SHA256
dfa7fb05034fc29ab5d5f4112510d8dc8b03e9ed751661b4eb5ec2caa1df7eee

SHA512
0361e6ae43d44a51e7be0d028edc4ba47da98d4439c0262ff874001751b203da949cb208463de15abeb59593f5d24b0db70a4d4c613d408b0a62ee85a3d5f455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cf3c1b0e32da987bf0d3373692dd6a08

SHA1
d445c3ab7332161385350e33b672034423cd73d0

SHA256
44d0f00c1762ec058739dbcee37054ef7d77b557f04f2858062e1c3e7bc94def

SHA512
8ba014ec919b059a2490860803afd6514b3e95ef4e7e03b21c40b68cbfcccaa2b3f41fd3d668ace8cf527f42ffd1557d489ceb53cc3dceb38071144af00ccd63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0560b78370632bc965c902fdda13120e

SHA1
53d41be8c7144ce7c266be6789c762cfdf6296e8

SHA256
f7eb2119cf3969b557e74fbb13b58356c57012305e496d5670dd9ae4b456fd1b

SHA512
bd240513b46884929568592ca354fd03d47a3aeb91517eac055563867644e302d551b5c775b16fe0759d6b135a7c2f5408f7c588f233d709ae34600126e7742d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b52f7b54375efcf0cb30e1021305dbe8

SHA1
28d8927d753ab8b96619009b1bfc57eaef88c5e1

SHA256
7ee4133ef73bf7038bc286f8ced582048ebdf1b52c3931c840ef077b554bb0ef

SHA512
a4963b5b3cdd1d525b671fe50bc0494086bbe06f12cce3add70ad2ea89e0fea0c5675d350c6aa33e894dc90807f907f821792ef48aa893f5d95417378701087c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
48c6f65cd5b25826fa01a3db6db63419

SHA1
921e924fbcacd4fe87bf22151357b7e9da9c6cd7

SHA256
6af1bc9dc29b3f9235cd674c7d8ff0cf0fd3ae664d847ceca71ce4e8cbc79db5

SHA512
781dcad59fcfd309a0744e25438905073fb20854874ab9239e2f5c1f25672070f1ddc018b432fa8257cb137bb850b9d6fb5dabfe2a563e3fdda95a832f91469e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8126997f92cd5f89b6331d181881d0c7

SHA1
db028e7d97b705e634512809adb1fdaf5f302bf8

SHA256
7d104001e926810948c12faf54e3248b3f603160e8a7b304a0d3afa463c474ae

SHA512
f12bbe9fe99a539873371f5aedd9f1ce361c6521a299cf8765d458c4798e5e36e4c7283a496ea37d52ffa54dd76dc1aef8513fa406b76c2b5adfe09221b56eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8AF8.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Windows\hsxacodacnsv.exe
Filesize
500KB

MD5
045e9e9b6fd45725ac8bb9bddb2fbd9f

SHA1
ffcd0cf2e9b9b1df2ca274044896381da04113ab

SHA256
58d0f6f4d44eeb1f0c518e928948c3dbd69540bfdd84581ab91a94861ef5964f

SHA512
2d65054a3166e3b6de4d66725ea2ea4c08b7c236aeef5002b97d3f5b4999b63d5d7514e09f107b8f01f2fd3404ba5e585fac2388506092268c4f184109b6d5f2

Download Submit
memory/936-5856-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/2908-1100-0x0000000000280000-0x0000000000306000-memory.dmp

Filesize
536KB

Download
memory/2908-467-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2908-4447-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2908-3621-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2908-2699-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2908-1818-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2908-5908-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2908-6312-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2908-760-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2908-5717-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2908-5855-0x0000000002540000-0x0000000002542000-memory.dmp

Filesize
8KB

Download
memory/2908-16-0x0000000000280000-0x0000000000306000-memory.dmp

Filesize
536KB

Download
memory/2908-13-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3008-11-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3008-12-0x0000000000310000-0x0000000000396000-memory.dmp

Filesize
536KB

Download
memory/3008-0-0x0000000000310000-0x0000000000396000-memory.dmp

Filesize
536KB

Download
memory/3008-2-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download