Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 07:10
Behavioral task
behavioral1
Sample
5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe
-
Size
141KB
-
MD5
5385bc77d15ea3cc312e6b096cc1db49
-
SHA1
d62e03afacbb767a5611819e7fc763e89e5ac7af
-
SHA256
70db66462514a8185655f31284029ec4c49ecc38ad2bb6ff0cfb17f4e35ceff1
-
SHA512
453ecfef449dc3c20c462dc8943092038f979d2bc89332dd1f146535d8aef81ab9b348c8f7d6405daeb8775b006ec2dd39d9c4bb86dbac093cced224b0b979d7
-
SSDEEP
3072:DLyk7G0MseogKoyGjrndJM94IXcoApIxwDjLfA+IehhyKdOTF:DL9G0ocoyGjM94IsDVDjLGT
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txt
cerber
http://cerberhhyed5frqa.xlfp45.win/404F-2305-2DCF-0063-7FF1
http://cerberhhyed5frqa.slr849.win/404F-2305-2DCF-0063-7FF1
http://cerberhhyed5frqa.ret5kr.win/404F-2305-2DCF-0063-7FF1
http://cerberhhyed5frqa.zgf48j.win/404F-2305-2DCF-0063-7FF1
http://cerberhhyed5frqa.xltnet.win/404F-2305-2DCF-0063-7FF1
http://cerberhhyed5frqa.onion/404F-2305-2DCF-0063-7FF1
Extracted
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.html
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (16393) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 812 bcdedit.exe 2208 bcdedit.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exeautochk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\autochk.exe\"" 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\autochk.exe\"" autochk.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2572 cmd.exe -
Drops startup file 2 IoCs
Processes:
5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exeautochk.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\autochk.lnk 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\autochk.lnk autochk.exe -
Executes dropped EXE 1 IoCs
Processes:
autochk.exepid process 1196 autochk.exe -
Loads dropped DLL 3 IoCs
Processes:
5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exeautochk.exepid process 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe 1196 autochk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/3048-0-0x0000000000400000-0x0000000000428000-memory.dmp vmprotect \Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\autochk.exe vmprotect behavioral1/memory/3048-8-0x0000000001CF0000-0x0000000001D18000-memory.dmp vmprotect behavioral1/memory/1196-14-0x0000000000400000-0x0000000000428000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exeautochk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\autochk = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\autochk.exe\"" 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\autochk = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\autochk.exe\"" autochk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\autochk = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\autochk.exe\"" autochk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\autochk = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\autochk.exe\"" 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe -
Processes:
autochk.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA autochk.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
autochk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpF6DD.bmp" autochk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2360 vssadmin.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2660 taskkill.exe 328 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
autochk.exe5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop autochk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\autochk.exe\"" autochk.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\\autochk.exe\"" 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205764acf2a8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000011eee3a53dc45044b1e91e8c07e7041400000000020000000000106600000001000020000000f5ae79471189696224fd4af4eb014e96984c018d43a91b02bd5844adaee7e470000000000e8000000002000020000000a72831d6bc16062fc9f2440953b1a50dd842bc0adeb92b4eef5e7c48e756dfdf20000000f77b9e73ab05dc473b5619ba22901b5330760420434e70daf7acee153d612b704000000043c8719a6f0ec727822b299a3608223d7767e8640de82f3967a5c22d60492b0a494c64ce867cbef44f4ad80cd825b23c3cf6fe617631edf1034c9ac17dc30aeb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422178182" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E88C2661-14E5-11EF-8221-D669B05BD432} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8803F81-14E5-11EF-8221-D669B05BD432} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000011eee3a53dc45044b1e91e8c07e7041400000000020000000000106600000001000020000000514f2cfacbd7e18f4a0ffa4a9a3ffb66b7d98a752650b526b77eb20b649e1151000000000e8000000002000020000000aae36f7c9c451894b54fd3e1473c200c587f30ef07880be0efc88881cece46089000000038953f1356a06e72275d206cd7f9c63d0f80cb084d8aa489034f4a4cb11d799332ce1293907bd0df4547fbd4f1e909c31baa9dd07b31b88c1803f870dcfbfc50d2fbbab0865ed4b557b335b48ada52c46c322e8c744ab03bf83e713bff2c91c7b79325f1ef55d3fd597e4a309d74c1b8ed0608e50080d3eec583ae89ed3747581c7a33225ab5071810c59d86486b25cb40000000381a5655072a6cd1fc6e0163aa09ce263dee4997c57e6076f71d57293481025f86b5ae9ebf0891a155982de84185ce0fa8bdf21406253c7c23a3d98498ee4f76 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
autochk.exepid process 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe 1196 autochk.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exeautochk.exevssvc.exetaskkill.exewmic.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe Token: SeDebugPrivilege 1196 autochk.exe Token: SeBackupPrivilege 2780 vssvc.exe Token: SeRestorePrivilege 2780 vssvc.exe Token: SeAuditPrivilege 2780 vssvc.exe Token: SeDebugPrivilege 2660 taskkill.exe Token: SeIncreaseQuotaPrivilege 756 wmic.exe Token: SeSecurityPrivilege 756 wmic.exe Token: SeTakeOwnershipPrivilege 756 wmic.exe Token: SeLoadDriverPrivilege 756 wmic.exe Token: SeSystemProfilePrivilege 756 wmic.exe Token: SeSystemtimePrivilege 756 wmic.exe Token: SeProfSingleProcessPrivilege 756 wmic.exe Token: SeIncBasePriorityPrivilege 756 wmic.exe Token: SeCreatePagefilePrivilege 756 wmic.exe Token: SeBackupPrivilege 756 wmic.exe Token: SeRestorePrivilege 756 wmic.exe Token: SeShutdownPrivilege 756 wmic.exe Token: SeDebugPrivilege 756 wmic.exe Token: SeSystemEnvironmentPrivilege 756 wmic.exe Token: SeRemoteShutdownPrivilege 756 wmic.exe Token: SeUndockPrivilege 756 wmic.exe Token: SeManageVolumePrivilege 756 wmic.exe Token: 33 756 wmic.exe Token: 34 756 wmic.exe Token: 35 756 wmic.exe Token: SeIncreaseQuotaPrivilege 756 wmic.exe Token: SeSecurityPrivilege 756 wmic.exe Token: SeTakeOwnershipPrivilege 756 wmic.exe Token: SeLoadDriverPrivilege 756 wmic.exe Token: SeSystemProfilePrivilege 756 wmic.exe Token: SeSystemtimePrivilege 756 wmic.exe Token: SeProfSingleProcessPrivilege 756 wmic.exe Token: SeIncBasePriorityPrivilege 756 wmic.exe Token: SeCreatePagefilePrivilege 756 wmic.exe Token: SeBackupPrivilege 756 wmic.exe Token: SeRestorePrivilege 756 wmic.exe Token: SeShutdownPrivilege 756 wmic.exe Token: SeDebugPrivilege 756 wmic.exe Token: SeSystemEnvironmentPrivilege 756 wmic.exe Token: SeRemoteShutdownPrivilege 756 wmic.exe Token: SeUndockPrivilege 756 wmic.exe Token: SeManageVolumePrivilege 756 wmic.exe Token: 33 756 wmic.exe Token: 34 756 wmic.exe Token: 35 756 wmic.exe Token: SeDebugPrivilege 328 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exepid process 1140 iexplore.exe 1140 iexplore.exe 2608 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1140 iexplore.exe 1140 iexplore.exe 1140 iexplore.exe 1140 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2608 iexplore.exe 2608 iexplore.exe 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exeautochk.execmd.exeiexplore.exeiexplore.execmd.exedescription pid process target process PID 3048 wrote to memory of 1196 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe autochk.exe PID 3048 wrote to memory of 1196 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe autochk.exe PID 3048 wrote to memory of 1196 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe autochk.exe PID 3048 wrote to memory of 1196 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe autochk.exe PID 1196 wrote to memory of 2360 1196 autochk.exe vssadmin.exe PID 1196 wrote to memory of 2360 1196 autochk.exe vssadmin.exe PID 1196 wrote to memory of 2360 1196 autochk.exe vssadmin.exe PID 1196 wrote to memory of 2360 1196 autochk.exe vssadmin.exe PID 3048 wrote to memory of 2572 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe cmd.exe PID 3048 wrote to memory of 2572 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe cmd.exe PID 3048 wrote to memory of 2572 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe cmd.exe PID 3048 wrote to memory of 2572 3048 5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe cmd.exe PID 2572 wrote to memory of 2660 2572 cmd.exe taskkill.exe PID 2572 wrote to memory of 2660 2572 cmd.exe taskkill.exe PID 2572 wrote to memory of 2660 2572 cmd.exe taskkill.exe PID 2572 wrote to memory of 2660 2572 cmd.exe taskkill.exe PID 2572 wrote to memory of 2448 2572 cmd.exe PING.EXE PID 2572 wrote to memory of 2448 2572 cmd.exe PING.EXE PID 2572 wrote to memory of 2448 2572 cmd.exe PING.EXE PID 2572 wrote to memory of 2448 2572 cmd.exe PING.EXE PID 1196 wrote to memory of 756 1196 autochk.exe wmic.exe PID 1196 wrote to memory of 756 1196 autochk.exe wmic.exe PID 1196 wrote to memory of 756 1196 autochk.exe wmic.exe PID 1196 wrote to memory of 756 1196 autochk.exe wmic.exe PID 1196 wrote to memory of 812 1196 autochk.exe bcdedit.exe PID 1196 wrote to memory of 812 1196 autochk.exe bcdedit.exe PID 1196 wrote to memory of 812 1196 autochk.exe bcdedit.exe PID 1196 wrote to memory of 812 1196 autochk.exe bcdedit.exe PID 1196 wrote to memory of 2208 1196 autochk.exe bcdedit.exe PID 1196 wrote to memory of 2208 1196 autochk.exe bcdedit.exe PID 1196 wrote to memory of 2208 1196 autochk.exe bcdedit.exe PID 1196 wrote to memory of 2208 1196 autochk.exe bcdedit.exe PID 1196 wrote to memory of 1140 1196 autochk.exe iexplore.exe PID 1196 wrote to memory of 1140 1196 autochk.exe iexplore.exe PID 1196 wrote to memory of 1140 1196 autochk.exe iexplore.exe PID 1196 wrote to memory of 1140 1196 autochk.exe iexplore.exe PID 1196 wrote to memory of 1900 1196 autochk.exe NOTEPAD.EXE PID 1196 wrote to memory of 1900 1196 autochk.exe NOTEPAD.EXE PID 1196 wrote to memory of 1900 1196 autochk.exe NOTEPAD.EXE PID 1196 wrote to memory of 1900 1196 autochk.exe NOTEPAD.EXE PID 1140 wrote to memory of 2068 1140 iexplore.exe IEXPLORE.EXE PID 1140 wrote to memory of 2068 1140 iexplore.exe IEXPLORE.EXE PID 1140 wrote to memory of 2068 1140 iexplore.exe IEXPLORE.EXE PID 1140 wrote to memory of 2068 1140 iexplore.exe IEXPLORE.EXE PID 2608 wrote to memory of 2232 2608 iexplore.exe IEXPLORE.EXE PID 2608 wrote to memory of 2232 2608 iexplore.exe IEXPLORE.EXE PID 2608 wrote to memory of 2232 2608 iexplore.exe IEXPLORE.EXE PID 2608 wrote to memory of 2232 2608 iexplore.exe IEXPLORE.EXE PID 1140 wrote to memory of 2012 1140 iexplore.exe IEXPLORE.EXE PID 1140 wrote to memory of 2012 1140 iexplore.exe IEXPLORE.EXE PID 1140 wrote to memory of 2012 1140 iexplore.exe IEXPLORE.EXE PID 1140 wrote to memory of 2012 1140 iexplore.exe IEXPLORE.EXE PID 1196 wrote to memory of 2288 1196 autochk.exe WScript.exe PID 1196 wrote to memory of 2288 1196 autochk.exe WScript.exe PID 1196 wrote to memory of 2288 1196 autochk.exe WScript.exe PID 1196 wrote to memory of 2288 1196 autochk.exe WScript.exe PID 1196 wrote to memory of 1824 1196 autochk.exe cmd.exe PID 1196 wrote to memory of 1824 1196 autochk.exe cmd.exe PID 1196 wrote to memory of 1824 1196 autochk.exe cmd.exe PID 1196 wrote to memory of 1824 1196 autochk.exe cmd.exe PID 1824 wrote to memory of 328 1824 cmd.exe taskkill.exe PID 1824 wrote to memory of 328 1824 cmd.exe taskkill.exe PID 1824 wrote to memory of 328 1824 cmd.exe taskkill.exe PID 1824 wrote to memory of 1644 1824 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\autochk.exe"C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\autochk.exe"2⤵
- Adds policy Run key to start application
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exe"C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:406530 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt3⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"3⤵
-
C:\Windows\system32\cmd.exe/d /c taskkill /t /f /im "autochk.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\autochk.exe" > NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /t /f /im "autochk.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe/d /c taskkill /t /f /im "5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe" > NUL2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /t /f /im "5385bc77d15ea3cc312e6b096cc1db49_JaffaCakes118.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.htmlFilesize
12KB
MD50e9255fc07cee0edad474b10d56649f6
SHA18ff017fce7fc1ac4de8386473459497585e74423
SHA25633d25dace91c4edf44d466ec1baf252d839c67ec0a65b60c63402d26aed7d705
SHA512d04f10dc1ba2d541769fa081eee7ef79956f679ab909e2c888f36c5c3ff529d19379fbe47de108c18fa6786bead82fdfd6cc7594f78f9207e81992da4ebbd92b
-
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.txtFilesize
10KB
MD5d6cd92dd327ce77e5b1d42f2bfabcca1
SHA1878561601af989d423e399e63635324f88148fe4
SHA2567b7c8f45fe25cbb2c439593cd3cbdc733050aeb89072dede45dc7b4544a73895
SHA5125d1332452e023c921eee6c4262acee4e8bdf93281bc4c31f41c3fe375cea0ae8239c2ad5478ea8a470da684c8f3c5792e28e4bda84503b389148750a02c7cd36
-
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.urlFilesize
85B
MD55a97d9fd78601f3e8bc4ecc92292b258
SHA1ed8edd1ae371e4877f8fe5f2966a1bf78560e926
SHA2563cbcfd06a3748b956526bd4e10bef22b600288645a143bf88fe848685b3f1547
SHA512eeb6f2049a82fa67763b80a82d1f60f3d42286afb571806c850d46540c20198fd89502fca3a84d43286a7fc7b45af59c81707f6c25d360cbf7332f33d0eac752
-
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\# DECRYPT MY FILES #.vbsFilesize
219B
MD535a3e3b45dcfc1e6c4fd4a160873a0d1
SHA1a0bcc855f2b75d82cbaae3a8710f816956e94b37
SHA2568ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934
SHA5126d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCCFilesize
252B
MD55a7c9f5ae931284f5b56d95b104cd13b
SHA1504c25a6ef5f7ca73aee6e8c099126eb5d6b4a99
SHA256b24d72cfdb64117d56b9593a2de8260a5531ba125c914e8464a3608f03d501af
SHA51282c63da710adc495eb1cd8c82f470356925a6dcab9bfd5959b09102533d64cfcaed266a828946bcb0f2c27cc856a5ec3e98e1e59ca21ea2a20588222d3e07cbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5483b0558764e2d912f48e39e3f83e2ee
SHA13283617f1bf93f0c4b55153e494476af38eba928
SHA256bd480a8061982e1ddc8a1dcf7f765c4edddc937e9c0cf6715afea32ed248a5f1
SHA51256eb652e1a49d2c9fa6998090a9da5952e2c1c313c1b1d6c622fce089dac8778fb16d96d21d805f6698517beeb9878bfb1780748addb64fb2445582ba2fb6b5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD582879ff16e6c5cd17e0a00940afdd7ad
SHA12fed58ebd9674ea0d0e3a4c40ba02a9630f17f7a
SHA256b234433ad3daab4d74780d75e511ac5595e6a6deae6e908fbb45cbeb96c74573
SHA5124d88cc2d309c59a92c9f89f6b1d0b629a4b34f6e674319c9653aa7179c81e73a74ca20137521a1f0063b671c4f628c9d8d6e2a177da1df98585faeedbec80606
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d5664cea96c6d4077b0f4f8d0073aeab
SHA1038c3e5acf27391cd4b89d300f93c1a09fcfcb6d
SHA25679869e8393820090834dca11ff726bb61a06af0d491a09b9ddb7195ce84ef2ba
SHA51278a132292df671366a08251b4976ec5eb1b39637b4a27c7fc1abc0ba16c67501bf1a0c59f49267db88c568bdf3fce98efc7d5e7fc92236e224eb00ba80e91210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ef325c6aab20cc1a69926b4daae3e66e
SHA10b43956ae1d80d1115da5b5eebb8eff7b6a5ab87
SHA256adb096feabd7373d335df95ec92a6a3ca0e6d3229914fb8cce08a9e29322fd9e
SHA512fcc66279f8fb8ef9147811f30dd802157202daf0393d82712aeb93de9f9c9bd9ffafe9e988b8f5f757af65e634cab2fb23c46103da2f2506b5d677b1d082f89a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d00a0badc2c3e6a3d66b3d34652f53e3
SHA161b8e256875c9835553db7bf876f5e065de13656
SHA256d7373df1df4864110cc946b725dec88705d9b590d35e38dea04c0da9b9ba7e6a
SHA51242d4a034097bc55229d3cfdbeb647906de66aabdb1044c84660353ffccf3958caef9690e72f4ecf8abca0cdb055219890f635c60ad29bfc5b1d62a7d2afd391a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5bbee6a06ca6503932d983ad86b0b37f6
SHA1975c88d6291568871e1240a2e2d03986170e96d8
SHA256fa14aaa24950f0f4785a5ce0e1e229dd202512652141abadafc5af86d591478e
SHA512b7c1664abee66b82cc2111a86d61d7a197c9549e6b406ef183a8b9cd10edabe7a3b322f22439f895ccfe8b7b8aa9b64579379d3aa8d0775954034ad7623397d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d455b2b079670d4b3c2d689883fc3a22
SHA1e0a7d9aba59c5b8f23906c5b313101119e7e3992
SHA256b84fbad3228c6e449e5717e15262ec61f6f16c0b35c2c5765f536674ed769137
SHA512eff6d11c650aad69fde760f19f190c6bd862b0dc7305c90799c2fb1464a4fb81f7d4c4f89189b9a26bfb7dcb7ae4cc5fc2c5df5c6bf3748a9efde4e3e241ae93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f6612e0a0347d7426d2a1130e7715fcd
SHA1ff1fe13ce53653bf368f60c6c2982e58518d9233
SHA25636206fa09722746fd01a08163d4694270bf671c5f115030c6524839e836b1b66
SHA512f8a984e0cf61b40806af0280a5d4bc8c460dbf90a036ff5e39c000851d6e9b26ff3862293870d785ddd79c6d18fd912bd0a838aa8686af29845e9e522dbf4823
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5093b6f54f47ce6059f2f5218fafacd53
SHA19f4e9fe71d170a0ad7ab862889416d02b2e7b010
SHA2569641d079b9a3b35a1119888f0b49a1a7b68aacbabcffceada645b981cf87d0ec
SHA5128ae24a0ae3620b0f836d1054933f6d6f33bd9c600874db6e051c72283739c146ac6771317fb55d827c47e40fc6bc6ea110d894c0d408110223535fd052e01c5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5409ac9fbcf1fb5d046ffffa7ea8bf6f6
SHA13eaa855e186306481bedd999e546e553f5671ad0
SHA25649264bbb8ff1b694a9eeb58beb3d9048877dce28aa4e316f820ed42182a78c8f
SHA51210e2e75a342dddec7b3a2477c11df76d08982d3c331ebf206ff7c2e6d8fd211702ef8eca081194128f79803cc8eaa97bd803643de99c794a6420961c9e8fb906
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e0010678171c49ed6d36a007c031f42a
SHA1f08ec514289c83e6ba94c596929e87dbe1e0998e
SHA256fdd5ae6e05295b582463bbd7cf666584bafc733496c6b5dd42564f62bb32b945
SHA5126cc36a57449a36bfa1826d0bcd6a470ee56e7593abb64d612416a628445013160257cd5fd4ec886a3960b56214bfe0382ec544a59e3521170ba9846897de14cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD551c4f428b685569d6ea5a98820b2cf40
SHA107274bd553dc308a8d50eca7844880f7588420a7
SHA2561f663bb8f521e978e95524c75ff95acf40442d4721309bf79065846156c301ea
SHA512c6b631522d5dd6bdd05201dbf95182c6f5a7cbe5ebd14f65103862034214a91fb1c4612514aecc0c8febb138668fa1c489acac475e50d9d0311ef097c105e1be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD535788953d88fbfe052a9b0914fcd2019
SHA19e1a5611a6daa25398232542126d0688d322eca6
SHA25690e9d622f6974fce79543e491cc33f007a13def3c123f4a6effdad025362e41d
SHA512f55c2e082de750719bcebf773868cffc62be27b15e241791ee05aaf46f98f860879d2db92f4e07829fd70db87a303704e28b78f93902aa8609c2115d0a113aff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54e20d300abd1192bd10da81fdcc295da
SHA1affba6dee1cd70e0e89f70b4448dcdb01782794f
SHA25664fc5a5dccfd4e26d93e8e154fd43293b1de637530473804fe5b7839a897cd41
SHA5126a246f10981e48b26ba4ecf4d9a83af9c7b3eb0cad97e2bbe76ab58d4248bf0213a8b81486334b9c530528280610583d1bd581148388e878bc6ea680e7bfe3f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b77a51351f0ec8e3ca66700bed29c9f5
SHA1391834d249ba4d1f0023372f0fde7003b416c851
SHA2569bc39afd2cef87376711f2fdd581c1befb469b38ad55b123173fb0c23fd1cba3
SHA512c0db9fd2d73fed0a2b9dfaf4fc8d91758049b107542718ed1c10ccd116fd83fdeaaaeecc1185e0eaa41058586e90d49d6b53c87c2c258774b5b9a8b47b6ef357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d37e0dd5c1dc3c58ac2a5d1e3f6ab293
SHA1868892e4c2bb85412db649fb34979cb5097b0446
SHA25643653419e2420e6b0dc74ce60cc12bf5ba46cd5724b0fc176ecd0797c6fb7517
SHA512b020720a1857968901e3e9e0b2ddc55c87fefe583d6a8173a1990ed562ef841f70cb6dea2fb5e87f542f287e0817859d56ffd9662691d6a365927bb267286204
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5844e41f8cfddee356333f504bdafb586
SHA18e36947685a1a4bbcd858dc1a3407ecdf5723ef1
SHA256f143a659b83c6de1fd86ccac9e2dff38a1b60a6b9526fdad18512c40a3ed41d1
SHA512013f9f85a9e86a072998a5a22da59f7bdb87be53d51589a7d34b7deab0e79ad508b6441c1dbaa74c63251efd3b51c3cfd6e406a07de9e346d5184153f6ef29f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b84e238d914d8b7fb4f46eeb41e1039a
SHA1fdb745e3d3e193d0ba9d6f9118d6e7575ca755ef
SHA256c545920bc9cc88e3c323ee6b3c801bcdc9684371e4a159a382f652d2ebc1cf78
SHA512cf7245a6dffdc8e4605ff301fbc8c9b28359b8c4e35695e94a1f35c6a9f49899483817b6f41f72742a1110e8b125f486b9ea24100f6dcbacef0bdc916f3d9979
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5118acd9b0b3256e0412ad9f1facdd8fc
SHA1ea2c98347d27296d8644aad68d0c050e12dfb36c
SHA256a707bc6953a1567eff66a82b41d1aaccea11aeccab3fca4f72cb44092981a772
SHA51260bce51998f4f3723c37ae8e6f4020a188602c7beec3a3cdd594b9e879a9396c0c071534483f2d2d43b70ea30d004e47fe231815c248662c9ae1fb1af6b269a4
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E8803F81-14E5-11EF-8221-D669B05BD432}.datFilesize
5KB
MD5dd51ce17c5b3dfa31d17973d45085450
SHA1427d5acde2ab6826ec420e8474492400f69dc57d
SHA2564477170af09b45d8be08bce75a0acb943efe4c01be6b722e4c7dc1e084daa151
SHA512d8890ff6ad3cf2d2fadce27f55b0cf25a32dee7f77f0d2476903acdde6ac9bd0dd64e906f88686754b587c79b4e797b40e0b489a7661d0dcfab3fcfafd81c881
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DA8WR3QW\favicon[1].icoFilesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Temp\Tar106B.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\autochk.lnkFilesize
1KB
MD5dc67c1206515b7cb47d1f943daf9112f
SHA169603a383791d58187c3590f47cfa4c160e686ac
SHA2568e8a4212b624b564f4b736f4694148537e3fb0071484b7c21161ad0ea38c4703
SHA512edf0677819d6607ccd178cb841bbc839c86576e67b6b3820e69bf9e3b3c8ceaf6dbd9c84f311c636930cef7914eba6a551ceff8dc6c457547016e6b67d01f95f
-
\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\autochk.exeFilesize
141KB
MD55385bc77d15ea3cc312e6b096cc1db49
SHA1d62e03afacbb767a5611819e7fc763e89e5ac7af
SHA25670db66462514a8185655f31284029ec4c49ecc38ad2bb6ff0cfb17f4e35ceff1
SHA512453ecfef449dc3c20c462dc8943092038f979d2bc89332dd1f146535d8aef81ab9b348c8f7d6405daeb8775b006ec2dd39d9c4bb86dbac093cced224b0b979d7
-
memory/1196-1027-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1196-17-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1196-26-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1196-29-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1196-27-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1196-420-0x0000000003C20000-0x0000000003C22000-memory.dmpFilesize
8KB
-
memory/1196-24-0x0000000002AC0000-0x0000000002AC1000-memory.dmpFilesize
4KB
-
memory/1196-433-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1196-14-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1196-19-0x0000000001DF0000-0x0000000001E00000-memory.dmpFilesize
64KB
-
memory/3048-0-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3048-21-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3048-8-0x0000000001CF0000-0x0000000001D18000-memory.dmpFilesize
160KB
-
memory/3048-22-0x0000000001CF0000-0x0000000001D18000-memory.dmpFilesize
160KB
-
memory/3048-2-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3048-1-0x00000000003A0000-0x00000000003B6000-memory.dmpFilesize
88KB