Analysis
-
max time kernel
130s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 22:36
Static task
static1
Behavioral task
behavioral1
Sample
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe
-
Size
344KB
-
MD5
270b70bad151a515136f553e5bc880ac
-
SHA1
77b7def336c7647c6faadaf7136d70ff1e9ba7fc
-
SHA256
db2f389b5566822f8cecb27b989920f16137e82b54b446868d01f73af23f5bfa
-
SHA512
c198f9498d634ec4d05cf29a1bb6ade8c59a2904510464e3b292b11bcf5382d7fe603e46b6a72b14f3f996811f68101e46c467914b21ea6eccaf423df2d1a43f
-
SSDEEP
3072:v5sAzvcjE+lcO3zXgKRcP66BpwwB9RStc3Yfqr:v5jvc4+lcO3zQKSPfBJXv3YM
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.vmfu48.win/7C14-B991-6859-0073-1116
http://cerberhhyed5frqa.45tori.win/7C14-B991-6859-0073-1116
http://cerberhhyed5frqa.fkr84i.win/7C14-B991-6859-0073-1116
http://cerberhhyed5frqa.fkri48.win/7C14-B991-6859-0073-1116
http://cerberhhyed5frqa.djre89.win/7C14-B991-6859-0073-1116
http://cerberhhyed5frqa.onion/7C14-B991-6859-0073-1116
Extracted
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16389) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2308 bcdedit.exe 2228 bcdedit.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exewecutil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{04E11A53-556B-582E-C494-323BC9541A7E}\\wecutil.exe\"" 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{04E11A53-556B-582E-C494-323BC9541A7E}\\wecutil.exe\"" wecutil.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2704 cmd.exe -
Drops startup file 2 IoCs
Processes:
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exewecutil.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\wecutil.lnk 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\wecutil.lnk wecutil.exe -
Executes dropped EXE 1 IoCs
Processes:
wecutil.exepid process 2340 wecutil.exe -
Loads dropped DLL 3 IoCs
Processes:
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exewecutil.exepid process 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe 2340 wecutil.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wecutil.exe270b70bad151a515136f553e5bc880ac_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\wecutil = "\"C:\\Users\\Admin\\AppData\\Roaming\\{04E11A53-556B-582E-C494-323BC9541A7E}\\wecutil.exe\"" wecutil.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wecutil = "\"C:\\Users\\Admin\\AppData\\Roaming\\{04E11A53-556B-582E-C494-323BC9541A7E}\\wecutil.exe\"" wecutil.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\wecutil = "\"C:\\Users\\Admin\\AppData\\Roaming\\{04E11A53-556B-582E-C494-323BC9541A7E}\\wecutil.exe\"" 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wecutil = "\"C:\\Users\\Admin\\AppData\\Roaming\\{04E11A53-556B-582E-C494-323BC9541A7E}\\wecutil.exe\"" 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe -
Processes:
wecutil.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wecutil.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
wecutil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp1584.bmp" wecutil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2716 vssadmin.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2864 taskkill.exe 1136 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exewecutil.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{04E11A53-556B-582E-C494-323BC9541A7E}\\wecutil.exe\"" 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop wecutil.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{04E11A53-556B-582E-C494-323BC9541A7E}\\wecutil.exe\"" wecutil.exe -
Processes:
IEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421369717" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DA44901-0D8B-11EF-873B-52ADCDCA366E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1034465098a1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000e8d18affc8b9c8d4663b03f067f4245cfdc2cef4640d346f4d3a8ac1aa8a5f74000000000e800000000200002000000066d82ac8b482ace83d749fcc9f06d24050e5e60e58dff164f27cfcde3e8c3339200000000d83a73f650876d551f7d62d62df8c1b69c63acf8c1bb13cc997fcaacf1855dd40000000a008e56ad2edcab233f42297a52e97cb7ba17086d67d6358852aa7a7a5c2588b37ba97e3696f083cc769e5e69c5a98139fa35fa30a2a1dcb3211110d227b9732 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c1b1608a003899632abd56e4d2a29b587f995d5bb937cfb4bb800f5722c2e241000000000e800000000200002000000034ec3127321e3f1529134c459456ce56a64f72359d93eba1b2be4dd143802bab900000009b2cca12ec8302638cbcb8d8148ac6d048473e328ab9eed96e4074ed8c11d3bbaeef38df3a8480ae9f817289f8c972600bd27068587c67796deb3967bab43d0a9cd3d92ec93a4a3a78bbf18f2ea93e5cdf91bb08c3efeeb20a7f38ad7590cccbd7a8d9f0e2522d8cd58b74166fa15871370bfe995d21f4edee9db24ea90f90fa8eeefc45f01ac97ee6cb7d01633ed16c40000000bd13a41c99b84e8624021675d2f7444892e5de043523b3c511f3ce6bbc5ec4092371f905e4f3cc836c350a4a469d29d75ac9ce88fe24d725fbd17bbecb9ae37e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D986221-0D8B-11EF-873B-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
wecutil.exepid process 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe 2340 wecutil.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exewecutil.exevssvc.exetaskkill.exewmic.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe Token: SeDebugPrivilege 2340 wecutil.exe Token: SeBackupPrivilege 2700 vssvc.exe Token: SeRestorePrivilege 2700 vssvc.exe Token: SeAuditPrivilege 2700 vssvc.exe Token: SeDebugPrivilege 2864 taskkill.exe Token: SeIncreaseQuotaPrivilege 2636 wmic.exe Token: SeSecurityPrivilege 2636 wmic.exe Token: SeTakeOwnershipPrivilege 2636 wmic.exe Token: SeLoadDriverPrivilege 2636 wmic.exe Token: SeSystemProfilePrivilege 2636 wmic.exe Token: SeSystemtimePrivilege 2636 wmic.exe Token: SeProfSingleProcessPrivilege 2636 wmic.exe Token: SeIncBasePriorityPrivilege 2636 wmic.exe Token: SeCreatePagefilePrivilege 2636 wmic.exe Token: SeBackupPrivilege 2636 wmic.exe Token: SeRestorePrivilege 2636 wmic.exe Token: SeShutdownPrivilege 2636 wmic.exe Token: SeDebugPrivilege 2636 wmic.exe Token: SeSystemEnvironmentPrivilege 2636 wmic.exe Token: SeRemoteShutdownPrivilege 2636 wmic.exe Token: SeUndockPrivilege 2636 wmic.exe Token: SeManageVolumePrivilege 2636 wmic.exe Token: 33 2636 wmic.exe Token: 34 2636 wmic.exe Token: 35 2636 wmic.exe Token: SeIncreaseQuotaPrivilege 2636 wmic.exe Token: SeSecurityPrivilege 2636 wmic.exe Token: SeTakeOwnershipPrivilege 2636 wmic.exe Token: SeLoadDriverPrivilege 2636 wmic.exe Token: SeSystemProfilePrivilege 2636 wmic.exe Token: SeSystemtimePrivilege 2636 wmic.exe Token: SeProfSingleProcessPrivilege 2636 wmic.exe Token: SeIncBasePriorityPrivilege 2636 wmic.exe Token: SeCreatePagefilePrivilege 2636 wmic.exe Token: SeBackupPrivilege 2636 wmic.exe Token: SeRestorePrivilege 2636 wmic.exe Token: SeShutdownPrivilege 2636 wmic.exe Token: SeDebugPrivilege 2636 wmic.exe Token: SeSystemEnvironmentPrivilege 2636 wmic.exe Token: SeRemoteShutdownPrivilege 2636 wmic.exe Token: SeUndockPrivilege 2636 wmic.exe Token: SeManageVolumePrivilege 2636 wmic.exe Token: 33 2636 wmic.exe Token: 34 2636 wmic.exe Token: 35 2636 wmic.exe Token: SeDebugPrivilege 1136 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 1512 iexplore.exe 1940 iexplore.exe 1512 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 1512 iexplore.exe 1512 iexplore.exe 1940 iexplore.exe 1940 iexplore.exe 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 1512 iexplore.exe 1512 iexplore.exe 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exewecutil.exepid process 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe 2340 wecutil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
270b70bad151a515136f553e5bc880ac_JaffaCakes118.exewecutil.execmd.exeiexplore.exeiexplore.execmd.exedescription pid process target process PID 3016 wrote to memory of 2340 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe wecutil.exe PID 3016 wrote to memory of 2340 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe wecutil.exe PID 3016 wrote to memory of 2340 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe wecutil.exe PID 3016 wrote to memory of 2340 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe wecutil.exe PID 2340 wrote to memory of 2716 2340 wecutil.exe vssadmin.exe PID 2340 wrote to memory of 2716 2340 wecutil.exe vssadmin.exe PID 2340 wrote to memory of 2716 2340 wecutil.exe vssadmin.exe PID 2340 wrote to memory of 2716 2340 wecutil.exe vssadmin.exe PID 3016 wrote to memory of 2704 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe cmd.exe PID 3016 wrote to memory of 2704 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe cmd.exe PID 3016 wrote to memory of 2704 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe cmd.exe PID 3016 wrote to memory of 2704 3016 270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe cmd.exe PID 2704 wrote to memory of 2864 2704 cmd.exe taskkill.exe PID 2704 wrote to memory of 2864 2704 cmd.exe taskkill.exe PID 2704 wrote to memory of 2864 2704 cmd.exe taskkill.exe PID 2704 wrote to memory of 2864 2704 cmd.exe taskkill.exe PID 2704 wrote to memory of 2500 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2500 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2500 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2500 2704 cmd.exe PING.EXE PID 2340 wrote to memory of 2636 2340 wecutil.exe wmic.exe PID 2340 wrote to memory of 2636 2340 wecutil.exe wmic.exe PID 2340 wrote to memory of 2636 2340 wecutil.exe wmic.exe PID 2340 wrote to memory of 2636 2340 wecutil.exe wmic.exe PID 2340 wrote to memory of 2308 2340 wecutil.exe bcdedit.exe PID 2340 wrote to memory of 2308 2340 wecutil.exe bcdedit.exe PID 2340 wrote to memory of 2308 2340 wecutil.exe bcdedit.exe PID 2340 wrote to memory of 2308 2340 wecutil.exe bcdedit.exe PID 2340 wrote to memory of 2228 2340 wecutil.exe bcdedit.exe PID 2340 wrote to memory of 2228 2340 wecutil.exe bcdedit.exe PID 2340 wrote to memory of 2228 2340 wecutil.exe bcdedit.exe PID 2340 wrote to memory of 2228 2340 wecutil.exe bcdedit.exe PID 2340 wrote to memory of 1512 2340 wecutil.exe iexplore.exe PID 2340 wrote to memory of 1512 2340 wecutil.exe iexplore.exe PID 2340 wrote to memory of 1512 2340 wecutil.exe iexplore.exe PID 2340 wrote to memory of 1512 2340 wecutil.exe iexplore.exe PID 2340 wrote to memory of 764 2340 wecutil.exe NOTEPAD.EXE PID 2340 wrote to memory of 764 2340 wecutil.exe NOTEPAD.EXE PID 2340 wrote to memory of 764 2340 wecutil.exe NOTEPAD.EXE PID 2340 wrote to memory of 764 2340 wecutil.exe NOTEPAD.EXE PID 1512 wrote to memory of 2764 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 2764 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 2764 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 2764 1512 iexplore.exe IEXPLORE.EXE PID 1940 wrote to memory of 2748 1940 iexplore.exe IEXPLORE.EXE PID 1940 wrote to memory of 2748 1940 iexplore.exe IEXPLORE.EXE PID 1940 wrote to memory of 2748 1940 iexplore.exe IEXPLORE.EXE PID 1940 wrote to memory of 2748 1940 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 2056 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 2056 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 2056 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 2056 1512 iexplore.exe IEXPLORE.EXE PID 2340 wrote to memory of 232 2340 wecutil.exe WScript.exe PID 2340 wrote to memory of 232 2340 wecutil.exe WScript.exe PID 2340 wrote to memory of 232 2340 wecutil.exe WScript.exe PID 2340 wrote to memory of 232 2340 wecutil.exe WScript.exe PID 2340 wrote to memory of 1808 2340 wecutil.exe cmd.exe PID 2340 wrote to memory of 1808 2340 wecutil.exe cmd.exe PID 2340 wrote to memory of 1808 2340 wecutil.exe cmd.exe PID 2340 wrote to memory of 1808 2340 wecutil.exe cmd.exe PID 1808 wrote to memory of 1136 1808 cmd.exe taskkill.exe PID 1808 wrote to memory of 1136 1808 cmd.exe taskkill.exe PID 1808 wrote to memory of 1136 1808 cmd.exe taskkill.exe PID 1808 wrote to memory of 684 1808 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{04E11A53-556B-582E-C494-323BC9541A7E}\wecutil.exe"C:\Users\Admin\AppData\Roaming\{04E11A53-556B-582E-C494-323BC9541A7E}\wecutil.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:603137 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "wecutil.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{04E11A53-556B-582E-C494-323BC9541A7E}\wecutil.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "wecutil.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "270b70bad151a515136f553e5bc880ac_JaffaCakes118.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.htmlFilesize
12KB
MD5c8c4f45274744b74e7502050e9e7c87d
SHA1a80f622de3be949be71ce1f4e9eed200ee2ef29c
SHA25688b70df7c6a18649050f8d1cd5f34f983ffb50d4ce15edbbc58300bbe0432cad
SHA5123662adf47a8188622af42c0841b909f518329c4e7df7dfafdd2306e7fbdd91e4ea5c51d0a74a8a6dc9ea203d33800b3d4df9b5cc488764a87e2bf6eacc4e13a4
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txtFilesize
10KB
MD5bcea9d9ec189e304bf3c09900ea70b84
SHA1f334b320e20626c4e3dbd2b2c277b7b457beaf27
SHA256fd537d81dee51f4bf0a8fdb6a7585aed397fb40837e7157e6644d592ed1ebd35
SHA5120dd633775d62ed60b86a6baa1a82a31bca8bd74aff4edbd6741efaa4f93eea89aa26b4393a370e6157c2d1b5740b88cf29528aaa9c1a8a05728e1fb100079695
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.urlFilesize
85B
MD565c5303fcb97dcb1d3b6aefc697fc010
SHA190bb3db7ba50c70107e99ea37cb3d192bba94e9d
SHA2561379b29fdca02b8c009cfeb49e710aa71ec964a9cc350a8972d0454819fe9cd4
SHA51245c228592783238dcfdcd7bc13e55e1a5131fd366935f54d3dd8f3c20694d16db49d3fe196ca17042a07361eafa63bd267434e34342198bbe593fa5b78eec555
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbsFilesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD570a026a3a4e6b4f69ca589dafc67f6a0
SHA1e12b6fc963fbb2c57a6a2b5da551a30a8b819c18
SHA256e8891c817ff6588853628cf69603038fcf997e792c9ef00913e91952797636de
SHA512d13355c03f30ed61387817a9471198caa7b7c5bb0305b01034cedc18bd2f5507817ae47d194507033565c5a93f893a9205dd08bf2effc00cd6aa40a8082ef087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD549a00829c30c5fe1869c63c024ba8bb2
SHA1cf1b6f892c63eba516a076e9863527bb071a73e8
SHA25624a07138e1f4cb4316e8406a00dffee1341469aec7cd4be506376f626ade1dc1
SHA512d8f6d331fc6049d0563d435019745342fe85f45ef19a2753d43d40556c9f9b9c804bec3b0d20f6926b2bf9b74d4b3d440d4ad3968950443cca045977a0206f55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD542bc913f48d0cad009547290ee5a99c7
SHA1c91e8bcad73500ec63de14d12d82d614725cc508
SHA256d6b372273fcd42e129abbd8c1432c9b2a6b93ddd3e241ba5ac4401ae5e927b79
SHA5129c17b5313400fa5f02d63493eff1d606acbda7c05b38a0989fb0a21c00c9332c5d7955c2bb9fe46f279df4f3e74505966277c7242f3ddbec09e608df1f388d3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a50f4c392e5b4d174e3f0e417bd95f82
SHA1f3569dd6af7aba5f758d78517da299f442254448
SHA256b75f83b217da42c66ec2cf75ea11849b82cc00545dfc5d85fa0727a0a7f892b7
SHA512a6a605e083c1d26b22d9926f353869b2447e242129159adcb3d575165d5960aa09e3caf09152209eb8cb0f4c6ffc7ad55d3be259cf2b8188808e475d9cdb2641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5896a3fa737fe0020a111417fa139b5cd
SHA19c8759451e283b0171f8f17bac164c5c575bc443
SHA256485e1ee640f620381d9d61e2b009ea33c914c35a9224141d72d5a2783439c31c
SHA512ecaa93bf60640331f42eb3f0cd70e072aab9d1501fb4a7537d037771132d10017aead3262060f3cd898d8d4d36816ea65c4f24b41e08496bdaf4ebe660b72672
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c4d018d93c5e0d33ee119e6931e560b4
SHA15c1a1edb43b2e5d95543d9b582931be4cbfe8df8
SHA2568a617f8003b4caf6a650eb16ae25b811c5c050d26cd278b4ef2fb9f8c5154fd4
SHA512ddb135034c19da10eb52d538288d0709952cc6c484f110a086aa628356c10ea63fe51fb651bd26d13687804fcba47e76eb99ca7bab2f9c5a085c392cd7daa9a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d810be7589647d6653db516e5a8a4e21
SHA1f51810f0aabcf5594c7ed24a45718fe15a141819
SHA256b7507669d6342d45f470ce4fee100376dedf066ff98671de0922305405dff2e3
SHA5123ee9c32837067c5b3fa8217140656312a5324c777fbf03383f3d18ad307bed9b05ef070e07e126639964696bf0770f91b7193195f1104bcb969a9b15c7e0113f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5347a3d45ae458847de28d7fe9ec90451
SHA1aedb3294b79d5b94619b1f6c16b5407bfeb1d2f4
SHA25664e21932e058d8e81fbd4d555ca0e235f3832e1cfefa85d1fd7e7fcfd9c09762
SHA512a39d6dc039866bb66f44974fa90411f1c9a63e215712d71a52d841b0513619c71f70512ee714a2c438872d0082db0581575cc0980d79b8e1222ff2eb810a38bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD571d1e2fb3a9b4cff7717fdb46517e6fa
SHA18896d12aa4de6ad79d1754b9b9afb0219d2f3401
SHA256d8cbd9e5cc1dab202e58c3f03b4a281b92322c3ad821f1cc41159735b241f5b2
SHA512f604d2a02fddbab43d33ca47eef963cec577e8569e002d2ac7239c9ca32f4ba144b48773c8f7dc3468862d1c6b35cff7e05d67b549958ac017c92b1aca634d8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD584ef53447151faa58259fe80caaae712
SHA1388fd074c6bd51b419146519eeddd6a337d5072b
SHA25635fe7b318f814231212ff18ab6c9def143236d74e7a4252d48079b864ecfa407
SHA51267e1b5023f54c74204cae8f2ed3a6c71dda47b60b6524835793ca7e097387402891abc390b44f938f37313ea1461a4722d037bb41c6276911f73f2bf1b3d93d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5deaeffddfdd5fa17f4dddd6660efbe02
SHA1391dd3b85c9fc41ed2f12ee6a8f0af60f556b6ec
SHA256822cfc9ddbedfdc1dd0be19c327264685fa2f2272eb992e08aec19af2a9b8d89
SHA512215ef7734beffa8a6307edde1199d48521087d3342c38200243cd0a0ec564e0ecb10de9f5a2e79145441556fae29c6c55d2ed304cc15dbbca3247afad47903c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56ef1a295e73e6259eaef90ad1e8226e2
SHA1072ec889ed2325329af507fb61a6b098b8969e6c
SHA256d09645a0e20b9b85d54f9c3e02cdc36d4193cc162cb2f7687a38842c87b3ccf1
SHA51263a518ba2215ede9b997367044be2f0e7ae43ca0df74e708bbbda357618e9157e5521f9f5fdc3ddaad3b97e8ddc28244a44c012c9d2512272f9635589404136e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c009bcc0f32222252b179cccc7f903a8
SHA1390364b4fb4b4634c75d36b4aa834aa9517f03cb
SHA256d697ba247e2e66929846aec38ac2c1ddda2119341f870c274fa561db62264e10
SHA5121359a610798e141d6303011e446bd078e824d832627e8c066c5cefa61c0189a47fb6fffae8db2af90af236be658a4863a5f3c6cde2e334a0149b0075a75197ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5375f801ec73b259ab52347e7e2fe260d
SHA19cd3b969c96e027f1aad528af15d4db46fe541f3
SHA256bf2195269bf40078eb443cdcd78da904f74df05d24c684ce1825773c96736f1a
SHA5124d63845faa9a7b60a8badd36b568754764ff5b81d93fe11ac19e328606fe479b1734c09a9e5e54ca8a2f55d6fb88fb418b10918366bfbdd5f86fa0e4b2f7bf84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56162c5065433dced61623fc3b777e611
SHA1cfa5f640562c4b7d2458ef2658536b0d695905ff
SHA2565cc089aeec6dbeead647713cb8ef8773a776771faf0cc209712888d314fee7d7
SHA5121a5d0704940aeadcfa8606f10ec29ad65f60ea347bb88bb397d653446285e8b664c60d3e74f6075780466d00356606ecebf8d5ab574babd0877378d16ee8f761
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f7d56f143aea2136f13cd39cb09040dd
SHA137f43c97db89ec8094a3c00fd8351616589807e3
SHA256e6bee18075adc4d967494202ff4e40a5964ef3aba849ae89c6ae6e375a2bd6fe
SHA51249ba1690503acf1fe9e003858bd81a4cbd4d31b1311fe5674328fc51f2658492c27dfd3911c68468a5c083315aaf3d4fb491c9b434882e1fdb2eb258d5899bfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58fce11ab35449bd92afaa9bd8cd51b86
SHA1fa60db222fb86f8480f831f1c18ece30db64c13d
SHA256ede022537850d7e470c6fcff0ea2b3e18517699b286f227078b707382e926cf8
SHA5128cd787732c575c419d0d29c6b9f68b5a4187fde6782723bbe743e5bf521edb0277f2c49bb5e53505e6858b897771d90c17ff3538bad53bc63a0dc16bb6a745c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ed020bf6dde230bb84a1ba50e91672b5
SHA10710a7226d7ad6767cca54917ebcd24c43fb9f24
SHA25610525558c88908df90ca2b1fc818ee6b153ff9d70a0b697571f884113a22c311
SHA5120b6e4eec42963177ad0d075641b584407cec329d2beee100b2eb5f17a9a5aae6ddfce9f9e9299fe3abf7eef4c09b26118c5a01f3be7ff85e93d9e792b22067a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51ad8e08ad8ebe365fdd7d831e38f3711
SHA146904173a1b5c2812053e8332d8a52ea53f9987b
SHA2564c68304ff3efc07e959a4cf2a976fa004ad5b9e62c3aa3a7a4513a3dd6562fbb
SHA5128c47931653bdc6c40f1202776d031ace98f5f00c7510b26f5356ff6435f4a2c8f462123afbe258f5d5af06fbd5a9518bd59029a947d09a7c9b2feca994ae0534
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8D986221-0D8B-11EF-873B-52ADCDCA366E}.datFilesize
5KB
MD59f3f1ed551ddd4a152f3e6aac6dd5ed4
SHA190c3ad65732e86e03e9190a099c80f7b0c0b72dc
SHA2561cd7f8576a358d3ca4d1fba2ba6bfb555bb362c7c177ed14d980b13c7d8b6fa2
SHA5120a77936441cfad3d2df673573fb7ba21c73980da8babbfb28f2a449c2e2d3912457383a65365959bc32ed48d5fc656e3c1e08d9638aec0efbb28eaab633f7336
-
C:\Users\Admin\AppData\Local\Temp\Cab2C32.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar2D04.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\wecutil.lnkFilesize
1KB
MD5bd4d7397a14bfe90058e155b63eb6118
SHA1f68ff454800ce8e2119121385902949043af0674
SHA25618b335ca356b85a255b3000acb9e970246c22449b0d944715601aa88ec16c87d
SHA512ab5bec3f28bc949907100ec77db71831f485a97af22137d54778909f51fd3b22ad696a36a2759a8ab9de22989242bf8902d341915d634892a82ac6846ba9bd86
-
\Users\Admin\AppData\Roaming\{04E11A53-556B-582E-C494-323BC9541A7E}\wecutil.exeFilesize
344KB
MD5270b70bad151a515136f553e5bc880ac
SHA177b7def336c7647c6faadaf7136d70ff1e9ba7fc
SHA256db2f389b5566822f8cecb27b989920f16137e82b54b446868d01f73af23f5bfa
SHA512c198f9498d634ec4d05cf29a1bb6ade8c59a2904510464e3b292b11bcf5382d7fe603e46b6a72b14f3f996811f68101e46c467914b21ea6eccaf423df2d1a43f
-
memory/2340-428-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-457-0x00000000053E0000-0x00000000053E2000-memory.dmpFilesize
8KB
-
memory/2340-411-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-409-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-41-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-37-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-28-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-417-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-27-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-419-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-25-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-24-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/2340-447-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-444-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-426-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-413-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-430-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-434-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-439-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-943-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-437-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-442-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-22-0x0000000003480000-0x0000000003481000-memory.dmpFilesize
4KB
-
memory/2340-15-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-17-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2340-14-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/3016-19-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3016-0-0x0000000000130000-0x000000000014E000-memory.dmpFilesize
120KB
-
memory/3016-2-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3016-1-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB