Overview
overview
10Static
static
33ce23461e1...18.exe
windows7-x64
103ce23461e1...18.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3NsResize.dll
windows7-x64
1NsResize.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 22:47
Static task
static1
Behavioral task
behavioral1
Sample
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
NsResize.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
NsResize.dll
Resource
win10v2004-20240426-en
General
-
Target
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe
-
Size
243KB
-
MD5
3ce23461e15c48785716ecef4a2f9be8
-
SHA1
f8cb374c9d216f3859cd0e681ad79fb7e7e8f84d
-
SHA256
af2c25f184a8542888750b7d150d955c638c3ee1633933b7262dcb6a1b82d0e2
-
SHA512
eb9da01bba9f172c90b8c330f8b52c6534429c72bac6b65179564fe0e82f738b7233461220163d55a92b62d665cde82e1243cdcb9f3752271707ab6f56ef9a7c
-
SSDEEP
6144:MkyacpfMzk1+nQFGbjVXgyLB5NaLVtju0r0/fk4Xc/Be1H23:MkyfYk4nXbjVLLBGLVtjuf/fk40Q1H23
Malware Config
Extracted
C:\Users\Admin\Downloads\# HELP DECRYPT #.txt
http://52uo5k3t73ypjije.y12acl.bid/AF5A-0EE6-8876-0046-1565
http://52uo5k3t73ypjije.f0jlbj.bid/AF5A-0EE6-8876-0046-1565
http://52uo5k3t73ypjije.cm5ohx.bid/AF5A-0EE6-8876-0046-1565
http://52uo5k3t73ypjije.jal9lk.bid/AF5A-0EE6-8876-0046-1565
http://52uo5k3t73ypjije.onion.to/AF5A-0EE6-8876-0046-1565
http://52uo5k3t73ypjije.onion/AF5A-0EE6-8876-0046-1565
Extracted
C:\Users\Admin\Downloads\# HELP DECRYPT #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1936 bcdedit.exe 2828 bcdedit.exe -
Contacts a large (524) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2660 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exepid process 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpCF31.bmp" 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exedescription pid process target process PID 1908 set thread context of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe -
Drops file in Program Files directory 8 IoCs
Processes:
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.html 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.txt 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.url 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2560 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 220 taskkill.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d2aeab87a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E90CCFE1-117A-11EF-B69B-6AA5205CD920} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008acd8fad6d6d934c9f0d8b800501b495000000000200000000001066000000010000200000003daa95b8fff02cfffb890541488f2cc1a443d7a0ac4bb6ede824c47ce00a2ffa000000000e8000000002000020000000f1888795bbfefc71281e2828f829e43b91671741c34ce2f83132cee8e67dfc4720000000561c4ccc8213e41dfb0e1507f62af3069d164ed07ab7769e2a057e3c4b7f754040000000f40476459c187b9a07fc24b63834febfe321d6668777a3b924e439ace86c9c5e5f151e5fdc97e2bbb5bdcd706069a21530c53c1beb260ac104f519ded94aeb4b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E905ABC1-117A-11EF-B69B-6AA5205CD920} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421802374" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008acd8fad6d6d934c9f0d8b800501b4950000000002000000000010660000000100002000000001ae1c294ee2a5d62e76e1cf7a9b5e8c5f4dd9f36330811cf9fe6701feedb983000000000e80000000020000200000001809736f7a6a6061c8fb92774f6cc4632792533f6ce1e05af73a5ffead252b40900000009761967fda8aa48255670fb26fd11531ce24820773573ca1685c5e6e56a272cbbc208d5100b73e78986f1d0ea9e896b0d67a36c4ed356fbfbfc55d97896fe6d3f2e94b146e868ba8458c4afa2d30ebb680f98ce1ba9d21bffd4cc9dc0b2925ff94aa212a8cce9eed29b33fccaac1a73893fa7e309307aa802e605b56157aa3965eca3230d1c39bc13db3cc339143782d400000006400b1de4aaa14044da187f1a411673ba1d0b9a6d44f6be5c051ca62dffa1044abb2d96b3a15966f920cb3867c5c7cec161583946d23ac192cd2f709e3474891 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exepid process 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exevssvc.exeWMIC.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe Token: SeBackupPrivilege 3024 vssvc.exe Token: SeRestorePrivilege 3024 vssvc.exe Token: SeAuditPrivilege 3024 vssvc.exe Token: SeIncreaseQuotaPrivilege 3012 WMIC.exe Token: SeSecurityPrivilege 3012 WMIC.exe Token: SeTakeOwnershipPrivilege 3012 WMIC.exe Token: SeLoadDriverPrivilege 3012 WMIC.exe Token: SeSystemProfilePrivilege 3012 WMIC.exe Token: SeSystemtimePrivilege 3012 WMIC.exe Token: SeProfSingleProcessPrivilege 3012 WMIC.exe Token: SeIncBasePriorityPrivilege 3012 WMIC.exe Token: SeCreatePagefilePrivilege 3012 WMIC.exe Token: SeBackupPrivilege 3012 WMIC.exe Token: SeRestorePrivilege 3012 WMIC.exe Token: SeShutdownPrivilege 3012 WMIC.exe Token: SeDebugPrivilege 3012 WMIC.exe Token: SeSystemEnvironmentPrivilege 3012 WMIC.exe Token: SeRemoteShutdownPrivilege 3012 WMIC.exe Token: SeUndockPrivilege 3012 WMIC.exe Token: SeManageVolumePrivilege 3012 WMIC.exe Token: 33 3012 WMIC.exe Token: 34 3012 WMIC.exe Token: 35 3012 WMIC.exe Token: SeIncreaseQuotaPrivilege 3012 WMIC.exe Token: SeSecurityPrivilege 3012 WMIC.exe Token: SeTakeOwnershipPrivilege 3012 WMIC.exe Token: SeLoadDriverPrivilege 3012 WMIC.exe Token: SeSystemProfilePrivilege 3012 WMIC.exe Token: SeSystemtimePrivilege 3012 WMIC.exe Token: SeProfSingleProcessPrivilege 3012 WMIC.exe Token: SeIncBasePriorityPrivilege 3012 WMIC.exe Token: SeCreatePagefilePrivilege 3012 WMIC.exe Token: SeBackupPrivilege 3012 WMIC.exe Token: SeRestorePrivilege 3012 WMIC.exe Token: SeShutdownPrivilege 3012 WMIC.exe Token: SeDebugPrivilege 3012 WMIC.exe Token: SeSystemEnvironmentPrivilege 3012 WMIC.exe Token: SeRemoteShutdownPrivilege 3012 WMIC.exe Token: SeUndockPrivilege 3012 WMIC.exe Token: SeManageVolumePrivilege 3012 WMIC.exe Token: 33 3012 WMIC.exe Token: 34 3012 WMIC.exe Token: 35 3012 WMIC.exe Token: SeDebugPrivilege 220 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 2928 iexplore.exe 2928 iexplore.exe 1608 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 2928 iexplore.exe 2928 iexplore.exe 1660 IEXPLORE.EXE 1660 IEXPLORE.EXE 2928 iexplore.exe 2928 iexplore.exe 1608 iexplore.exe 1608 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.execmd.exeiexplore.exeiexplore.execmd.exedescription pid process target process PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 1908 wrote to memory of 2712 1908 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe PID 2712 wrote to memory of 2872 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe cmd.exe PID 2712 wrote to memory of 2872 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe cmd.exe PID 2712 wrote to memory of 2872 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe cmd.exe PID 2712 wrote to memory of 2872 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe cmd.exe PID 2872 wrote to memory of 2560 2872 cmd.exe vssadmin.exe PID 2872 wrote to memory of 2560 2872 cmd.exe vssadmin.exe PID 2872 wrote to memory of 2560 2872 cmd.exe vssadmin.exe PID 2872 wrote to memory of 3012 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3012 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 3012 2872 cmd.exe WMIC.exe PID 2872 wrote to memory of 1936 2872 cmd.exe bcdedit.exe PID 2872 wrote to memory of 1936 2872 cmd.exe bcdedit.exe PID 2872 wrote to memory of 1936 2872 cmd.exe bcdedit.exe PID 2872 wrote to memory of 2828 2872 cmd.exe bcdedit.exe PID 2872 wrote to memory of 2828 2872 cmd.exe bcdedit.exe PID 2872 wrote to memory of 2828 2872 cmd.exe bcdedit.exe PID 2712 wrote to memory of 2928 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe iexplore.exe PID 2712 wrote to memory of 2928 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe iexplore.exe PID 2712 wrote to memory of 2928 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe iexplore.exe PID 2712 wrote to memory of 2928 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe iexplore.exe PID 2712 wrote to memory of 2824 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe NOTEPAD.EXE PID 2712 wrote to memory of 2824 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe NOTEPAD.EXE PID 2712 wrote to memory of 2824 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe NOTEPAD.EXE PID 2712 wrote to memory of 2824 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe NOTEPAD.EXE PID 2928 wrote to memory of 1660 2928 iexplore.exe IEXPLORE.EXE PID 2928 wrote to memory of 1660 2928 iexplore.exe IEXPLORE.EXE PID 2928 wrote to memory of 1660 2928 iexplore.exe IEXPLORE.EXE PID 2928 wrote to memory of 1660 2928 iexplore.exe IEXPLORE.EXE PID 2928 wrote to memory of 3044 2928 iexplore.exe IEXPLORE.EXE PID 2928 wrote to memory of 3044 2928 iexplore.exe IEXPLORE.EXE PID 2928 wrote to memory of 3044 2928 iexplore.exe IEXPLORE.EXE PID 2928 wrote to memory of 3044 2928 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 2072 1608 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 2072 1608 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 2072 1608 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 2072 1608 iexplore.exe IEXPLORE.EXE PID 2712 wrote to memory of 2660 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe cmd.exe PID 2712 wrote to memory of 2660 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe cmd.exe PID 2712 wrote to memory of 2660 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe cmd.exe PID 2712 wrote to memory of 2660 2712 3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe cmd.exe PID 2660 wrote to memory of 220 2660 cmd.exe taskkill.exe PID 2660 wrote to memory of 220 2660 cmd.exe taskkill.exe PID 2660 wrote to memory of 220 2660 cmd.exe taskkill.exe PID 2660 wrote to memory of 2688 2660 cmd.exe PING.EXE PID 2660 wrote to memory of 2688 2660 cmd.exe PING.EXE PID 2660 wrote to memory of 2688 2660 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe"2⤵
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# HELP DECRYPT #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:472065 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# HELP DECRYPT #.txt3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "3ce23461e15c48785716ecef4a2f9be8_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
252B
MD5dceb2c97273227955af2973b95a6d96d
SHA161e57d3a57fd02b7421b2f4036160e814a025ebd
SHA2561af70b94408bfefae4c4e75ce65643ebaf11591d1941ea0886b852b1be45f6fe
SHA512ac2a737bedcdc71d4979d63b1afcf096182560c27f9756e7a06ee68b8d98f6be8b2c672a21c49673b379b4e48741d9b9aa2d3ebb753a8d1473d4a82a8cde9585
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f976696603c1ebbd8c48ba36e2b72575
SHA1600d8db35a278828bf118a9b3a8cd1c585524304
SHA256e7ba849cc1d012fec76bece81d0bc94ed69baade1a75ef5dbfa66d0af7424eca
SHA5124d3c4c21860cffcab5cbc8155393d9116ebb9eaf3916df7f2c94beb9d5328d5be74dd6ce09fc68961b98bac9553c722a180f2f26ef81b104c1efd404a8f28783
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59d6e9b53bd652b5764843b696e30288e
SHA10c83165118fc1c7467165527b35deabb7a5c749c
SHA256a38740184be4d5b75ee7b74b753922e6d30a9c12cc9f91b6e335dc0071adcf6e
SHA512d0c46e1a0a7044a12e67345bf16aad0b1d065a7c2026df54a0af975e59cccea0f4241cce033e34a3c8fb6085e9581ecb03968f9ca242705cc64829bb9ffef57c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ffc853ab10b5c15b06f037608a82afa9
SHA1cf204ef17fac246a54a0a7b200460ed84c39a5f3
SHA256424b3c24e6f739722c28accedf26c15af143251b49901c95a641787da521e5c7
SHA51246850728b45c3d58bbc052a185ea8ee210ed4fecf8b3a521982b1b67cfa088a8f1891a8b37734fa120dc830d9b59b6f6aca0903782d6eaaa4c666bb8224f65b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c45d568c84ab2f1770cd11e03e1d30a3
SHA1249b6ffe4d33ca02f393816e738cb091fe751dde
SHA256dfdfb366fead6d1cc07d01f37f7ff8c1786f155188da2e8b0516aa37a773f4cd
SHA512e19603246af655ea5068e7dc25b25960fe907db4cd0d8c6e465424312713bdcdf597f1710a35d87c6675779b66f85c3d74586bfad0e18168b6e4c0aad126d2da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50f9c6960fef9a94f3ea9c44c2b72e970
SHA1688ebd61c16dc5486f6e711c95a172540ac98704
SHA256fa64094eccc7dce850ab9d9aeaaf7145f147cf3759c6701cd1497a92c7efdf43
SHA51246f346bc8f9aae002129c6f4b4fda9b0aa3dc0cd0ae527c8548ee3425b7f1f7cceb6e290a62d336431b50823f22569e0a5d8ef66d533ed938152bc6097e1d554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d8e8242a0ea0cf2ec0744d22524c0ba9
SHA1a5b36b73d3c7a80386b683862ae469976b6b07be
SHA256ea6ce047c258639493cb31cc650542c4907745a09b33f4b341d018ae9b0a96dc
SHA51260e5d2390980d404676838ac4ac6dbccdd9c3b02006d1766a70143b0085fec0677bef0a7017ba72eec55de40cc0e9ea1e6b7e91d74a4a125ded79006c3c7a10b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51a2d656a9d6545d1fa1eab1631e7c39d
SHA1cb5bf9959c9ebf097db27d8bd86634a248a4f430
SHA25620372219a7ebb0562c3b2169dfa13ef79e4077539f2de109572795c7ca6c9979
SHA5127b1fd85c7f6b64dbbe9cd75d5bbd08dc6f01a5bdd06d9c345f05b0155c06ff4fae51e9d475de76b421e3d12e08b9985d1d6cce7915bec6b3f89a8ab5e812f62a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fec40a1fe969798c765a82a2930bf781
SHA18f344250f87f852003e460c69544c437f01936cd
SHA2566ec6b56982ebc8664d18c362756b4c8ea21dc385370cecedbd5e1ddec26cfe8d
SHA512cde889ba3b15ff355f257e03bc4784b0701687a8066d14250d741c55f1e04a7c1f51b26a5bf2fb93513af811aa70c279da7aaba5428431bf33c6883f267762c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5784d782a46a82a4d88e52e05696930ff
SHA1fa6f060cf2f440c6f7625350e256c5f4bbba0405
SHA256dc5395eca43289962e03377b0ad7b10232a4726bebf7eac11a657ac0df4c8f09
SHA512bf91710bbf08aa92e81f87c423132b0a957b58b4375f15013356f48ed79860ce83889e2bde3c30712e58fdbd48f6dc5c20e598f69f5ae8487353a1a09fc6e48b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5653f66779a0f886c71ab5e2cfde62c00
SHA19e58f5ac8ad48fd9208366d435e127dc25e9d86b
SHA25638eb7d696e8808aad13ca0e924011a225d1407d4b96966b702c096807405450d
SHA51288173e1fcbb3ae4823edf458497d15d52eaad991dbc991923610b4f168d97633a3a8890e4a8e9c8fc7bb61a044430ac67026b725d609af04e1ae1f43144202b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56be07a282472f16ccaf155577630c88f
SHA12571f4952b42a516d60f7eb1875024c95663e8a6
SHA256dd662a0d62300b798b75c4c64e1046c008c66da8557568033095184aabe3fbfd
SHA5121ce58960ecd0258518633404fe97b60e380576d8e7b13d88b2bdb911371bf5590d278cbdd13c763b64dea20abcff33e47416e9e1de0e7553e5c673e764ced9d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c7962cc3ce7b345560a7e9dd6e681710
SHA1805b9da8edfc56d9998d6665d190f123c7ff5a55
SHA256b96056cb5dcdf435c9d066e2d2f0b25e4513634a2c43e772b6d4ae52977a7e6c
SHA51260199f1d22217f21239f8f7720d0f849e85cd04bffae1f3ff4c0ad99b82376e40f0d5305941c16f8fd41310de302985993a06ff7a38f52be7803299d5673c231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50bf6d7c4fcfc6642353e99e0fda5a6c6
SHA15945e4247577d45295a92cad08458ab215440da2
SHA256575b775b0e19402433528e785d1eb865d03f6cd6a99f3cc59aa3c0830dbda696
SHA512fcc962dbcbe2cdf192c94b4d63738a2997eacec54ce45df636679f260b546411252262f4f1da90cf5225081ce4164cc57324ab7c993995327bf1da2f30d9f26d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5955399e6c254c0c1cf5b5937c5ddec54
SHA112434530e5ce2abc85d548b92883d8cb6ddcc8f3
SHA256da306f3394a3b8de3af8fcf623bd208b65328f5fbfbf63edc309d8c7c71af8f0
SHA51205c3388c022cf84f756e0f1f7ba478f8c48376f04b689c800a183582725d445fe74b65435eda88fc65836300a13fc330748df95fd6de32daf200d7ff359fbf24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51aaf6413f13f07849bca3bc4dca06792
SHA12ddc2787c0a155cdb5bf1933e0a27b9315892b6d
SHA256b300e3ad0fecae0d054b0c06d3091ac0ceacaa0a394d4047b1f601a76f50e33c
SHA5127a5804ea5ee8c2e696197e5c40e734861988b4aff3811c072ce69771b141f074787751918d0e6f896045c96361624e24ead3d49df739f7672a21c12cd63490ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5bb8dedda8bbf5cbe826a5f7de0f5b83a
SHA147b40aec5923996f311db03c32194c7d838bf1e4
SHA256ac1ea678bacfd3a60a0f0e78df61ce49ccee41eeeb043bf23d4d1bc45127b78f
SHA5127f3526f98c828aea8b7bdca98096c5ef2e86c2d5626314b3402bc78f65d1621b56a6564f5145f9b32f00daaac4d89319a114204b68062e23c10f6718c052fed7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58f1f7a3a38afd1a691b1eef8b610f240
SHA1399dced50e1fb814bc9bab95cc2c0a9d5a1f3290
SHA256060d94a4e86d0087f63becae334271d50431ca2f487cece3e05695f033a3eb59
SHA512ba30b426bf3ca05f19a6fb61697ba3d84d72f556e6f84f11d066be6eb5e51d6a256b79b9bbb0c3a8813a18205dfa34038c41c118019fe6f7c9710c4eb84a4e9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c74034a7e8ed7e4fe9d6ab79fa1aa1e3
SHA1bb3bd1610fd05d25b695cfebed2a6bf7a78e3989
SHA256554de83c24c21c4771e703b33c7a9de8f501283e883e9f1e5f63f2e523f3238c
SHA5124d36204cff6e4ca1bda3b6f08e5d6bb25cb6c1dd28a7214bbb3d73b65ba493a77cefbc7a4463fac62d41d0f54d85c4b30e7a06a952452dda8b2085727d1cc939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD58ddcd31b09fcda836b184d4ca3ea4849
SHA1217316d2d196fd666c070e004ebba53292e34bdd
SHA2564ae48f3ca9854d76d04aa170732298298672f7f014f1bc30c48dbe5f30de7905
SHA512cae9261e0c76aa53e703785965926f8c3c97bf7b1c52c471f8ca15194ebdb1e282160acc0ee25ff8105f8027e2d835607a7218e0b868b4e7d4af64e260fb0715
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56a8d5880bb5e8b610f6fbe3faa24cfef
SHA14192d89cca5dc8e2266859a92fb93a5b663b18e7
SHA256a482a6bdf99eb9756f3cb9fe8522108ce6597fbe2bf2fade01496f5472ac3924
SHA5121e6fbd936c2a82681cbf8e29b46f08f253bf137528c9a9ee22d0928d42de0a2b1da91820c46b18f8df8d7a298e7b900feecf110f35813a1f8102ef66b5d975be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5867552a453ea2d4f028e8f7916a11c17
SHA1e3fff1b75d529292cf89591491bc34cf0d033429
SHA256f9d285d374fb9bab678d2873dadd1342745abc3da1e09ca99b7d9d638a4050a3
SHA51291c8df8f2d24064f3339e688a5b26739188949a5b297410527b6a974222650b40701cbd2756b0c24923953c72b98dbb3437b36bcdc7422f6bc0e8439e0b684b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53cc75fd905a1326e899aaec2e500a069
SHA1070b490604ee752b9ad058a321dd1333f436ad2f
SHA2568becabfa1c618c486ba726fbadfb57971c6a5d03ed8f2769bcf3a4c68afdd8eb
SHA5120cf2cb52bc6dc46792a40169c1af542751124cad5b3419706d464be7a8ae550bc1b64daa267c2c7a2423956aa9d1f20a70ab1121335267480c95f42b116d4523
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD523b65c7827f8d9ef80aabd54895756ee
SHA17408ae72053bdeeff067080db3e5d749e7792b44
SHA256733b574047673e70a08aadd06c4943596bf308d2fa42031823bbad450f79932b
SHA512139904d6c7899b03707d362e33d33a723152767fbef61db4bd98d5333cd5f8447a99f2d5ab145ab513bdb923f306d027c0c41917eeb704bb8b2a2486b9c62858
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoFilesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E905ABC1-117A-11EF-B69B-6AA5205CD920}.datFilesize
6KB
MD5df3a8e1ca329d12028896648c3c7a5ab
SHA1097b1d908339515ec95bac9a7c22ec9161427f75
SHA256e1d81a8a560d7945c465050a4806d4ec44a3f9f2c97e7b001056a9edf43a0fd9
SHA51259f11a89c8aa9751e71c5059d3046b172c03f8349d727c297b3c7e83b3aa25bc746a1390eaa1466666add3134603a2a8a3d5a334f115c3372fb629f140f66497
-
C:\Users\Admin\AppData\Local\Temp\Tar684B.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\Chanson.cFilesize
178KB
MD53b8e66245821e3007742619b50887970
SHA135b9266e8bf19cabf46c8a7a33afa11ab8a8b8b1
SHA2561f1cd64d89bd0f2a87250bdba64f4d3cb4b2b040a625dbfdc2ec62f90d4df40f
SHA51280c35734cb08d0abd0c8f5919eb7d2df348103dd1740fdc3591fed68462be9cf09c02d13bf9dc9d6c0980b43cf83f989333f7206d10da5b7d77defb1bb7f5323
-
C:\Users\Admin\AppData\Roaming\forward_disabled.pngFilesize
2KB
MD5597557e628d4e1275b31818d45dc1dcf
SHA17b0b4d8da0d7f846fb5edaaf9e4512873223511d
SHA256952b933c0a7ba2af85f216fc66b6d9944000bdc4d11e5c19e9649bedeb64feea
SHA512b1ba60e4290ae77a29a895a234b120d9425d434d47bf4a77ae98a15e201a24a7b9ea4a91ba66dcc772ee380f2694e269f8a79e8a03e9b200b8669e3a1cdfaff5
-
C:\Users\Admin\Downloads\# HELP DECRYPT #.htmlFilesize
19KB
MD5d4cc379f238b22764c034198a145e0ea
SHA14045a8335d324f6062a44ed6c9237c3d8cb7e8cb
SHA2565d565be91ebbdab90f8b09361acea06de12be3378078b4302c0cb399c8a12521
SHA512509a243c381aca2dcbdb8e194449a10b9aed95c78adef9b407e9e81d0f2596249d7332832aeee92480093179f4538310aebb4d0a4ae4be96b56fc9e83f600e4d
-
C:\Users\Admin\Downloads\# HELP DECRYPT #.txtFilesize
10KB
MD581acccfd51298b4b456f5f59f22befcc
SHA1e2bf74e253350376fde001fb047d79af9a7894da
SHA2561898d508a517dc87b7d213e2e0dbfa2f3cfa8ea4919bb0f7ec8ef940060e822c
SHA5122c246cfe01dcdefa878fece0d4b8ea7318dd2c8a9ec33ed9dfba1fc0dafbef2862e5a47c803f25a61c44178f02494b8fc57643b92cb0b0933b23cb592f364835
-
C:\Users\Admin\Downloads\# HELP DECRYPT #.urlFilesize
90B
MD5041bf5b3fa8d9781410c306bdcf09a68
SHA1945be77268aaf8eb1ccf577df204d076fef5ffa7
SHA256b375104052f0cdd058f7de47ba2b7a35eda0e94262940e67df7d5b13b5844601
SHA512e01dd965b742779364c59ee53612f2e1b8535368f25de9e70e8a540bf2965a0d7af7fec5384d454a60241cfbf3825046ff361cdcc2eacb9bf586559c973ceee7
-
\Users\Admin\AppData\Local\Temp\nsi200F.tmp\System.dllFilesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
\Users\Admin\AppData\Roaming\NsResize.dllFilesize
116KB
MD575376d6bbd017ec8711f820aba8ed53b
SHA174c776e288b1f8eb193264333098f44defa871c2
SHA256523e5bca53ee608535aa63662168cae8cebe7f83a0416c9c3f612599a892e930
SHA5129ff3f135275ec20c366411d95979197aec8eb96d7d7274feaf441d835cf2123312f6a81fa00c2ef59591a545212d9a7833ebd1e633eb43880f551b76e91c8ed6
-
memory/1908-10-0x0000000002830000-0x000000000284E000-memory.dmpFilesize
120KB
-
memory/2712-383-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-443-0x0000000003D00000-0x0000000003D02000-memory.dmpFilesize
8KB
-
memory/2712-413-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-425-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-445-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-49-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-410-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-407-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-404-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-401-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-398-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-395-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-392-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-389-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-386-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-416-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-26-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-431-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-448-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-46-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-34-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-32-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-31-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-30-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-28-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-422-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-419-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-17-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-20-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-12-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-18-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-22-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2712-380-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2712-14-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB