Overview
overview
10Static
static
31e039f9770...18.exe
windows7-x64
101e039f9770...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Nwiz.dll
windows7-x64
1Nwiz.dll
windows10-2004-x64
3default_hash.js
ubuntu-18.04-amd64
1default_hash.js
debian-9-armhf
1default_hash.js
debian-9-mips
default_hash.js
debian-9-mipsel
libimalloc.dll
windows7-x64
1libimalloc.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 19:26
Static task
static1
Behavioral task
behavioral1
Sample
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
Nwiz.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Nwiz.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
default_hash.js
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral8
Sample
default_hash.js
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral9
Sample
default_hash.js
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral10
Sample
default_hash.js
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral11
Sample
libimalloc.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
libimalloc.dll
Resource
win10v2004-20240419-en
General
-
Target
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe
-
Size
186KB
-
MD5
1e039f9770017f09225e58d7759b700a
-
SHA1
fc1e83365f05fb98b4dc94833e430a7adc055bf5
-
SHA256
f9ab2087217beb38c3ec3dc043aad739dac202dc422f44e49c0fb5ca6db26502
-
SHA512
ebeb10678547b0eca642645a673e9e6309c3ba961e62d83aca95aff8a351a56c07544c92688681e58dbe66cc8e0812ab01c388d0b5e463d5c97d4ea038bf26e2
-
SSDEEP
3072:oM1BjoYNXoKDIJBXJPG45d48j8uZmXJtP4NMtGvNOilk+qNKNtmlohi8tUUB5+Qy:oMMYNXqBBG6Zj8ikJtP4SGVdHqEUGQUw
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.onion.to/F1CB-43B1-ACAA-006D-F530
http://cerberhhyed5frqa.onion.cab/F1CB-43B1-ACAA-006D-F530
http://cerberhhyed5frqa.onion.nu/F1CB-43B1-ACAA-006D-F530
http://cerberhhyed5frqa.onion.link/F1CB-43B1-ACAA-006D-F530
http://cerberhhyed5frqa.tor2web.org/F1CB-43B1-ACAA-006D-F530
http://cerberhhyed5frqa.onion/F1CB-43B1-ACAA-006D-F530
Extracted
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 920 bcdedit.exe 1824 bcdedit.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exePkgMgr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\\PkgMgr.exe\"" 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\\PkgMgr.exe\"" PkgMgr.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1792 cmd.exe -
Drops startup file 2 IoCs
Processes:
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exePkgMgr.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\PkgMgr.lnk 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\PkgMgr.lnk PkgMgr.exe -
Executes dropped EXE 2 IoCs
Processes:
PkgMgr.exePkgMgr.exepid process 2932 PkgMgr.exe 1948 PkgMgr.exe -
Loads dropped DLL 6 IoCs
Processes:
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe1e039f9770017f09225e58d7759b700a_JaffaCakes118.exePkgMgr.exePkgMgr.exepid process 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 2932 PkgMgr.exe 2932 PkgMgr.exe 1948 PkgMgr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exePkgMgr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\PkgMgr = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\\PkgMgr.exe\"" 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\PkgMgr = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\\PkgMgr.exe\"" PkgMgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\PkgMgr = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\\PkgMgr.exe\"" PkgMgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\PkgMgr = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\\PkgMgr.exe\"" 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe -
Processes:
PkgMgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PkgMgr.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
PkgMgr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp68D1.bmp" PkgMgr.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exePkgMgr.exedescription pid process target process PID 2988 set thread context of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2932 set thread context of 1948 2932 PkgMgr.exe PkgMgr.exe -
Drops file in Windows directory 2 IoCs
Processes:
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exePkgMgr.exedescription ioc process File opened for modification C:\Windows\tillings 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe File opened for modification C:\Windows\tillings PkgMgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\PkgMgr.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\PkgMgr.exe nsis_installer_2 -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1064 vssadmin.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2692 taskkill.exe 2720 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exePkgMgr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\\PkgMgr.exe\"" 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop PkgMgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\\PkgMgr.exe\"" PkgMgr.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70583379eb9fda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000001cec79ec9ab397bd5ebf7db78a8f0f3e0fd137b528026b8dcd1ca7f629696c30000000000e800000000200002000000024f03ca928bdae02e6b5cbd8041d7457c7740d4cf98ed350c861d3dc67cebdd99000000044065f6595dd914a4beb2b12ef040a809b1ec1082b285452ee28c05fe8ac4d11b895f250ef3a3f12518adbf4386f6cb24b8adf8d6ba4056502b7c2b54acd412962c6a6f418af491c72bb01ef6a3db883ac6426ff81ed8fa0a2faebdf14d7e14f6d21d7593401b42c793044d7b492688cc5c11d955a9d4ff66bb56825b1ee1c6e6b0785397e75aaba337866cf6f94784c40000000d18398f5d3ba73edff1a76f87e388e2b4e271c400bf80b339dff58098fcafc5a488268abb5d6cec6d71f3d183e660eeda449b15b4c1821f4dd20d26cf5b80a8b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000004a25405906576b621e0dee1bead870ad2a65a4b9cc2ee02925c651b5707cbd88000000000e800000000200002000000048600a854be6b83258a56933dfc4defac19b350b280a27cb7d32f85dea6ded0b20000000dfe95c5951589925cb2a95f38d2783d021f3d8cf75da5767bf0b7e672de2c266400000006326e7a9ed865e236c520f9a33a0cec8e5c24e72d2c3b95277eef2a47e3d4affd7ade5a0d95b66e450789136316f2be3349cbba44825084aecaa9f7a05ffde19 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5DE03B1-0BDE-11EF-A40F-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5D47E31-0BDE-11EF-A40F-5A791E92BC44} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
PkgMgr.exepid process 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe 1948 PkgMgr.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exetaskkill.exePkgMgr.exevssvc.exewmic.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe Token: SeDebugPrivilege 2692 taskkill.exe Token: SeDebugPrivilege 1948 PkgMgr.exe Token: SeBackupPrivilege 1896 vssvc.exe Token: SeRestorePrivilege 1896 vssvc.exe Token: SeAuditPrivilege 1896 vssvc.exe Token: SeIncreaseQuotaPrivilege 1576 wmic.exe Token: SeSecurityPrivilege 1576 wmic.exe Token: SeTakeOwnershipPrivilege 1576 wmic.exe Token: SeLoadDriverPrivilege 1576 wmic.exe Token: SeSystemProfilePrivilege 1576 wmic.exe Token: SeSystemtimePrivilege 1576 wmic.exe Token: SeProfSingleProcessPrivilege 1576 wmic.exe Token: SeIncBasePriorityPrivilege 1576 wmic.exe Token: SeCreatePagefilePrivilege 1576 wmic.exe Token: SeBackupPrivilege 1576 wmic.exe Token: SeRestorePrivilege 1576 wmic.exe Token: SeShutdownPrivilege 1576 wmic.exe Token: SeDebugPrivilege 1576 wmic.exe Token: SeSystemEnvironmentPrivilege 1576 wmic.exe Token: SeRemoteShutdownPrivilege 1576 wmic.exe Token: SeUndockPrivilege 1576 wmic.exe Token: SeManageVolumePrivilege 1576 wmic.exe Token: 33 1576 wmic.exe Token: 34 1576 wmic.exe Token: 35 1576 wmic.exe Token: SeIncreaseQuotaPrivilege 1576 wmic.exe Token: SeSecurityPrivilege 1576 wmic.exe Token: SeTakeOwnershipPrivilege 1576 wmic.exe Token: SeLoadDriverPrivilege 1576 wmic.exe Token: SeSystemProfilePrivilege 1576 wmic.exe Token: SeSystemtimePrivilege 1576 wmic.exe Token: SeProfSingleProcessPrivilege 1576 wmic.exe Token: SeIncBasePriorityPrivilege 1576 wmic.exe Token: SeCreatePagefilePrivilege 1576 wmic.exe Token: SeBackupPrivilege 1576 wmic.exe Token: SeRestorePrivilege 1576 wmic.exe Token: SeShutdownPrivilege 1576 wmic.exe Token: SeDebugPrivilege 1576 wmic.exe Token: SeSystemEnvironmentPrivilege 1576 wmic.exe Token: SeRemoteShutdownPrivilege 1576 wmic.exe Token: SeUndockPrivilege 1576 wmic.exe Token: SeManageVolumePrivilege 1576 wmic.exe Token: 33 1576 wmic.exe Token: 34 1576 wmic.exe Token: 35 1576 wmic.exe Token: SeDebugPrivilege 2720 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 544 iexplore.exe 544 iexplore.exe 2024 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 544 iexplore.exe 544 iexplore.exe 1656 IEXPLORE.EXE 1656 IEXPLORE.EXE 544 iexplore.exe 544 iexplore.exe 2024 iexplore.exe 2024 iexplore.exe 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE 1664 IEXPLORE.EXE 1664 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe1e039f9770017f09225e58d7759b700a_JaffaCakes118.execmd.exePkgMgr.exePkgMgr.exeiexplore.exedescription pid process target process PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2988 wrote to memory of 2568 2988 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PID 2568 wrote to memory of 2932 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PkgMgr.exe PID 2568 wrote to memory of 2932 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PkgMgr.exe PID 2568 wrote to memory of 2932 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PkgMgr.exe PID 2568 wrote to memory of 2932 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe PkgMgr.exe PID 2568 wrote to memory of 1792 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe cmd.exe PID 2568 wrote to memory of 1792 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe cmd.exe PID 2568 wrote to memory of 1792 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe cmd.exe PID 2568 wrote to memory of 1792 2568 1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe cmd.exe PID 1792 wrote to memory of 2692 1792 cmd.exe taskkill.exe PID 1792 wrote to memory of 2692 1792 cmd.exe taskkill.exe PID 1792 wrote to memory of 2692 1792 cmd.exe taskkill.exe PID 1792 wrote to memory of 2692 1792 cmd.exe taskkill.exe PID 1792 wrote to memory of 1968 1792 cmd.exe PING.EXE PID 1792 wrote to memory of 1968 1792 cmd.exe PING.EXE PID 1792 wrote to memory of 1968 1792 cmd.exe PING.EXE PID 1792 wrote to memory of 1968 1792 cmd.exe PING.EXE PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 2932 wrote to memory of 1948 2932 PkgMgr.exe PkgMgr.exe PID 1948 wrote to memory of 1064 1948 PkgMgr.exe vssadmin.exe PID 1948 wrote to memory of 1064 1948 PkgMgr.exe vssadmin.exe PID 1948 wrote to memory of 1064 1948 PkgMgr.exe vssadmin.exe PID 1948 wrote to memory of 1064 1948 PkgMgr.exe vssadmin.exe PID 1948 wrote to memory of 1576 1948 PkgMgr.exe wmic.exe PID 1948 wrote to memory of 1576 1948 PkgMgr.exe wmic.exe PID 1948 wrote to memory of 1576 1948 PkgMgr.exe wmic.exe PID 1948 wrote to memory of 1576 1948 PkgMgr.exe wmic.exe PID 1948 wrote to memory of 920 1948 PkgMgr.exe bcdedit.exe PID 1948 wrote to memory of 920 1948 PkgMgr.exe bcdedit.exe PID 1948 wrote to memory of 920 1948 PkgMgr.exe bcdedit.exe PID 1948 wrote to memory of 920 1948 PkgMgr.exe bcdedit.exe PID 1948 wrote to memory of 1824 1948 PkgMgr.exe bcdedit.exe PID 1948 wrote to memory of 1824 1948 PkgMgr.exe bcdedit.exe PID 1948 wrote to memory of 1824 1948 PkgMgr.exe bcdedit.exe PID 1948 wrote to memory of 1824 1948 PkgMgr.exe bcdedit.exe PID 1948 wrote to memory of 544 1948 PkgMgr.exe iexplore.exe PID 1948 wrote to memory of 544 1948 PkgMgr.exe iexplore.exe PID 1948 wrote to memory of 544 1948 PkgMgr.exe iexplore.exe PID 1948 wrote to memory of 544 1948 PkgMgr.exe iexplore.exe PID 1948 wrote to memory of 1700 1948 PkgMgr.exe NOTEPAD.EXE PID 1948 wrote to memory of 1700 1948 PkgMgr.exe NOTEPAD.EXE PID 1948 wrote to memory of 1700 1948 PkgMgr.exe NOTEPAD.EXE PID 1948 wrote to memory of 1700 1948 PkgMgr.exe NOTEPAD.EXE PID 544 wrote to memory of 1656 544 iexplore.exe IEXPLORE.EXE PID 544 wrote to memory of 1656 544 iexplore.exe IEXPLORE.EXE PID 544 wrote to memory of 1656 544 iexplore.exe IEXPLORE.EXE PID 544 wrote to memory of 1656 544 iexplore.exe IEXPLORE.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\PkgMgr.exe"C:\Users\Admin\AppData\Roaming\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\PkgMgr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\PkgMgr.exe"C:\Users\Admin\AppData\Roaming\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\PkgMgr.exe"4⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:544 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:544 CREDAT:406530 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt5⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"5⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "PkgMgr.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\PkgMgr.exe" > NUL5⤵
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "PkgMgr.exe"6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.16⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe" > NUL3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.htmlFilesize
12KB
MD565d4f7fce5345ac6bb2cc42597d54adf
SHA1d8eedc0ff32f12ae15aa366eb1211612ffcf1d5a
SHA2567529c5c895c67f831cb10b95a45af8bd0c9c1f92a74e97713608b8d6388e737b
SHA5122ffd9ba3efb18c8a1c209087ba4a19f232227cbb354d9ab93110865d8c38e476d95926453c408618a03628820ebe8f7e9cd6bcf552a3a5a1c336213b210d7385
-
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txtFilesize
10KB
MD5749f3939953d3873d2b909ea82b8c29c
SHA17ea1ebf4027e837375e3f227946e7e04dbacf738
SHA2568507499d81955a88b6bd4ec5b087cb718c48db49534aeeeaf2408fe70e402767
SHA51270f33598e50ab4f82dbf9361f2a51b3dcb16173f80a6e7f980d1fe31015b46c246d7ef8687dd70351d6ba9c58f755f9af981fb6352ebc3e7cb58476b7cd47e67
-
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.urlFilesize
83B
MD5d3fb9d5da0695f823092c69189100ff2
SHA109f7e9adab9495faa79c686c8cc19816d2ecd522
SHA2564eadc170889683f01c3be1de96ad1b5fb090006da748c2b9dbbe57d1b069e121
SHA512cfe020bbd13cc4d0f7e30861822763adf329f5c44323207118ebcee984a5b045c59bf7e5d467f80166c111a447549a86f70ea8e825363507175594124ea96c3c
-
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbsFilesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5e9dcfecc49a31bccbce34424f68eb600
SHA159350dc83b930500db1d29ea961993a793af90ba
SHA2568a580c9711d777c86886400e6e92d80706cc67fda0c5e50f3bddf1bd47d39beb
SHA5128f7a4a2a56e41a06cf3d4c7020711f9c171e75f157e15c1f1746b043332f2862ac6bbb0b22436dcf8dc5cee4ee10fc33bae2ce3584705c569a6c66f7e2a51fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD58f8f80385ff5d897c7cde8833154319e
SHA1f796889d75a9123be40f6fe3b374d4080311dbcc
SHA25604d483193cb9efe188129c858b555f52c85ca2fdbc5adaf176dfe562d635e178
SHA5129074df254e2f557b24fe647d22bfd3a8cd5a12eb59179dadee38b03aa66700347d0988010351ceabebdfd6d59f4a3b126df5e4b2cdbd8d72946061ade0d9de5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD54705859888dac60955db181616fa7463
SHA1ef68081fce30a935c5f78c6f21c09ed6befa5172
SHA2568365295fee1ad383e3a13b52e1dfb2587f7ecdd895905a2b8cd22b4e5faa69fd
SHA5127f808cce2a41f4238b7c4bce5205cadb30875cde3679258fe5ec5e54cfaf588aa53f9771a2ffc3e38720a7b87acb4e2d58b337d0e045731cca8c629a20c177e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD51cd0d62e0a3b2a9df8fa4fd4c05b8b18
SHA1aa315cba0dc7e0bc498e0a031c4136c5f3bee1bd
SHA25678a641d10b0646cfb02d92777ca80ea75bbb00f9fc6d5611fd1af9a1ec99c7bb
SHA5128df6718a6e7686c76a2eb242bb4ecd0d934eb4ee2d5b735a0e90bf1ae97e5030fe6e66cf6458c9b1f1ac752bdcb96d6fd88aeafe3c8b4d1aed6e965af2bdaa2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5d0472dd41531602483c4a4fb326036c9
SHA19ae750f6369af73fb9d416cb5d06ab6eb7d1ba98
SHA256433e1a350579f9b09e904bd514ca143b222430c0f7e286c96c42a49f726d1ea5
SHA512cb878a2b799e390227edf4374af8273aa9e97343cd5a2aa67bef791057428dd83b26dbfb580005a8cd2f7ca371c6df43a3e087fc88212084e97cd039a7485cc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5d282161c40db9e0d0ed621b4eed63c20
SHA1b3a31beceb1250506d2530845a96a00ad4935e6f
SHA25624536552b88d9af490d2c516c08d2066f1eb403bc14dfea70fb7067a590e8bcb
SHA512aa19bcf0aa8283b6f4393a85363c470c1983bf2c7bde6acfa3638c740aa7394317f7b90084868292df67bcdd2fc092da6fd320fc514a0c1c6605aa5befb2e9be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD59eaa49349c85e422853f2e63147fa88e
SHA10b7c50dd602b955444f29d0d9ff894adc10befc1
SHA256eb012945340af44c832c571c96c59edef0e2a4a5c7e7f9104aa9cad93f641ed8
SHA512b934db4981c7f984deb011275ad811866d4add424a30f10066c89cb8cec87d2fb27591fabf4c3871d4798b2433440bc7064a3c203e90899605d3a223542b261a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5c57a69efaf88e573be5b8df20063d20d
SHA16f184786242297b3a82cc0281453a1a51cc568b3
SHA2563eb0b73a92d74f583506b5f66d51e327418706cfd3d9bacfa5e38d6f7ceb33b7
SHA5129390747a00a2fee6796b4528dc63620648930a9f8c1280a999ac78697f14b0f2a5db4de39c04efd677f9c4ae30fff68ab2ad32dfd27043164a0cef351939f4b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5699c23e254a9d1b37565fadb124e7f43
SHA131c08f88b3f1988fc077c4793fe92703766f96cb
SHA256354612143fc83e6cd616602be95d238c66042856c81088351e58348a1c7ae950
SHA51216d27655001c985ee3de81b5901b511454baa3cf6ed58ae580d59d6ff45018b437452bd71296627c6722883c0d82d048903e8c9287418983d4a13066295ffe68
-
C:\Users\Admin\AppData\Local\Temp\Cab802B.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Cab8117.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar812B.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\3BSYBS1-DCSA_Alerts_05172015040008.xmlFilesize
1KB
MD502d85a522d05abc48ea60808a117a3b6
SHA14b838a6a61a35432632a17a3bba3b08d92c16400
SHA2566cf17674e8026ad42fe74bfda3132f985bc9fdf7fb4bc0b3cb1624af49a3ee73
SHA512864eac0c48ae9d1c5791b4294b42df953b3bddea08de4b6c9451369317c1d47f84728d5da2765f7c929549eb8ce7387528151f84dc41c8ad6309701c7ab4fe99
-
C:\Users\Admin\AppData\Roaming\424 bl 4.ADOFilesize
524B
MD5f180e85af9eea2a1d42807a6ebcb7a36
SHA15d49cde993f16d8259b10c5401280aa067c1b423
SHA2564e748cbdf4437760c6f7e32b770814bba131d1d9a1e9fa887ae62114a1be22f1
SHA51222ff1448e9197f5ad37b288bcad397fed8de00c2cd97178aa7b3ae766a7eef60d153db0e59293281829ea65d3c3e66ff6b7d6eb7e52a5d5c3c3f108b46d416eb
-
C:\Users\Admin\AppData\Roaming\BahrainFilesize
77B
MD5d7a8d88e7d5b134d92542787e019e123
SHA1ad633d30aa9f0bf314bba5f004060fc90a14a16d
SHA256859d70658cc7502f214d9abd669c4e730e798210c372fd7020ceae470ac7756c
SHA512194e553ecc8ffd376c029670ced1f2480509b072d2adebd6af22fa69945f3fafb58a3385d5a09451c85f03d891049b8123c0cd3907bce944cb4784606679ffa2
-
C:\Users\Admin\AppData\Roaming\BruneiFilesize
77B
MD5e25d4339e1f45436dc0dfbfcb96ebf3d
SHA11bfac0992a3b92e9db24f51e6cd18db2686e174f
SHA2565db2a1b2a800bad6a64345b5993cf04b37818fc9679203ae93f12e46ca8bc241
SHA512dcfb9a4d288c732b36fb54a3cd1e78bf50b700e917cdbedd021a1164b5d2e65ddb8debc1d26357e2cb2dc1ec04e1a9e03114225b136942c396deab1fa971c5f7
-
C:\Users\Admin\AppData\Roaming\DamascusFilesize
1KB
MD593657662177fdc9183a0fd632790c0ae
SHA15586f64b641545aa2610b3bcd5df7750a17955de
SHA256a353644ae75ca0a454a56caa9a442e361f1097ff429d035fc7ba73e87650e21e
SHA512c0a0deb8e5773c783e3656084fb751847b71b2b1e6b2bf489f31f97100e4c629c0266c10d3f1a75c6811a2a195308d564d7216be8bce01b8ec5dda3a5096eb93
-
C:\Users\Admin\AppData\Roaming\DushanbeFilesize
261B
MD570e3f2851ad0cacb4d9f850fc7d0cd60
SHA16fbdc432df31bd7af06c619f91bf7b759788be2e
SHA256caeec5309a9b777812307e423efc4112cb1eb25a00704848eb954ec4c70f174d
SHA5121d484b231b9180f87af6d9d926d5faeaab0547d0600a7bd77046f71b4b2eaf62785bda462726a13fec4136d0bb20e737de819577a43a8d8f60660519b6263a74
-
C:\Users\Admin\AppData\Roaming\HelsinkiFilesize
1KB
MD5f3b05d9cac6285e7ab08950275b0284a
SHA10a5d25e02a1784ff15c20c13840dbd48118360b6
SHA256e87cc9499cf2ada66c2b53ff2ef96ccb2726c08b4881608ceb23790bb60b3522
SHA51259d5c8ab5f09d0ccfd395510d24df8a9e4a935a6f9cc835142ac62b96416a395f8d6aa02e55a6d246f1879eb8e009e14b1ab5bad7b102ff53dfe0c3914a5b0c5
-
C:\Users\Admin\AppData\Roaming\KSCpc-EUC-VFilesize
3KB
MD5c8e708d1288dff4aba0cc066d873f187
SHA1c2078d884d95b0c3bf10dd0af5faafb0d504537b
SHA256d9f3be39a1777d1e3996b385b0ac90935e8fe6ab1b7a83cd9bfeca41fe7bd4ec
SHA512e60af3a3ccdb60273645a86a527a8152b9a80fae286948d546c53835b016cc31c686c2d3b22414e0b058fe3c56aba7761ceea817e9f73537f4ac4ccdb8a970e1
-
C:\Users\Admin\AppData\Roaming\LF_Disabled.pngFilesize
4KB
MD5885b8f6f03afc2875d358f189389a78a
SHA1c4f99bf71f30be63467897ca8a40067a132b98c4
SHA256796025f41c142dc5878c63ab5bdda17bd9516a333fce26bad36c22cca6a7c1da
SHA5122a305ecfc3a529ac4e40e9b26db83b6216fa21348c61555c0d38476e3f136d8b4c77afd619c23bb9181fa249d4da9c173e086037f3e1834af31d2805c1070f7a
-
C:\Users\Admin\AppData\Roaming\Makefile.docParamFilesize
1KB
MD54fa5ebe8c3bebd54be9eded49c1c8c27
SHA1b320a0a0add161ee971a26aa54ed2db48c6020e9
SHA256a24237defa96897c3b553f4f81d6609f9bddb1c191e6eed69b35abecf56be9d6
SHA5121b7cbfa09367b8c12ab54b3766bd9f450736efe1dacc91c6c6acdd68ca53d434699074b386f57f5e64a0c5ef71429065556782f6d9e87cda55550e1d89a32024
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\PkgMgr.lnkFilesize
1KB
MD5e7617ce35a1add0ed0db8e0ea1d59b0d
SHA1a3c28a1316ba6b1936281981d506d495f5db9a21
SHA256468b123a19e3177c1bfeba8ce0a451eba3da820655abe4a79fb8c7fb49d69b7f
SHA5127daa81174a0bf438aefa24ac96aa95f6554df9192fc5036abb9c655e3a7f8f9cd09f8dc7a7dea85a506d90812c436eda6f96cb54ad9e68abb2879176aaacfe41
-
C:\Users\Admin\AppData\Roaming\Monochromatic Low Contrast.hdtFilesize
112B
MD553ca81c9d2f8bde4285415e29568f19b
SHA1759eeba53e63000efb6b39ce5d61ed71ba5cfb7a
SHA256303b07b6f9d35762ebca5b5496f7910b42f54ed0eab5000e2324f08aab28e57e
SHA51280f197fc63b9d441b6387f193efb8f273e04e72121f2580f4709941cba4b7a513acbb8453e04db8e7575bd16f8eb4ac22e3556cee18c173c928c7f18c1589614
-
C:\Users\Admin\AppData\Roaming\VSFlat.hlslFilesize
148B
MD5387995a1ad77f6a492c6f16ce887b7f1
SHA1e2f22e55d1b10d877514d9adee20d0c244d7bc62
SHA256c5381ca7bbd13cb11c2d2e543ee12e9c4d080e77a765743574eaef6fff96c6e6
SHA5128010388b6444f09d2ace5a31a3910746c42dcade8cda487c9d9f6f90397803ec05c79efbd3ac6e227478d2a1e82bf3d862cb53a719ec10581a9c0de44bc327eb
-
C:\Users\Admin\AppData\Roaming\Vestibule.XMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\body.bg.color.xmlFilesize
891B
MD5c8f0d3c03c5696181ae7aafd8789bce8
SHA15ec888513c60fefb2a42027333cd1cffbff0b44a
SHA2565e78efc7d4505f63d57951859a336551904a546f55a1f7564e12494012fdef83
SHA5123a31d227a986aeca2863f8732e382a9ee3405869ff86c43bec6d3ff3bcacdaa72b9edaa5ae683c8084cd71a4eac7318f80bfc3a2e129fc66f920baed9b4eaa4c
-
C:\Users\Admin\AppData\Roaming\data.pngFilesize
1KB
MD5bd9ddfb41b3e25fd012e1f92dc942ea4
SHA1aef939292591094e6363d80e9d029f920bbed314
SHA256083d293c2882bb146cefbce31e9096d7bd340cc691e94e46a7be297a2ac9bb5e
SHA512933c93dfc0e4709368440973297c279f4e504dd7cf6dafa12d92e42831440de2d4ffac3c92a4b1fc8903ce04527abc7090a6ef5c2d74959c1db4e9f529ddf66a
-
C:\Users\Admin\AppData\Roaming\default_hash.jsFilesize
528B
MD53693c0548c4d9e4e57849a52a4523606
SHA11dc700379cd42b6f045bcc0048b4c844528c5a21
SHA256d197a4d9b206072739b60046fe03d60e10bccb70a7aec457e5b271f0ef038a7e
SHA51266183be23520f39e15a11b59e236fd757b778cc635ee2d1c4bfef9a80ca203c071de6891d7a050e1a97c37aa30c6c82e7050e5f5b6648b33014af8d12b652e12
-
C:\Users\Admin\AppData\Roaming\diagnostics_na.pngFilesize
410B
MD51b509acbb124eda9d7a1f722941096cc
SHA19ed8ce338f74a57365546c4e112cc25564b7c971
SHA256b6eaa77c7f3cc6efa96fc6f7f555477d7ba9226206cc954212d52d2e2dd90ebc
SHA51261ec6ef8e4697456261b9d49b883f40a75f50f5c4c6bcdd4a88809724608fa6645803ec30b687b7d8a07eb6ff088e3eeb5bd46b55e0d916ad4a2fcaeec173d2f
-
C:\Users\Admin\AppData\Roaming\diagnostics_na.pngFilesize
808B
MD5bc028a0820c2525818dafcbb36cdebe1
SHA1f6734d8c8ffccc8e9d7985e1a7f2e3e68c548fbd
SHA2560e7b6fa7cfd039417d89ee332d9f4ff9fb7489ca90dd9b01240a35c135668f03
SHA5128b315273202fe06774a85c6526cc478922b95a36353ea82c6699063ad946890ec2b5c5d2457f2fc3ff42a5f34b95023e22238059e0eb6f0824f956b31b6d54d8
-
C:\Users\Admin\AppData\Roaming\externalhelp.xsdFilesize
805B
MD54e78ba21399fe6c949c163ebc779bf60
SHA1d20b6e7d854a53394eb68d653b2eea32963fc96c
SHA256984afa83853bb983601491fc923fb957e523084c670745ee1d0ea6f6edfc5f6c
SHA51297f4440beabce2d6bb8783cd157ba3cab159dc6f0659a4315a65c4e1716350d2a03641465c1297ecd14332724d8ad2801f815667331dbd449cfa9765c2674b32
-
C:\Users\Admin\AppData\Roaming\f2.pngFilesize
1KB
MD5d327242e49b038fa123a598102e5d0cd
SHA1f5bbf38f4300883b83d4d9c41e70eebefaf8018a
SHA2568cbef400adddb7c310eb7fdd19ccffd80521064b435d9b391188023be7f3591b
SHA51289447e41596266fd297cb4f40a670ecf3be7cbc74af2cb4130416f6409c054d8e8b276cba3c522731e28e2a63879374738293af91322a2409100c045967517d4
-
C:\Users\Admin\AppData\Roaming\f6.pngFilesize
1KB
MD5e1cc4228bf8efcffeab59fb645c9832c
SHA1a4994becf0cd8c5f2924e4365e064f1a34fbdfec
SHA2565ece16429710ff94c832ebac8eb48614e547fdd7d94067bc5ddd64367776b961
SHA5124ea6bf172a002bf51408bdb0d4e6ea096209512465d3772e022b4db911be8c699a024c0d9f7d6f1af9f9d25a401a8cbc34b45a9526c0390dc0ab990ff4f75e00
-
C:\Users\Admin\AppData\Roaming\f6.pngFilesize
1KB
MD58abe12bf32d65c2f8c0af9c8bfd77c62
SHA1b63290e99b00a03cb08c6853b9b71ad1037e6031
SHA256c2dbce16e3def25797c4620928e614848c5e53deed6fdcb4a775758b38fa77a5
SHA5121024689524ed700d77bba93d834cbd5fceda521a6e328b02810ffc26421e95db0772c2546f87d3d1913b5710c169ac306fe86b939e091afe0c117ba9942adb62
-
C:\Users\Admin\AppData\Roaming\file_sig_verification.pngFilesize
543B
MD51315745b828d02838c8f3a8954bfe1c7
SHA157fb2c41320bdee698d75b59fd7ce5b337deba93
SHA256738bb684c612de4553ea636325846acc0b8661659ad5495ae79d08a31997d184
SHA5126e30b24b345c2b4a70d6444799fc5e87fc489bbcf9038a551a7406e7f4ec5dce9c51a5a6b77241f5bf2a60af346b4ac36fa099306cc0050380a9adf4e094ec3c
-
C:\Users\Admin\AppData\Roaming\file_sig_verification.pngFilesize
955B
MD571ff8835e27d495e764d33a08cd5dd31
SHA198920b18b7c98c3934c34ca95ee31fa60f3f04b5
SHA2565c347889ae446dc288c8d6d84552419cb012354548a905f9dcec40b674d64adc
SHA512bf35a3f661f15738689570c619edb78634412c6ce779f56ebfefbca0f993b3fa157a453eaad2658e1f86e1f3956835a29308f6bc70d0e857ef8810d28abd4c5e
-
C:\Users\Admin\AppData\Roaming\hammer.pngFilesize
3KB
MD510566dd922ce3766715d5950adef767c
SHA181afeabcb35828f71bff053ab342983e5cbec847
SHA256d1cdcf57ae3fc07e2d51c74be1be3df32557b11eafdf5c78a2fdd77426ec46b1
SHA512dcd842aba0bd34a7cd44353e4a0c2ae04e3e382a24de43ba36b0f146ef10abd887d88141e8a7432080e1324578c1ede199201ecd09521a7615cf45d7c8d08a23
-
C:\Users\Admin\AppData\Roaming\hammer.pngFilesize
3KB
MD5a4083c0b4c784f8bd8d25a2e11c94c00
SHA15055292a8aca3eb52c0b78107e394e81f1b640f4
SHA25642bc8a6bec014b8f0ded37fe4a84bda406166fa3ab74048146157bbef6b074ad
SHA512f381a7bd823d07e2e761ff7e7aa1e69a950bd91cbfe2812a8a6322400793f80f1f31f45ea8d993dcd454ed6deae227367813518e5798ca4841624cc278df9039
-
C:\Users\Admin\AppData\Roaming\html.cellpadding.xmlFilesize
983B
MD55b626b6f01e073a639410a00ba394414
SHA1c500c25c5976cc9b20c0bbb65a2869651dff50fd
SHA2564156be6502ba6daa517e5cff65e2792dd12e98f9ddcb439eda287080c461892c
SHA512a79ddfe1ec9085d42b0a1b6561a7a85b6d44880c893e0004060ed45e2bd1a16627c8cf1311e56ef81d4b61466015cda316cab7fadbab70075d7fa9a3e02f8849
-
C:\Users\Admin\AppData\Roaming\html.cellpadding.xmlFilesize
1KB
MD5a04752cb181220c0f648f7db3a8f5a61
SHA17f50ff711fce7d970b3ad9e63a87568f32017024
SHA256d011155b31698893194feb7c9bc1c1cad230430e1f151f51db054e1785de179d
SHA512cbab207cc5a75833fd8bf15af12c1e83071f70934f21ddb1f2ae95141115d65fe1a9fe6af905b6fe822ceecf40e3426f190d1113aab28c097ddd423a86e4c3a6
-
C:\Users\Admin\AppData\Roaming\itemizedlist.properties.xmlFilesize
1KB
MD541e5c9ebfc019a38e094c4868c9a1b10
SHA188d34e80beab2e1b4e9ff8baa963e47ea35e53db
SHA256b515a1b4f21354daa641ca0794cffa1007731ac8a08df5ff39171d180373d000
SHA512bb2538e88341d456f9d66c8ca6f756139d23bfa0c0aa03a9b30612863124ee04839572dfeab99f142849525f95f83b2d6a22a7a1b619c252a781a43c8422a291
-
C:\Users\Admin\AppData\Roaming\man.output.base.dir.xmlFilesize
1KB
MD5601499ed95bf6c937209ebbdae1b33ab
SHA13d0d6d945668498cce4f8d09d08920647fa08684
SHA256f808da08ad1b8e5ab75bcc7d8d2dcaf2fa51cdf47e693b212d2a893fe301d31c
SHA512eb3e95902d91c015f803270eed9046524a3943cff49845071ab90d99bb92b5f98a630153f1448da8466eabde7dc1693129a5f77ed15029a7c4f7ef68744743d7
-
C:\Users\Admin\AppData\Roaming\msconfig.pngFilesize
2KB
MD5ecbc5e3d8c0314a1671441ad66422581
SHA1356b6245df4dae2ec2d5312031438834171c94fb
SHA2564a9a8b1aa036980f933053221d996f69070c32410cd7467b7a8653c523ac7a43
SHA512c0b131bfbdcf6ece718e2b3b345327a2e9492e6bc3c3e8f63ee0d67c8ec32945971232df8e90bc617e32181e51899a1c67c74349aa44dd908a4a265523194964
-
C:\Users\Admin\AppData\Roaming\msconfig.pngFilesize
2KB
MD5e58cabadd11838d2fb5d5cb376b20930
SHA19fd4a2d683b8036659132c9f88ac3ede769d6b0d
SHA2565708872baf40ebc1fe8d2b3aedc38a7cab65e8d13b4766e194b1263612232397
SHA51250befbdd82f500e127e3de5c71d256d1f2a24071515499e8ddea3ffe4abe3b148d5db158f8d14a90c0434d68a9d4962609a3595d0b044250ba6aa04a0cde42ad
-
C:\Users\Admin\AppData\Roaming\pointer.pngFilesize
556B
MD51fdfde82d31456ca9d1d378235ef4f1b
SHA179f736075090fe8942ae69e9e0ffc2198935059f
SHA25693e4b5913a084791e282efa6c018388a31a5100df870e0aa38c6b5f73d66b1ec
SHA5122044ab0584681f904778ae7cd785725cfefa259db6ed9e6181f3949b14a888c0d725ca9bdaaa2c3ca4c9e3f83e7859c4707e0298248ef1381f8c928bd045b971
-
C:\Users\Admin\AppData\Roaming\smartcard_reader.pngFilesize
4KB
MD58ad63bce5bbb3a69ffcc1cc5eb065cae
SHA1baff947cb368dddf86df3c74d89f44fe16f46872
SHA25638a51458fba9b2bbd6060d95c483959dd343453cf9e0cf970698236d4b58d23d
SHA512a1e70d333a929d99ee1368bb318e7d9d32d4f82e5d7cb867dc5c75a91be2da25f4fe02e42f2e2a64d3350bd8726d7cba0a80fd41cb148719da7d345deaa07f7b
-
C:\Users\Admin\AppData\Roaming\smartcard_reader.pngFilesize
4KB
MD581f983bf97abfe3d28918bb2ce9e8a06
SHA10a84a215a7778f9c7fbc0f4758d45a3ce86cd10a
SHA256e5f5b97d653805627d26704d64f156c07e3dea01df45e4d582ca14a131bce28f
SHA512ff716bd138b468b69fad718acb2e40bb62a8980344f9ae01cfe4e91eb3a12a94c06cdb28011a03a2cd22d538a654b40909d5f0da29a95bd39d75fb4d8a107b62
-
C:\Users\Admin\AppData\Roaming\tweakNetworkingManual_es.p5pFilesize
1KB
MD5f815309cb6953d1a573e2bc721287053
SHA12e2284639a82b38fe6cb5d4e278ecdb4ce145370
SHA256cc0fe9c375dee9d1c548c506865cc086ab8914945156cb818db5d928622943fd
SHA512cc07f98f280ba81b32cc2490f3274aa60be379ba465cba3e15237396c8fc59cb41c12fad0135f8fbbacf232a5979782a8971d9008b934c936dd8f4d8f0ca98e0
-
C:\Users\Admin\AppData\Roaming\video_card.pngFilesize
3KB
MD58f76de212a59bcffc6613e3365cc9871
SHA15565c6f389b5c1ca190567b3d1055eba1be29ca6
SHA256c9b169107fca20ca721ad2dc03b065ae546093348ec5ebf9107b2c745f47cae1
SHA512571e12113723c076075cdceb1b9f6aaa9dc805b7700b1e624e0118a16d264f0c9b5c5b5414101fb2b80301112bbfddcbbbc0a4e960d7ba8107429b8666a96676
-
C:\Users\Admin\AppData\Roaming\video_card.pngFilesize
4KB
MD58b1a0b936059f38621043920eff3b416
SHA15d92c55ebf0533e9038bae889346554670cff7c9
SHA256872f3250c8a438dfca5389b6d48a628e8ca29f9c383ba0bbe3ea556b5b33dcc5
SHA5126a9fbd6d78e00b382792c4e000e3d758553eefdc4c67687a2046e1d869f4bfdaebd76ca6b74ee0a1e21aaa33c9733256df30ed41b1656279baead364943528c9
-
C:\Users\Admin\AppData\Roaming\yellow bl 4.ADOFilesize
524B
MD59f92ff064f3910a5199c60109ab20d42
SHA16949e2728d371d57d446c46d648a086849825656
SHA256586c1646484e700c6c80aa5f5031286119d97767f5cf7217758890439007738d
SHA512e48294ec60f229f9d59a5a251a0b9c2ab852a4b4c3c5b781476c5fb3844048c63fd91eb1866ebae956fbf4bfcb3bf950fb6ad4832f44b48bffd5415481553d7e
-
C:\Users\Admin\AppData\Roaming\{8F76CA93-6AF5-FCB8-1751-35093594ADFC}\PkgMgr.exeFilesize
186KB
MD51e039f9770017f09225e58d7759b700a
SHA1fc1e83365f05fb98b4dc94833e430a7adc055bf5
SHA256f9ab2087217beb38c3ec3dc043aad739dac202dc422f44e49c0fb5ca6db26502
SHA512ebeb10678547b0eca642645a673e9e6309c3ba961e62d83aca95aff8a351a56c07544c92688681e58dbe66cc8e0812ab01c388d0b5e463d5c97d4ea038bf26e2
-
\Users\Admin\AppData\Local\Temp\nso255D.tmp\System.dllFilesize
11KB
MD5883eff06ac96966270731e4e22817e11
SHA1523c87c98236cbc04430e87ec19b977595092ac8
SHA25644e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA51260333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
-
\Users\Admin\AppData\Roaming\Nwiz.dllFilesize
40KB
MD57f5859cddce6d27bf5ee5a0e5abf80f7
SHA13fdb34f8c461031de871716f913b6414d71e5f8b
SHA2569be59c18fa3c74fda8d6bbab8ce3b0ac980872261688c62c4ea3a89e7aaf3766
SHA512d4dd6c85edc84b77f3ec96071e6cd3ac29ea62d59852a0707616fb8b70f25fee6ede59818a2c3e9e69d260cee31ade339ea80b9838eb38498d33319dd41ab4b0
-
memory/1948-185-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/1948-187-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-192-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-200-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-193-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-183-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-627-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-180-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-181-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-190-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-188-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-632-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-630-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1948-624-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-62-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-54-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-83-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-48-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-53-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-65-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-56-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2568-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2568-50-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2932-165-0x00000000005F0000-0x00000000005FA000-memory.dmpFilesize
40KB
-
memory/2988-46-0x0000000001E10000-0x0000000001E1A000-memory.dmpFilesize
40KB