Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 10:13
Static task
static1
Behavioral task
behavioral1
Sample
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe
-
Size
237KB
-
MD5
4a91d6952c9e040e6c17662cfc271b62
-
SHA1
09a6a44e25bd15841b97381c603fe3a16a0dd68d
-
SHA256
89990552456235fc80e303433ef6609ce137d9c74016bf9c14218125edbe8854
-
SHA512
ccd64aefbb628ae2c39cfc5ed685f5f4b8ea0d093484290c1ade7a4174b4e556791ff23db34c97f00eb21244e4990ea696402c0f72ced0292e1b9a5c20b08950
-
SSDEEP
3072:pXbUhF2VZhu6sfLj0+QqQ3LVXkH7PUpg5+ua0Sq6ViqxFUZ4Jf5q:pQLqbid5Qbybspq9XSqAZYT
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.html
Extracted
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
cerber
http://4kqd3hmqgptupi3p.thyx30.top/9147-29FA-6784-006D-F695
http://4kqd3hmqgptupi3p.o08a6d.top/9147-29FA-6784-006D-F695
http://4kqd3hmqgptupi3p.6ntrb6.top/9147-29FA-6784-006D-F695
http://4kqd3hmqgptupi3p.vrid8l.top/9147-29FA-6784-006D-F695
http://4kqd3hmqgptupi3p.onion.to/9147-29FA-6784-006D-F695
http://4kqd3hmqgptupi3p.onion/9147-29FA-6784-006D-F695
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exerdrleakdiag.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\rdrleakdiag.exe\"" 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\rdrleakdiag.exe\"" rdrleakdiag.exe -
Contacts a large (518) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2628 cmd.exe -
Drops startup file 2 IoCs
Processes:
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exerdrleakdiag.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\rdrleakdiag.lnk 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\rdrleakdiag.lnk rdrleakdiag.exe -
Executes dropped EXE 2 IoCs
Processes:
rdrleakdiag.exerdrleakdiag.exepid process 2708 rdrleakdiag.exe 2240 rdrleakdiag.exe -
Loads dropped DLL 2 IoCs
Processes:
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exerdrleakdiag.exepid process 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe 2708 rdrleakdiag.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
rdrleakdiag.exe4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rdrleakdiag = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\rdrleakdiag.exe\"" rdrleakdiag.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdrleakdiag = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\rdrleakdiag.exe\"" 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rdrleakdiag = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\rdrleakdiag.exe\"" 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdrleakdiag = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\rdrleakdiag.exe\"" rdrleakdiag.exe -
Processes:
rdrleakdiag.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rdrleakdiag.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
rdrleakdiag.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp9A7B.bmp" rdrleakdiag.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2536 taskkill.exe 572 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exerdrleakdiag.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\rdrleakdiag.exe\"" 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop rdrleakdiag.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7402466A-3EA9-2132-F626-09DE715F2421}\\rdrleakdiag.exe\"" rdrleakdiag.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c716f87ac613cb5a73c119e71503517c74c0bce2fa802f82e5d35b0ee8cc84ae000000000e8000000002000020000000eff87673b67882344a7b9bd8ff648bcd94cd7d90f95bc91158334b33ba4594c09000000045b76848a7a10dbb41987436f1924dfb7f92f917711ccab225c576b1f07ef7bc492b284c90a6293c124f4fcb9a52fe191234730c205a28017425f4d33b63bef8a01d8c924a733a475fbaf66a4fa79688785a5de20b0a3b69400fa02aebceeb53dc60faccfe40137bca39dfad1ad4918ccd5603c6da1cc7a3ea558f9adf6c7c9bf11d66ddf83805909ce7eb4c2fa7564440000000c724adbe6d6fabc497b44c4dc4c587417922e185b660dafb7b46f608492bca9800813fa2e247271dff1715d9dd2b34db532a0d4e5db4687df134216185879395 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1069F061-136D-11EF-BB1B-4658C477BD5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b114a7cb4094335a851626a3b18d5eff3ec28bf3fd226543598f570557d088c1000000000e80000000020000200000002edcef403fc6c50905e1798c37eafc244dc11fd056dd3c2c96704d7b6d60ea94200000006a9043d2b73cb1188ae433eb41a177d17aaf65aee23363f32123d9a655af7bf840000000cd46151bdfafd2232cef8d82ab374974c24095489b37fffce06d1c06f2bb7216548ef2e92ece53f776ff319c76ac4544c2fb4883b3dccae570e26c84b8d175ab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04f66d379a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422016329" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{107A9A01-136D-11EF-BB1B-4658C477BD5D} = "0" iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rdrleakdiag.exepid process 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe 2708 rdrleakdiag.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exerdrleakdiag.exetaskkill.exerdrleakdiag.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe Token: SeDebugPrivilege 2708 rdrleakdiag.exe Token: SeDebugPrivilege 2536 taskkill.exe Token: SeDebugPrivilege 2240 rdrleakdiag.exe Token: SeDebugPrivilege 572 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 2196 iexplore.exe 1964 iexplore.exe 2196 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 2196 iexplore.exe 2196 iexplore.exe 1964 iexplore.exe 1964 iexplore.exe 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2196 iexplore.exe 2196 iexplore.exe 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 1800 IEXPLORE.EXE 1800 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 3 IoCs
Processes:
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exerdrleakdiag.exerdrleakdiag.exepid process 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe 2708 rdrleakdiag.exe 2240 rdrleakdiag.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.execmd.exetaskeng.exerdrleakdiag.exeiexplore.exeiexplore.execmd.exedescription pid process target process PID 1036 wrote to memory of 2708 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe rdrleakdiag.exe PID 1036 wrote to memory of 2708 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe rdrleakdiag.exe PID 1036 wrote to memory of 2708 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe rdrleakdiag.exe PID 1036 wrote to memory of 2708 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe rdrleakdiag.exe PID 1036 wrote to memory of 2628 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe cmd.exe PID 1036 wrote to memory of 2628 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe cmd.exe PID 1036 wrote to memory of 2628 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe cmd.exe PID 1036 wrote to memory of 2628 1036 4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe cmd.exe PID 2628 wrote to memory of 2536 2628 cmd.exe taskkill.exe PID 2628 wrote to memory of 2536 2628 cmd.exe taskkill.exe PID 2628 wrote to memory of 2536 2628 cmd.exe taskkill.exe PID 2628 wrote to memory of 2536 2628 cmd.exe taskkill.exe PID 2628 wrote to memory of 2456 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 2456 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 2456 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 2456 2628 cmd.exe PING.EXE PID 2868 wrote to memory of 2240 2868 taskeng.exe rdrleakdiag.exe PID 2868 wrote to memory of 2240 2868 taskeng.exe rdrleakdiag.exe PID 2868 wrote to memory of 2240 2868 taskeng.exe rdrleakdiag.exe PID 2868 wrote to memory of 2240 2868 taskeng.exe rdrleakdiag.exe PID 2708 wrote to memory of 2196 2708 rdrleakdiag.exe iexplore.exe PID 2708 wrote to memory of 2196 2708 rdrleakdiag.exe iexplore.exe PID 2708 wrote to memory of 2196 2708 rdrleakdiag.exe iexplore.exe PID 2708 wrote to memory of 2196 2708 rdrleakdiag.exe iexplore.exe PID 2708 wrote to memory of 1860 2708 rdrleakdiag.exe NOTEPAD.EXE PID 2708 wrote to memory of 1860 2708 rdrleakdiag.exe NOTEPAD.EXE PID 2708 wrote to memory of 1860 2708 rdrleakdiag.exe NOTEPAD.EXE PID 2708 wrote to memory of 1860 2708 rdrleakdiag.exe NOTEPAD.EXE PID 2196 wrote to memory of 2316 2196 iexplore.exe IEXPLORE.EXE PID 2196 wrote to memory of 2316 2196 iexplore.exe IEXPLORE.EXE PID 2196 wrote to memory of 2316 2196 iexplore.exe IEXPLORE.EXE PID 2196 wrote to memory of 2316 2196 iexplore.exe IEXPLORE.EXE PID 1964 wrote to memory of 1800 1964 iexplore.exe IEXPLORE.EXE PID 1964 wrote to memory of 1800 1964 iexplore.exe IEXPLORE.EXE PID 1964 wrote to memory of 1800 1964 iexplore.exe IEXPLORE.EXE PID 1964 wrote to memory of 1800 1964 iexplore.exe IEXPLORE.EXE PID 2196 wrote to memory of 2208 2196 iexplore.exe IEXPLORE.EXE PID 2196 wrote to memory of 2208 2196 iexplore.exe IEXPLORE.EXE PID 2196 wrote to memory of 2208 2196 iexplore.exe IEXPLORE.EXE PID 2196 wrote to memory of 2208 2196 iexplore.exe IEXPLORE.EXE PID 2708 wrote to memory of 1668 2708 rdrleakdiag.exe WScript.exe PID 2708 wrote to memory of 1668 2708 rdrleakdiag.exe WScript.exe PID 2708 wrote to memory of 1668 2708 rdrleakdiag.exe WScript.exe PID 2708 wrote to memory of 1668 2708 rdrleakdiag.exe WScript.exe PID 2708 wrote to memory of 2224 2708 rdrleakdiag.exe cmd.exe PID 2708 wrote to memory of 2224 2708 rdrleakdiag.exe cmd.exe PID 2708 wrote to memory of 2224 2708 rdrleakdiag.exe cmd.exe PID 2708 wrote to memory of 2224 2708 rdrleakdiag.exe cmd.exe PID 2224 wrote to memory of 572 2224 cmd.exe taskkill.exe PID 2224 wrote to memory of 572 2224 cmd.exe taskkill.exe PID 2224 wrote to memory of 572 2224 cmd.exe taskkill.exe PID 2224 wrote to memory of 1252 2224 cmd.exe PING.EXE PID 2224 wrote to memory of 1252 2224 cmd.exe PING.EXE PID 2224 wrote to memory of 1252 2224 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\rdrleakdiag.exe"C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\rdrleakdiag.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:472065 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "rdrleakdiag.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\rdrleakdiag.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "rdrleakdiag.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "4a91d6952c9e040e6c17662cfc271b62_JaffaCakes118.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\taskeng.exetaskeng.exe {9052A978-5316-4461-94F2-9013C08255D0} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\rdrleakdiag.exeC:\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\rdrleakdiag.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbsFilesize
234B
MD56f84dbf74ef41dc3d861f5fb3e0f45ff
SHA13e5f17e9b9589f33ce6add7f2518a666ff2253a4
SHA256df5f432d7e0d2bd1c4dddb1fabbf1e77bd1065b9020f71abaf1a45fbb950bbb8
SHA5129f9ec25b815be7b20df26244d31848c9a4896b130241b63636d63511a290eaad78d289a9bb04592c0ba31492064671351b4c7359310f03469e27764132a20a5a
-
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.urlFilesize
90B
MD5ddb38536642e22b004f77111a4237796
SHA1faec04246fc5fad54cddb992f740e24841dcb9e5
SHA2568ceda18f6434aa79f8dc48fd70ff7d09a9393ee0cf58922d3616607e337cc50d
SHA512db0edee600e5bc2d890b369ccbb6541653c03c4d11f0ffdc9c87681d74e899fee7e5fd04b570d625ea92dbca3e8aee642afb44d1220402a35f30debec0def46f
-
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txtFilesize
10KB
MD596c57f63b4a5bf9eab86084e26280b3f
SHA1125d1861766888fa10142e8e50ac9d11fc0629d3
SHA2561962109ba6912244c0bb111677e62595907218d0bf748bd9fdd80cafee8775b6
SHA512d284395b3dd023259efe33d4a815bfdbc30df29c88886aa561b7db0f8299b63eb7aef90610e7c6d59a7652542c08748c14970c7549a21a57c462f209dedac6f0
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\# DECRYPT MY FILES #.htmlFilesize
12KB
MD5997ad0d3e259bc30a98c3f482ebaa387
SHA19eb1f1630868eccad06fe169b34a8371d8519c3f
SHA2566904007baa325f42415efec7e013bcfc7e0274728c2a5e61bc27aa6ca8131c67
SHA512c8cba126dfdd29e0308c3fa2aacd04f070605dcd068c08d9dfbc7ac9071ee6e1017c3df14f345f4f9d597a41eab0accf8e17d16db2bb9bd43b7cb8b2e5791b5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e2e1836667735b53bde0507e178521a7
SHA1f1c166277052a2d2b4365e86e2c09594b65f2257
SHA256867c48b89d82824de9d8c047ded7726fd326832c910ceda3f821e0be2cac8502
SHA512f5594b13a1ebc800c07321e840fba71461dc4781b62bb2e3f28c2b8d4315a41a81df51eda245039cc05e5886982f5e687169b983ded52a1cc13d0b090a7ea115
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d70f1f054a5e1610772dbcf8f2bf0112
SHA13921a7c044d210a287cbfdfd073499664d7fb6a2
SHA256e3e466be48b092f478d674183e22107fa412eaa54e283441e95ec72dbf339bca
SHA5124cb334a21695f64622e9e656cfbba5a2f6a051236598adc7e7f063e3a5ea2608c2db54eec65420150ae128e0c7799795262232389e78a1a89bb8abac389e818d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b5993ec6e1d5bedc6f4dee9bc43dc24e
SHA1e9c74b24d53a57c27d9430fc61c758447cfe903d
SHA2560350054524f88e422a72043dc92fd9080cd51a1691eef7904e26721fe2dca079
SHA5128ac5cb2d484804d4c4bad7d9f9307144d319a7027d058e0312ec82075fb4a24ef40da91ad737e7ab4c72dc26d63a8bb3ecf16d6b37e739fcad2f821f29010f3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5abd301adddd9f8f24f94ac700a25ef11
SHA12b75289056851ecf333eeeaef9d67e72d9a0b2ef
SHA2561ed42f69c0a3e87a5f0c5f66d9b59bce041aa791651375f5ac9d6e670661f915
SHA512d56741729012a8b05deff169ea3a639e757b339d36181066494a17312007089a7f358c28c285480c63e3fdc582811c78a543c8d5f9b1e41409d3a1b5d7795301
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ff92763fcb29e1aaf8698251038f62a9
SHA1a8a435c3ade58071cabf2336bcdf395f6dc68e52
SHA25688777cf731001ff9593aae1370671b714b549b46018be5380a95aefa55358ef9
SHA512358adee3166aba9d9b57b833152605ca0955ef6b132932c13a0d5f593b9dd20fb6a53e277bce0c41bbccd22ed90e8b8195c0a7ceda9850b5b7991641f63728de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53694a4e387f6e185fb5aedd15ce606c0
SHA19484053c8afd0246694e22b282177eb1f70a1898
SHA25687813928f1b3d07fc057cbf4d7d1c3125a5b465f9b4335fbefc30e49e632548a
SHA51284d0b0702d94b01932943e7ac76812d66e5772c1a4ec564234830e3bed8498f5a4e84c3624a0cf06777cd0ba14d908ee2f090bc98c42902be18876263ba3a4b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5787ebfb8dab28001a7f37c0d14ad40a0
SHA1a7167506f48372c12caa45a256d5fc1ab072577b
SHA256360a1d0c83db558b1928d3b67209ca337486de76e80731c3ac92071171bb2fdd
SHA5125063caee1067e50655639f23d083837e8481be5a78798a69e2e8397264672e7fb4236cd3470bde65a1475bde9266ec27455019c5a08c8216b0bc87f823e1945f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5345c622a0b98c30193da1796aa852da5
SHA104177cf41802bbd35ceb8e44c712115d218efe6f
SHA256acac1ba360f9f6f74475d89471bbeba46451304200c1947fd6e417d564e4df63
SHA51211247d33d0cd87b8d4934d7312d97b4d76eebaea6fcdb55ead27d8e700d006526c918e43a444224e4dacf79ce2196b4c5d04179a6464a88e039b88afbb8291dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59a17d6f59056b25a9dd7e64e62f2cb49
SHA1d0be87919c56fcbe7795f4e7294a2072eaaa51c5
SHA2567864cb55e74923791502acaa34b2b9196f515309c54ead8ae3cd106b0dd1bba2
SHA512c9d48e73cf4947c6e13db004b9a2b885ef0510e6433dc56a3949ecf36e1c461d0e7183fdef9c94338e46fd972365912806c8253b302ed6c7437aa4e292443720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD581aa7f31f78fcc6042727aa0e520e929
SHA146eddd1eb30307731af922289112e95218fd113f
SHA256b598202b86f74a2d777abd948536e0323d039850f8baeaa77c3d1a0b80aca70f
SHA512878b96c082c67b1c7909e4cb12dd8d533b09b87248a38ad671121437e3abeaadb1119a2ea1202ba24be90815db1fe30e1fcfcb4744190246a4f2ac22720a20f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51b8051d55d171cb9da83eff30d38b9a7
SHA14b009ce2dce57a4937c147e61f30cbb0c55daf06
SHA25600266f2349bb6fd22b9c494b267e713cf21191b8ea7257d0e01379baa0576e17
SHA5124764fcce1b25280b2dbf21809a066c7309b8217e68b665d3135428d87ccfd95d8aa87447d7c293014d8cc89d4a26383368daeae1cd84df374bb98ec03f751407
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5bcfd9da94364e014baeeef4253e23597
SHA102f249a975d7589714cdb3e69a18e9eb26f342d2
SHA256244443ac980773b3b32bbbe5ab9a48d954c8e98e8d841f8f9290fa05c27ae6d8
SHA512724e2c2c6034fafd20fd8ab4180e4ecddd1c5c84ac30c06345affca6c8ce289f8e2354eb9acde2aacd9baef43b5674afc6a9504efbee65f1ec794ded2655d529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD507af60180d205941561a5ff3b9e30aa7
SHA106d0d934450c5fdc777bd8446b37300ac1c5fe59
SHA25605aa9ba1ee2bcd66f14e3a2b598fa26d0bff0f8ab0edc65a9ca296ae3397cbbf
SHA51280b3ce7c8b82de511a3c09d74cc740914544fe3ca5fc7612599f6d839b1721b7a6de8a83c32a3f2f2239d98516424d0f9c3bbef170e811d215eab158fa938c76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c19232daf3be70ccdc9d2be84b04f320
SHA1d0942d11c8130925068349864b601e614507fa74
SHA2569443572e8c68cf5543741a4d77df2636e3ae0b8bb1c9873214d27496bf11b288
SHA512dfee9cdcd9f49098f2ecc8af7eac37f0f8ba7d2978a291baafeccfb20d316151fdc345750a5aacbb8681eca0d60ab98577b402b5dc76459dccdcdb9e7a2a9e78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fe1af8f3eaaa2786fd887aaef6a68c26
SHA1a64c99a65bcf4340abab6e39b5fbcb3faead90a6
SHA256f854415e93472792bba52b077b4f442348bbb385870757c07705dbc10e5e2cbb
SHA5122061ef58377cf5779051e3b0ecaf8070929e4984470eb55d7cbc5cab3c28f7bc3bd949cd72f7e7c52c697191fcaa1ba1d58edb692361cdc1b8d95babd596a1a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD508299058f65c607549b6f7ed37207e3a
SHA19f8a84b2ac4e3c176ade5408494f2d7a2938f516
SHA256a4e2e359671d550236739a3c63a9b5242bedbdc0359c708932db21fa94077d4d
SHA51256d90d64a59c181842f475813d8a02dfbdbaabbbc2f43002eadd1a6352b8b61914bd2fe5e5a345d34fa85fba6bb77030d50254716a5ae7505ccdb2760fced5b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5683ad2b450308cbef0c7c288eb6ccea5
SHA13149b274dc6f260e404d6a11c5284a6f41a041b9
SHA25604178d5b11a51e7b19b9a8624dd7cf54010f0ad0f63ad7179396145bd934077a
SHA512fc84da34b2096f24a9ad2d26e96ed3a6e8ea003d77e92c703f36b1be6ab1135d88a2406f63e8317c0ce5bdc4303b36e32e705682bdba382cc0ef1531fd7174ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55e362002f6005d783bf4333a055e0f67
SHA184e7bf4e5f0d9933d580adb711c5c1b5c1e786be
SHA256a9b5ce7a220c923dca5491a87d795838beacd12746e802f3e1771c6606e6b554
SHA512ba29db52ff7445cd370c48a20bcc6167150390f8892067b384af9afb79ce738d55e258358cf931ba2dc8f8c4980c6bedda31d01d5cec8e1e96f9dd70ef64aafd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59e9258b99ae03a8fb926971abfbf1a81
SHA12eccbf2e11cad2a4e909f016651073700d4b477c
SHA2566b907e55ea51ecb8e6eecd136fa49c1d55760108ed1e5e161787b9822160272a
SHA512d0531e5cbc2d0111ee8cbcedacfab043216bd6412d8f8a7723623e2a108d9bd8df85cc0156d77768a2555c8902fe0fed3e768273f51ee50ee7dad54718a83c30
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1069F061-136D-11EF-BB1B-4658C477BD5D}.datFilesize
5KB
MD55c181cca09960fc039bf2702c31ca1af
SHA1c7b8e8ad1d33f05ec74638d0490345980c37e894
SHA2561e2d7925d27bdd94e11e104e268928bc2b6e1087afa55c9c60c26cc71ae5d26a
SHA5122c84b42885f34da255edb5f87a3c994cd26a9c12382df0ef20a1421208e0cc37c5cfa3e91c013140f237d67cab77461531a5c95c6fd675cb2db82b6a47416945
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{107A9A01-136D-11EF-BB1B-4658C477BD5D}.datFilesize
4KB
MD51402cfb384d522c5495c7f59bb7254e2
SHA106839594fd990d5aea34177aef5afb316ba754d9
SHA2561534a2c539da03f5cec9fffc40fa222a4386e117b54220dd220cb438c84036bd
SHA512fc51fd5279c6a772d57eac9c59479afb2f297b786044ce6a4b1660226a852e381d04cd76e7be686158386670228300d56efbcb2657e71f99486c82db66e8beef
-
C:\Users\Admin\AppData\Local\Temp\CabB1F3.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarB245.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\rdrleakdiag.lnkFilesize
1KB
MD54476828a0c9072d2d98a36acac5cdb58
SHA10e87c20c593165009c9b1c05338854badd8077d6
SHA256b7009e3bf1aaa663e7ff0216ac18421352c39419fdec5c5d32e772c933d10094
SHA512088e14bc47dd49c24edc6da842fdda3a500043c7eca31f4fa1e32f55edfb688780e42b6ff28a343d22214cfdedb5aeae247fb72d1452854e8349c94ed46398f6
-
\Users\Admin\AppData\Roaming\{7402466A-3EA9-2132-F626-09DE715F2421}\rdrleakdiag.exeFilesize
237KB
MD54a91d6952c9e040e6c17662cfc271b62
SHA109a6a44e25bd15841b97381c603fe3a16a0dd68d
SHA25689990552456235fc80e303433ef6609ce137d9c74016bf9c14218125edbe8854
SHA512ccd64aefbb628ae2c39cfc5ed685f5f4b8ea0d093484290c1ade7a4174b4e556791ff23db34c97f00eb21244e4990ea696402c0f72ced0292e1b9a5c20b08950
-
memory/1036-2-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1036-15-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1036-1-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1036-0-0x0000000000130000-0x0000000000151000-memory.dmpFilesize
132KB
-
memory/2240-20-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2240-21-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-38-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-372-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-373-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-425-0x0000000005EC0000-0x0000000005EC2000-memory.dmpFilesize
8KB
-
memory/2708-437-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-438-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-376-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-378-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-383-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-389-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-395-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-396-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-413-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-398-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-401-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-404-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-407-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-410-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-386-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-380-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-35-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-24-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-23-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-22-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-17-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/2708-12-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2708-13-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB