Analysis
-
max time kernel
128s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 18:58
Static task
static1
Behavioral task
behavioral1
Sample
47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe
-
Size
204KB
-
MD5
47937d75be86ed7ab9c2048cee4bbaf4
-
SHA1
d7eed8c49beca46ce4be3b376611f22a0351c09c
-
SHA256
911184d3633225146e3c57884f9c1a7ed7849b8e7e575a8b33de8fd42e745b66
-
SHA512
802a1196fae9bf3f3cb8dd9abdc359ef5bfa0728dec28d70033b3341f0e6eb6aee1560307f5f7553c1f38ba279de7d6ddce2e7370c1f5d7100fed8c539cdbae8
-
SSDEEP
3072:XA1yBUlytLJVM9yQGVTcuB4rdSQTDOkoycTXiv+5oN87KppRsqYaefim1:rBUlyzVM9yQGvwPXoyc+C7Kkaw
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.6oifgr.win/4C5E-999B-1B09-0063-76AC
http://cerberhhyed5frqa.xo59ok.win/4C5E-999B-1B09-0063-76AC
http://cerberhhyed5frqa.zx34jk.win/4C5E-999B-1B09-0063-76AC
http://cerberhhyed5frqa.rt4e34.win/4C5E-999B-1B09-0063-76AC
http://cerberhhyed5frqa.as13fd.win/4C5E-999B-1B09-0063-76AC
http://cerberhhyed5frqa.onion/4C5E-999B-1B09-0063-76AC
Extracted
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16390) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2128 bcdedit.exe 1852 bcdedit.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exemmc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\mmc.exe\"" 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\mmc.exe\"" mmc.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2160 cmd.exe -
Drops startup file 2 IoCs
Processes:
mmc.exe47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mmc.lnk mmc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mmc.lnk 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
mmc.exepid process 2140 mmc.exe -
Loads dropped DLL 3 IoCs
Processes:
47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exemmc.exepid process 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe 2140 mmc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exemmc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\mmc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\mmc.exe\"" 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mmc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\mmc.exe\"" 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\mmc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\mmc.exe\"" mmc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mmc = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\mmc.exe\"" mmc.exe -
Processes:
mmc.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mmc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
mmc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp879.bmp" mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1508 vssadmin.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2612 taskkill.exe 2444 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
mmc.exe47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\mmc.exe\"" mmc.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\mmc.exe\"" 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop mmc.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0589014faa6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51B7A651-12ED-11EF-A57D-4637C9E50E53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421961463" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000ef51a650cd98a4110671be93d14e4c4ee10edc7b80efab4a20bd595e698457ec000000000e800000000200002000000016c73543c94cef7156d90002443481fa707accfc070244638fa0f1555e3b9e2090000000923cd200b6d01906bff5a6f5a76944e660d74001274d2a5ccb9004e20b2fd3cd75854cb1d7fa5b3f10449f8b3f095e51e0dfe1872dd1813e2dff05a60df7452760ca1d6ad876a9bfb0ff38d9980888c1f915f641220f9e6cc1acae3b0450965c8da7aa4a1ee2e79ea32203b01cca60093a1ebdef1a5bb02f5dc5b151218102fd6f8b8b9547c6bf491ae534d09f4f0c6a400000002b65e09ec0dd9d8f6c81e62237601c4c57666becaca5b90472f7eb6c3b30828c326205aeca5bbf7e8e830983c90e11dcc3d8c38ce06420a6abe8106939baf1bc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51A6FCB1-12ED-11EF-A57D-4637C9E50E53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000fcd401eb7c1555fa709a7e69b8e5df3b21fda3c828cfac326b4ab04f0669dcdc000000000e8000000002000020000000c2a512b31f293e739e32d1031ca4efeeb3dbe47c460f8afba00366595a94e1c320000000383c3626c72232dd2f2820a9a5b9a9f5a4bc8e5da85dab95d2d8f71cfee31405400000008fe172e9e6a5327ffadf9f94cedf18acdd88b1bad54b4ee3435da4a2d2d3a7aabf2b13d51b727cc9b15160622271f36491deb25a828e1ce44d272375a1c59d03 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
mmc.exepid process 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe 2140 mmc.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exemmc.exevssvc.exetaskkill.exewmic.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe Token: SeDebugPrivilege 2140 mmc.exe Token: SeBackupPrivilege 2572 vssvc.exe Token: SeRestorePrivilege 2572 vssvc.exe Token: SeAuditPrivilege 2572 vssvc.exe Token: SeDebugPrivilege 2612 taskkill.exe Token: SeIncreaseQuotaPrivilege 2052 wmic.exe Token: SeSecurityPrivilege 2052 wmic.exe Token: SeTakeOwnershipPrivilege 2052 wmic.exe Token: SeLoadDriverPrivilege 2052 wmic.exe Token: SeSystemProfilePrivilege 2052 wmic.exe Token: SeSystemtimePrivilege 2052 wmic.exe Token: SeProfSingleProcessPrivilege 2052 wmic.exe Token: SeIncBasePriorityPrivilege 2052 wmic.exe Token: SeCreatePagefilePrivilege 2052 wmic.exe Token: SeBackupPrivilege 2052 wmic.exe Token: SeRestorePrivilege 2052 wmic.exe Token: SeShutdownPrivilege 2052 wmic.exe Token: SeDebugPrivilege 2052 wmic.exe Token: SeSystemEnvironmentPrivilege 2052 wmic.exe Token: SeRemoteShutdownPrivilege 2052 wmic.exe Token: SeUndockPrivilege 2052 wmic.exe Token: SeManageVolumePrivilege 2052 wmic.exe Token: 33 2052 wmic.exe Token: 34 2052 wmic.exe Token: 35 2052 wmic.exe Token: SeIncreaseQuotaPrivilege 2052 wmic.exe Token: SeSecurityPrivilege 2052 wmic.exe Token: SeTakeOwnershipPrivilege 2052 wmic.exe Token: SeLoadDriverPrivilege 2052 wmic.exe Token: SeSystemProfilePrivilege 2052 wmic.exe Token: SeSystemtimePrivilege 2052 wmic.exe Token: SeProfSingleProcessPrivilege 2052 wmic.exe Token: SeIncBasePriorityPrivilege 2052 wmic.exe Token: SeCreatePagefilePrivilege 2052 wmic.exe Token: SeBackupPrivilege 2052 wmic.exe Token: SeRestorePrivilege 2052 wmic.exe Token: SeShutdownPrivilege 2052 wmic.exe Token: SeDebugPrivilege 2052 wmic.exe Token: SeSystemEnvironmentPrivilege 2052 wmic.exe Token: SeRemoteShutdownPrivilege 2052 wmic.exe Token: SeUndockPrivilege 2052 wmic.exe Token: SeManageVolumePrivilege 2052 wmic.exe Token: 33 2052 wmic.exe Token: 34 2052 wmic.exe Token: 35 2052 wmic.exe Token: SeDebugPrivilege 2444 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 2952 iexplore.exe 2208 iexplore.exe 2952 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 2952 iexplore.exe 2952 iexplore.exe 2952 iexplore.exe 2952 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 2208 iexplore.exe 2208 iexplore.exe 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2556 IEXPLORE.EXE 2556 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exemmc.exepid process 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe 2140 mmc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exemmc.execmd.exeiexplore.exeiexplore.execmd.exedescription pid process target process PID 1196 wrote to memory of 2140 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe mmc.exe PID 1196 wrote to memory of 2140 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe mmc.exe PID 1196 wrote to memory of 2140 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe mmc.exe PID 1196 wrote to memory of 2140 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe mmc.exe PID 2140 wrote to memory of 1508 2140 mmc.exe vssadmin.exe PID 2140 wrote to memory of 1508 2140 mmc.exe vssadmin.exe PID 2140 wrote to memory of 1508 2140 mmc.exe vssadmin.exe PID 2140 wrote to memory of 1508 2140 mmc.exe vssadmin.exe PID 1196 wrote to memory of 2160 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe cmd.exe PID 1196 wrote to memory of 2160 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe cmd.exe PID 1196 wrote to memory of 2160 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe cmd.exe PID 1196 wrote to memory of 2160 1196 47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe cmd.exe PID 2160 wrote to memory of 2612 2160 cmd.exe taskkill.exe PID 2160 wrote to memory of 2612 2160 cmd.exe taskkill.exe PID 2160 wrote to memory of 2612 2160 cmd.exe taskkill.exe PID 2160 wrote to memory of 2612 2160 cmd.exe taskkill.exe PID 2160 wrote to memory of 2372 2160 cmd.exe PING.EXE PID 2160 wrote to memory of 2372 2160 cmd.exe PING.EXE PID 2160 wrote to memory of 2372 2160 cmd.exe PING.EXE PID 2160 wrote to memory of 2372 2160 cmd.exe PING.EXE PID 2140 wrote to memory of 2052 2140 mmc.exe wmic.exe PID 2140 wrote to memory of 2052 2140 mmc.exe wmic.exe PID 2140 wrote to memory of 2052 2140 mmc.exe wmic.exe PID 2140 wrote to memory of 2052 2140 mmc.exe wmic.exe PID 2140 wrote to memory of 2128 2140 mmc.exe bcdedit.exe PID 2140 wrote to memory of 2128 2140 mmc.exe bcdedit.exe PID 2140 wrote to memory of 2128 2140 mmc.exe bcdedit.exe PID 2140 wrote to memory of 2128 2140 mmc.exe bcdedit.exe PID 2140 wrote to memory of 1852 2140 mmc.exe bcdedit.exe PID 2140 wrote to memory of 1852 2140 mmc.exe bcdedit.exe PID 2140 wrote to memory of 1852 2140 mmc.exe bcdedit.exe PID 2140 wrote to memory of 1852 2140 mmc.exe bcdedit.exe PID 2140 wrote to memory of 2952 2140 mmc.exe iexplore.exe PID 2140 wrote to memory of 2952 2140 mmc.exe iexplore.exe PID 2140 wrote to memory of 2952 2140 mmc.exe iexplore.exe PID 2140 wrote to memory of 2952 2140 mmc.exe iexplore.exe PID 2140 wrote to memory of 1452 2140 mmc.exe NOTEPAD.EXE PID 2140 wrote to memory of 1452 2140 mmc.exe NOTEPAD.EXE PID 2140 wrote to memory of 1452 2140 mmc.exe NOTEPAD.EXE PID 2140 wrote to memory of 1452 2140 mmc.exe NOTEPAD.EXE PID 2952 wrote to memory of 2368 2952 iexplore.exe IEXPLORE.EXE PID 2952 wrote to memory of 2368 2952 iexplore.exe IEXPLORE.EXE PID 2952 wrote to memory of 2368 2952 iexplore.exe IEXPLORE.EXE PID 2952 wrote to memory of 2368 2952 iexplore.exe IEXPLORE.EXE PID 2208 wrote to memory of 2360 2208 iexplore.exe IEXPLORE.EXE PID 2208 wrote to memory of 2360 2208 iexplore.exe IEXPLORE.EXE PID 2208 wrote to memory of 2360 2208 iexplore.exe IEXPLORE.EXE PID 2208 wrote to memory of 2360 2208 iexplore.exe IEXPLORE.EXE PID 2952 wrote to memory of 2556 2952 iexplore.exe IEXPLORE.EXE PID 2952 wrote to memory of 2556 2952 iexplore.exe IEXPLORE.EXE PID 2952 wrote to memory of 2556 2952 iexplore.exe IEXPLORE.EXE PID 2952 wrote to memory of 2556 2952 iexplore.exe IEXPLORE.EXE PID 2140 wrote to memory of 204 2140 mmc.exe WScript.exe PID 2140 wrote to memory of 204 2140 mmc.exe WScript.exe PID 2140 wrote to memory of 204 2140 mmc.exe WScript.exe PID 2140 wrote to memory of 204 2140 mmc.exe WScript.exe PID 2140 wrote to memory of 2896 2140 mmc.exe cmd.exe PID 2140 wrote to memory of 2896 2140 mmc.exe cmd.exe PID 2140 wrote to memory of 2896 2140 mmc.exe cmd.exe PID 2140 wrote to memory of 2896 2140 mmc.exe cmd.exe PID 2896 wrote to memory of 2444 2896 cmd.exe taskkill.exe PID 2896 wrote to memory of 2444 2896 cmd.exe taskkill.exe PID 2896 wrote to memory of 2444 2896 cmd.exe taskkill.exe PID 2896 wrote to memory of 1936 2896 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\mmc.exe"C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\mmc.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:537601 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "mmc.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\mmc.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "mmc.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "47937d75be86ed7ab9c2048cee4bbaf4_JaffaCakes118.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbsFilesize
216B
MD548ac29422570636cae371b68c858b988
SHA1ff86dea198c93a8ae49ee52c6eb919fcbd259aab
SHA2563926b08f205999c2f1a24121117ecfeed31557bf6f0529416f3432321292c6b0
SHA51275019e6fd4b53528aab1af668149540e1bc372e58e4786eda1da75e7c9718dbc274cbf3f37cd38fbe7e618ea9c1b24c2534d18aecfcc3264ec55f83f206faaa3
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.htmlFilesize
12KB
MD502bf34b97a210769ddc077dce2911d23
SHA1c05159824a71fe81f012ad0c8d489ec1c0831e17
SHA256c6323383d1df3fd2da75e9dea6bbe17dbcba64c62d829dadceb7889592303a64
SHA5121e4e831771555dc815fff9c310405f4efbb793e2bb17a1a9e14976a5a5beddb6515d7d54cbd389a389f06e8e03ffdb751b796c80b7ae8c15c8b2cf901a590410
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.txtFilesize
10KB
MD5fe631737bbfdf0bb5cffce74955688f0
SHA113ad82f5ffac6b7ddf5fb0c705b3bbc1026696e2
SHA25649cef3c2729d83fe95f2cf15c8be6221e538367d5291b0f6d70870c86779c4dc
SHA512e1d6eb797ae17931540e55f51c37b8be2f92f6a4551c1a9e94be83459c4feb2da1544353f3c90397555f880a663164b3c8cb82afbe1bd72ac47f1a046976481b
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.urlFilesize
85B
MD514fb988c5c8b975599948d7afc0581e0
SHA135e081b1e3f8dd2f768a42e549c320f986704629
SHA256e73ed2dd2369a0dd2f6bd07fcea396fe1f95d2683d355e3195c52cb5572dcfbe
SHA5120c39fa30cf4c5eef32f4b00ab8c0abed5ac89df9f74a74a74601ddd9cffe85df79badc4951f2d145508ee3905f1cbcf00d99796d188fc99e9eac1d0f808ef3e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD540803ae3a980bd1c65e2868df55d46c0
SHA1594821b62280cef7143308f602e3397ac5d33864
SHA256d4b1c8667da1f8e88fbe5b0b7954a25ba69288f0f3fbbdcda5ea6c40c846427a
SHA5127d075eb2fe86d590289136b54f9bd6be3592b90e45cb9afee434cc579e40800cd4d4d3c3c4526318b9ea7d14fc0ff4ad5b306879c8294adbad8b8067aa8bd783
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5307ffd5b7937db7aa347cc04a7788b47
SHA152d172358375fffc1d410b1db2f9d298bcdbfa0d
SHA2560137f06322cfb82376f152ef5b9032e14308f18c2ac71e2ef0cfd01b2f8f66a9
SHA5129b679927157fc00b1c67efe97215a412a2d00d2c79c84ff050a9f592af4e81a660d1eaed04713a3223d0b0ac77d4935edbde42a5a4aed231d5fd7ae0cb738065
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54b389f10c7e97e6949ee67140fe590f2
SHA1fd3eaad2b3d6ca314e9f033ccf8f2b67cf93615d
SHA25604bc08e98d1ddb321aec7783701955627d1a785a441a0b7a730b25cfbeaeef65
SHA512e420d1b6871c515bc23b077c4924a8291a84a599c796982e6b3d9da03b93a61fe10348cd1877bbf28f8999a0af98f499a0b7c28db212036210ec394613856cfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5786b24e2e0b4217a106f3c8f4207a26c
SHA1f01d0765bd78207dc74b1f7e76bcbdbc4a488c1b
SHA256dd63ff63a66419278c08891474ce4b90fb072d5eeec010ad18548f0c11200446
SHA512a27b286d07a963f57ddb2b48ca9277d9a4cf7dffddec63925217ddbe9e98b568e7532ff646cb82e5e97642c5a07ed126ef262fd4242f9c7b0b33e11f5ab13fe8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50ebc64fc55ab601d7186f27ef6086892
SHA1d504e5612e215a17707266290d4903abcb8e205c
SHA25631d014a7f09c924bb1c5e34dcc3ece7e5308375474e372aade5944af36fda1ee
SHA512785feccc02e6cd09274a0dc9fb0c884d72249a1983d3bb0fb7127dfc9beb79d55e1668b7703ff8bbddd15c003f98c60b144b3abe06aaca537b64a301b75c133a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD556a8313d6bad0f566364c821d7108997
SHA18617de90c85086ef3c1447973a5f6379c6700e80
SHA2563dba3300222dfbe3e6f9b81f8a99182e633ddbb844cdfb2ed8823741c7291b41
SHA5128169cd550abaa6df4428b258ccfd08696e28aec581076f01b9f333dfad771a816bd8dd3ab24305c3e3c636a77d541bded8afee0afb30c674f6cea5199c9f8d42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD543902be593b468640f7a4c87b4ff2dfd
SHA123ca85001e9ed2e6bfc296680972b9f3fca549a1
SHA2567a0bd22c6abf2dd3405956548b125014ade2ecfa4d54980d17d8bac6972bdb68
SHA5120ad46e418eb50e6bc499203750c2cfaf69daa999db6e51bb5612840a53273966eead5557a1e6a0f511dd8f5aa2cf53cc55f0bdf65cf397edcf7def1c2b14f601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a0ccf732f1f491cfb0b960b4ee7090d0
SHA115b3d05384c351d8baa77733b097d75c4322aae1
SHA2565d19e9eef76abff88ed45c735c8ddfd16f13bb87a784bd02720880d8bf99896c
SHA512046031658cbad8fc139abf17eb59962de8a97b8302310b16a0425bea2a8a76c342fa9712b83712e69df2195879a9317c6deb714f219e0bdc7677e1f65715ab38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD56510b180a0cbd29400a8a08246e3255c
SHA1e83060a9ff6497929da4e6d406f506f11e998800
SHA256eb741466bb370e0f35ae045a9d946c935ae853f990f5b8bb5400e2e816e1801d
SHA5124cd1b3c69c869b4ea91bade7a61d9a956623e470f2169a12edff2bd4eb7a270c88081ac290b3d44eafc445e4ea5dd71a68c36950520c227baefc58ca7a1ef1dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD527905cc0d98960b640103e45af99ef50
SHA179ed759e9e0a485606d81c82bce1a49f6ac3fdc6
SHA256217520f090c3453bc4fc7e09dc3b0659994803f1542d405722218de2944aa2d9
SHA5124f8bbd3c5436e9953cc250e4db07fde6efbc73abb769799ec2c055b68d5dbb20fcd1746f08b31cfcd14685ca97c4a8ee440a09382306d07d9174b67bd1ab004b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD509b38aae410c977144d71bd447d65233
SHA1fa161acdf7020f0f6da4c89facf37d5ea44eea5e
SHA25603b8ddbf22de2da596e82d3443acae42ce379dd2e854c4481443b84e4bdd9533
SHA512be683564174334bb4110547c1101ee0092e474c6780979da968797e72f41c5fbbe58a74d00d43f7e9015c006fd97631e9bd2013457a0bb7d878cb6521b5c0564
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55d23ac8ee2f7e065ed51c90026a50888
SHA15d9524e86f0afa1b6713bbc46745a235aaf436e5
SHA25601dfaf016d28472c702072153d61a64d83213c37652450b0418f9df7d82b556c
SHA5127c2e6e6123d71596d8f186f6ff886d3612b603781a388d7fd726d86f4f09bbe907e94414ac7b36ed995b53be66f79eec60677d1a488ad9d92be2985f7969dd20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD557272e813542462bfaaf7aa3c5d334f7
SHA106f7634c9e7b335d44c99dbbfb2da0a9099e763a
SHA256323e648619d752ef2d9aef15099b4ad6dc57fbe0ad7c2c803dc9ddf0814d8efe
SHA5128324f02b74cd47d5621238dd8ab49064f218eb8ae953c1fb26877f249e29cfdab5e4ea9f96f136acb083db1d2f52c3b3007034685fe3fca074489e033cb2c084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e956ce275f1a7ff1bb1d9aebdd04d189
SHA1ecdd6f2d82fe64cb7bb4c1f097b371e5fa687736
SHA256edff95d108264f476fee4d213c0acfd0eb0b1129d53e9a669f5962ad976f8685
SHA51287280f4c87720c4a801491c988f1bb3049e1eb93a2bf6b4087783ecf855d308bd78ed760fc33b711380629e5e64184760ab09461c85b01223112e4a244efd19d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f82a9c8a7b686b0b2023c916189035aa
SHA1d6f207131f9d6b751bf9d88008c95da97e586f2b
SHA2563fa49ccf685fd8e53673965f7984f2792af876773081fd93af912e8b780655f2
SHA5122790842936a5df6146baf878a73058aec2105c9b5495e4acd0b29ec6e40bdee4ab3a1d18e35e4b6675c151545fa7f77e3db3c49f9dcf84445e38c69152ff8c98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fe5d8210f4f31ac53ed23691c11e4019
SHA19c9982c0edac8fed0b0022b3d85b29fac5c3bfa9
SHA256f760b299dba23e67e887c06ddd41d1a10a82b5f3a7516b64c5c849a169762f51
SHA512378adc7421532183904cba8c00d87f9d9ce010b722c100602594951fa3f53073c53ce5f9215823c6d97e82dc56305bf0fdcf41e79f9a2839290fd10d3c3f8e0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51e5bcf84cab7148d8de345108ebf7c0f
SHA11892ba7231a82b58158d68d0705c8fd59ff2e7f8
SHA256b3cb74b44052dbadb5d9e3f8091ca1c11b8f950f30848248d96670dd736ccb74
SHA51233b84300026cd4f755d42945b710d2fa386d1b5c28239ade8939d7a103cff9b15fb35cf5ee7a6ba4dd348c6a444b0c101c68a655988bfe6f415ca68587292d67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5506af82744bf06f1018d361e0a78cb1f
SHA192c42f32b0703aa4bb1fcc1be57c92b513dea4d2
SHA256d71689cc868be2f72017b54ae956adf8d4216968b3e772126d59b1a806a20504
SHA5121c713438bbe03e4ca3f12e2e17612810d5a2213a141dccd833ca177a649ab130d8ea72774dd9cd4a2d12035497759d2a39377fdc20276a50adaf3a83e7104fbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD534bd020a15a876631c129acc97eb82cd
SHA16f6e2f00d6636e3a59693afa1ac8df26bfd3fce8
SHA256d55b9f2130b155b13134f5accad71a8c97f0a2270114a8c01867624336a8833f
SHA512f9ca94afaf7109220b2a6fa31c69ab273827142c4d9baba2dce163ebb7c19b74d6b5f0215888ed93e88aff94ba420a13f7f74d69d9bcacfcb35079679d8f0408
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{51A6FCB1-12ED-11EF-A57D-4637C9E50E53}.datFilesize
5KB
MD5553cc1d126cfcf407a8d71f7eae172e8
SHA160195bf071acc78a32c67ce54545dc7fc79184f1
SHA256ee5da65b9032b1de12552399f05c5dde01026c26bfb407803f5f8f73853c1667
SHA5124551767c7b4116e8bebb6788f19b390b63b1decedc56bec4eaa9aaecddae08df1deddaf1f21e1827ca41ef23e7540a7e748a141c4993300493e202e7de067084
-
C:\Users\Admin\AppData\Local\Temp\Cab1FF1.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar2053.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mmc.lnkFilesize
1KB
MD5d3bd19cd8946ea701c58dabf41c36622
SHA113f443cf9377e2943248d5211da5d0ec588bcde3
SHA256dd1ffa3edb6851937933c07b0ca96da240f19dfedc8eaa22b4bd99b6c372ab2f
SHA5128b5dda29727be513a6f74ad7e6ccc07b03bfae9fc7d9d42f25c5d211834970f1b0b59d65f75184a62afbccd048affdd08580c5f84e1482ca36a3e1440ae16dd7
-
\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\mmc.exeFilesize
204KB
MD547937d75be86ed7ab9c2048cee4bbaf4
SHA1d7eed8c49beca46ce4be3b376611f22a0351c09c
SHA256911184d3633225146e3c57884f9c1a7ed7849b8e7e575a8b33de8fd42e745b66
SHA512802a1196fae9bf3f3cb8dd9abdc359ef5bfa0728dec28d70033b3341f0e6eb6aee1560307f5f7553c1f38ba279de7d6ddce2e7370c1f5d7100fed8c539cdbae8
-
memory/1196-0-0x0000000000220000-0x000000000023F000-memory.dmpFilesize
124KB
-
memory/1196-1-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1196-2-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1196-17-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-450-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-431-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-429-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-38-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-24-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-23-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-21-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-472-0x0000000004720000-0x0000000004722000-memory.dmpFilesize
8KB
-
memory/2140-455-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-453-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-442-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-447-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-912-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-423-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-425-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-427-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-445-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-19-0x0000000002CD0000-0x0000000002CD1000-memory.dmpFilesize
4KB
-
memory/2140-463-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-15-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-457-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-459-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2140-461-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB