cerber | 99bd6452dad7eb2d9904184db057947f9bf68490b3f13f39534dfc0b479079c0

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
Size

249KB
MD5

da3bc9346be10987c91c372c7e178656
SHA1

871531b578d12416f988bd50fd1efdec42aafb6a
SHA256

99bd6452dad7eb2d9904184db057947f9bf68490b3f13f39534dfc0b479079c0
SHA512

6a0bda49f64409ea3a4dec0818c3fcdeb9ca079d222e3cd16bcc1e59d6f0eb3515cc5fed43ab98b2346585be99bf248f7a0c50b4bbde1d6250ebe39e8a79f55c
SSDEEP

6144:iEcNClmzABdXUEq3lqivP533DtUwU1zdyI6DhTV6S:FlmkvkbJ+nldB6DhTJ

Score

10^/10

cerber discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community #Cerber+Rans0mware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Rans0mware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2 | | 2. http://52uo5k3t73ypjije.5b1s82.top/A9DA-3411-B47D-006D-F3E2 | | 3. http://52uo5k3t73ypjije.xmfru5.top/A9DA-3411-B47D-006D-F3E2 | | 4. http://52uo5k3t73ypjije.hlu8yz.top/A9DA-3411-B47D-006D-F3E2 | | 5. http://52uo5k3t73ypjije.onion.to/A9DA-3411-B47D-006D-F3E2 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/A9DA-3411-B47D-006D-F3E2 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2

http://52uo5k3t73ypjije.5b1s82.top/A9DA-3411-B47D-006D-F3E2

http://52uo5k3t73ypjije.xmfru5.top/A9DA-3411-B47D-006D-F3E2

http://52uo5k3t73ypjije.hlu8yz.top/A9DA-3411-B47D-006D-F3E2

http://52uo5k3t73ypjije.onion.to/A9DA-3411-B47D-006D-F3E2

http://52uo5k3t73ypjije.onion/A9DA-3411-B47D-006D-F3E2

Extracted

Path

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. <hr> If you are reading this message it means the software "Cerber Rans0mware" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li><a href="http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2" target="_blank">http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2</a></li> <li><a href="http://52uo5k3t73ypjije.5b1s82.top/A9DA-3411-B47D-006D-F3E2" target="_blank">http://52uo5k3t73ypjije.5b1s82.top/A9DA-3411-B47D-006D-F3E2</a></li> <li><a href="http://52uo5k3t73ypjije.xmfru5.top/A9DA-3411-B47D-006D-F3E2" target="_blank">http://52uo5k3t73ypjije.xmfru5.top/A9DA-3411-B47D-006D-F3E2</a></li> <li><a href="http://52uo5k3t73ypjije.hlu8yz.top/A9DA-3411-B47D-006D-F3E2" target="_blank">http://52uo5k3t73ypjije.hlu8yz.top/A9DA-3411-B47D-006D-F3E2</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/A9DA-3411-B47D-006D-F3E2" target="_blank">http://52uo5k3t73ypjije.onion.to/A9DA-3411-B47D-006D-F3E2</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is <a href="http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2" target="_blank">http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2" target="_blank">http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2" target="_blank">http://52uo5k3t73ypjije.b7mciu.top/A9DA-3411-B47D-006D-F3E2</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/A9DA-3411-B47D-006D-F3E2 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> </body> </html>

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\\sdbinst.exe\""	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\\sdbinst.exe\""	sdbinst.exe

Contacts a large (517) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 IoCs

pid	Process
2356	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\sdbinst.lnk	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\sdbinst.lnk	sdbinst.exe

Executes dropped EXE 3 IoCs

pid	Process
2800	sdbinst.exe
1144	sdbinst.exe
1792	sdbinst.exe

Loads dropped DLL 6 IoCs

pid	Process
2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
2800	sdbinst.exe
2800	sdbinst.exe
1144	sdbinst.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdbinst = "\"C:\\Users\\Admin\\AppData\\Roaming\\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\\sdbinst.exe\""	sdbinst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdbinst = "\"C:\\Users\\Admin\\AppData\\Roaming\\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\\sdbinst.exe\""	sdbinst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdbinst = "\"C:\\Users\\Admin\\AppData\\Roaming\\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\\sdbinst.exe\""	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdbinst = "\"C:\\Users\\Admin\\AppData\\Roaming\\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\\sdbinst.exe\""	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sdbinst.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\inversions	sdbinst.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpF49C.bmp"	sdbinst.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2800 set thread context of 1144	2800	sdbinst.exe	38

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
File opened for modification	C:\Windows\	sdbinst.exe
File opened for modification	C:\Windows\	sdbinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sdbinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sdbinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sdbinst.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2212	cmd.exe
2452	PING.EXE
2356	cmd.exe
316	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0005000000019259-72.dat	nsis_installer_1
behavioral1/files/0x0005000000019259-72.dat	nsis_installer_2

Kills process with taskkill 2 IoCs

evasion

pid	Process
1208	taskkill.exe
2184	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\\sdbinst.exe\""	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop	sdbinst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\\sdbinst.exe\""	sdbinst.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F02A13F1-702F-11EF-9F30-7694D31B45CA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7047a3b43c04db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000eebf5225c2254175218715336713aa7b4f6da34e1b5829914747654cf58081cb000000000e8000000002000020000000bbc5b68de3b690c27996d733dc6cac62cf897e25f1aa46406cf1dfd941c0dadb20000000fa62039f2d803ee214d4cb36633d35930eae0eef266b08695ffeca706180253240000000e274eca71c5dc0a56ad59fd474a460a89ccd67b5462091c6dbc2399145b28035a9a0fd46dc7db7fc71279258a7fbe18347b4eb1efcd4f55dbb5fb0568f09beff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000001437d4a9c7570f65e3ae0279317233fe500203c811416449f08304d5b767c1ca000000000e8000000002000020000000346c3178835b0a998f1be62524dd31bb471f9c853fb6f37431361d08a27e9efe90000000dccb4a2ac46de8aaa15b39716f86e16602d39cee8ba25c5cf95a5f295b4d1c278ab78467461850bf1e4c53f1923c848ab100f9dd67939a7d7bf5681c0f51650a672cc4260de12820c6ae9529052ae3f187a989d1f06fc9aaed48ecc3c63b1265e5b7bb8811555cee07d8d40b15cedd603c140d579c5f463d731062b512a60691e5e4ef3e4b087f6a7cbfa7412fb1476d400000007d358d3c957d1d299b33b24d5a55ff34ccc94fc8d6a96725140cef1e215cfbd05f1c2c51a99d7d347f9de3059f7434e4a1eeebcb48d5176413bc05a16c6c7274	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFE50C11-702F-11EF-9F30-7694D31B45CA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
316	PING.EXE
2452	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe
1144	sdbinst.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
Token: SeDebugPrivilege	1208	taskkill.exe
Token: SeDebugPrivilege	1144	sdbinst.exe
Token: 33	2660	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2660	AUDIODG.EXE
Token: 33	2660	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2660	AUDIODG.EXE
Token: SeDebugPrivilege	2184	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1892	iexplore.exe
2672	iexplore.exe
1892	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1892	iexplore.exe
1892	iexplore.exe
1892	iexplore.exe
1892	iexplore.exe
324	IEXPLORE.EXE
324	IEXPLORE.EXE
2672	iexplore.exe
2672	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2160 wrote to memory of 2448	2160	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2800	2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	32
PID 2448 wrote to memory of 2800	2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	32
PID 2448 wrote to memory of 2800	2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	32
PID 2448 wrote to memory of 2800	2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	32
PID 2448 wrote to memory of 2356	2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	33
PID 2448 wrote to memory of 2356	2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	33
PID 2448 wrote to memory of 2356	2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	33
PID 2448 wrote to memory of 2356	2448	da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe	33
PID 2356 wrote to memory of 1208	2356	cmd.exe	35
PID 2356 wrote to memory of 1208	2356	cmd.exe	35
PID 2356 wrote to memory of 1208	2356	cmd.exe	35
PID 2356 wrote to memory of 1208	2356	cmd.exe	35
PID 2356 wrote to memory of 316	2356	cmd.exe	37
PID 2356 wrote to memory of 316	2356	cmd.exe	37
PID 2356 wrote to memory of 316	2356	cmd.exe	37
PID 2356 wrote to memory of 316	2356	cmd.exe	37
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 2800 wrote to memory of 1144	2800	sdbinst.exe	38
PID 352 wrote to memory of 1792	352	taskeng.exe	41
PID 352 wrote to memory of 1792	352	taskeng.exe	41
PID 352 wrote to memory of 1792	352	taskeng.exe	41
PID 352 wrote to memory of 1792	352	taskeng.exe	41
PID 1144 wrote to memory of 1892	1144	sdbinst.exe	42
PID 1144 wrote to memory of 1892	1144	sdbinst.exe	42
PID 1144 wrote to memory of 1892	1144	sdbinst.exe	42
PID 1144 wrote to memory of 1892	1144	sdbinst.exe	42
PID 1144 wrote to memory of 2008	1144	sdbinst.exe	43
PID 1144 wrote to memory of 2008	1144	sdbinst.exe	43
PID 1144 wrote to memory of 2008	1144	sdbinst.exe	43
PID 1144 wrote to memory of 2008	1144	sdbinst.exe	43
PID 1892 wrote to memory of 324	1892	iexplore.exe	45
PID 1892 wrote to memory of 324	1892	iexplore.exe	45
PID 1892 wrote to memory of 324	1892	iexplore.exe	45
PID 1892 wrote to memory of 324	1892	iexplore.exe	45
PID 2672 wrote to memory of 2192	2672	iexplore.exe	47
PID 2672 wrote to memory of 2192	2672	iexplore.exe	47
PID 2672 wrote to memory of 2192	2672	iexplore.exe	47
PID 2672 wrote to memory of 2192	2672	iexplore.exe	47
PID 1892 wrote to memory of 2820	1892	iexplore.exe	48
PID 1892 wrote to memory of 2820	1892	iexplore.exe	48
PID 1892 wrote to memory of 2820	1892	iexplore.exe	48
PID 1892 wrote to memory of 2820	1892	iexplore.exe	48
PID 1144 wrote to memory of 1916	1144	sdbinst.exe	49
PID 1144 wrote to memory of 1916	1144	sdbinst.exe	49
PID 1144 wrote to memory of 1916	1144	sdbinst.exe	49
PID 1144 wrote to memory of 1916	1144	sdbinst.exe	49

C:\Users\Admin\AppData\Local\Temp\da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Roaming\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\sdbinst.exe
    "C:\Users\Admin\AppData\Roaming\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\sdbinst.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Users\Admin\AppData\Roaming\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\sdbinst.exe
      "C:\Users\Admin\AppData\Roaming\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\sdbinst.exe"
      4⤵
      Adds policy Run key to start application
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1144
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1892
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:324
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:406530 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2820
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:2008
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:1916
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /t /f /im "sdbinst.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\sdbinst.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2212
      - C:\Windows\system32\taskkill.exe
        
        taskkill /t /f /im "sdbinst.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /t /f /im "da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe" > NUL
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /t /f /im "da3bc9346be10987c91c372c7e178656_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1208
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:316

C:\Windows\system32\taskeng.exe
taskeng.exe {A5040AA4-A282-43A9-83B2-D4BE9E8D39A7} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:352
- C:\Users\Admin\AppData\Roaming\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\sdbinst.exe
  C:\Users\Admin\AppData\Roaming\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\sdbinst.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1792

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2192

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:1628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x42c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html

Filesize
12KB

MD5
57a3a195dfabb0c97a15e9ab2c47b566

SHA1
d36b99053ba7be009fb6490140abf9f23c98a00f

SHA256
8ed7413cc5de07379a5c70125663aae8237de9fe0b69d3b6c37fb50803f168de

SHA512
25314d1207c9b47a90bcd9eb21b6dfda5e0ff0e81899467d05a9358b1fd2c0ce5f6449fcf4801c3ea430b9908fd69e8975c996b9367206f8adda42ce1f2ed74e

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
5353e08ee624da1d15029c64e31ef5f4

SHA1
7fe8a3d0936eab1e6c5b2ad48b9146eaa51b85eb

SHA256
9abf28594d3818b18adfd4bf2b9148738f3e7a5ab9ee11b1f6f3549135937fce

SHA512
2651c40ebb104dbf8f568853f3231b94375768fc6bda89244b461eed9adb31b4dea3506c553b02fd18de76d8206d5f7b5f3af70d77b31fbdc74698a8ee540f2b

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.url

Filesize
90B

MD5
9c190ed5bd814f8e90aa81078c205af3

SHA1
d58dcf6e05e4502d844651ef50cc02507e1decfe

SHA256
2844b4aefcddaf39f0b8de8b5d4d86c90241e1ccab94c89a02c596e5a8218f50

SHA512
9de67fbdbfcfa0ef2bfaad87e4ebd156e6b25e8461fa22ad594ad959b46819d1d1fb47408c8061bc20b5c8ef1eb969870f9590ab5bf10a838bd4a15dbf2d14d0

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbs

Filesize
234B

MD5
6f84dbf74ef41dc3d861f5fb3e0f45ff

SHA1
3e5f17e9b9589f33ce6add7f2518a666ff2253a4

SHA256
df5f432d7e0d2bd1c4dddb1fabbf1e77bd1065b9020f71abaf1a45fbb950bbb8

SHA512
9f9ec25b815be7b20df26244d31848c9a4896b130241b63636d63511a290eaad78d289a9bb04592c0ba31492064671351b4c7359310f03469e27764132a20a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a45d22b261dcff56fd6bbd3af320738

SHA1
bc3d1561fc69e02099dc4decc79e87caabe0327a

SHA256
ccaf54a008f50cce419ac3201077bf488d84affc83e097fc83b5fe792d9dc993

SHA512
c9a72fbff911f1c9379bbb4b3060e6cd4beeea517aa2e1605981eeecf3685d9cd0fc90beb79ddf7299ff44c13416b4bdad00d0a71772e370a5e4a87b806f5d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91771e828a01544ffaeb87470d584be9

SHA1
e90c6f36b07fe1314c9e9ac11e4614e0054421cd

SHA256
9751e4c8714ce69f9c3e9c7159c1348206bd6e3d0b4c58951cc129d6f2af8899

SHA512
e6ce504a6f87b97b657bb20a59dad0a72f435b48bad59ccff2869f8e22a75bb06fdde2b9abca8a93896b70a303afe5f227409ec9b1555d397cdcae470b680fa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff9537dd9fb65d5f4916cc9b619607a4

SHA1
12b5139aaedddcb7b12d655a786e691eb4e4a16d

SHA256
cd755fa953ecb3ef694a08f2148f65b21993cf8094555e762518d29d1d1c919e

SHA512
62a69c0bf5d0e3dace731a239413d98065debb8c9d848803bea59e9a7f1a97a5779fc66bafa5f58a18090360bcfef35139bbd42cef730b10eff0e5aa836ab5ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf587ad9d938ea6090b1ef6ff0b6ef64

SHA1
b4b772a6936f61d5ea14b492b334dca0ede4c7bd

SHA256
2f4ec15fb97490234a6b70c4c13dc14c8e460450b90e4fb4d86136b7c2fbe6f7

SHA512
59062b0a37b3d528ef81338b38143d452a28c7c0cff927bef86c401900129886dcd5d401aee2cf7b2da9721de6b83d289230013943234a2c4f5a375aae1dbb35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59f34792675913edd21249da57a78e1a

SHA1
d9efa3330a46b83abc246fde1212c9b2f8fa0a35

SHA256
ba0bb03c67056bf0c3e431383ea808791a2bf13614ce4ab724622851f33e9926

SHA512
01fe78f56045a197d7a02397d40ca22afd2ccd11af8fe2c12d8cb44c66de5e58f79400b9ff4c548c863c443af862cd664366e7b8aa18424a252a7d5a0d4de668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b54341bae134346a335f086b1f1cf66e

SHA1
ec65bf99535ef61f89bd5b43cb53443aa1da93b7

SHA256
1b5c34ea2c8f8ee1498a08b6fd272ad8ef495977876845d118da44d90d652130

SHA512
f67cb76fd4bfe02ecab19fc4bd871e05fd211c5d81fc6953d64fe8667f42c7a9f0d670b9c4ffbd8548d34cb08554a490981bdb668d10ddab4184740bae84f368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6506aa7b35b4a613cb71b080433774d4

SHA1
3c072f796e64dae3415517adc1afbf8c29817a98

SHA256
37ccf174449fe6c07bffc96a999c348f483f26427aec0a00be649d17992919c7

SHA512
97df49cd70bb19304f5a59639b71fa273936d18e23a54c4cd8dae951f00d3b8a143bed7090e5aa4d9233f2114bbb94653a0dfd709a656b05bc4267b38be78c38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b6fa6e3116b2ed46f3dd23355974ffb

SHA1
9a75dec73d5f08b17c5374a558ef231f885332ac

SHA256
4f51cbd3d2c92b3227558685dd8f32de9cc026591f22681721920d937b22d1ca

SHA512
e6134444f2a4082809853895f98bc3802bdfb29808959bac66dbeece7728e0e7e834726dad19696fead2255b94099efaea0cac59ab1bc05ba50755d8b2f1a86f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a4b5bc38f2444ff873332680201219d

SHA1
b9d6634620eb70d34725c1e29871c18b1081cf8f

SHA256
98e285467cc06b21bb0b3ab56408003525c20ce43e49b46ec9cdc8713c27e273

SHA512
2141252eff98e5b97a63e64eadecdff52aa66332e28e74ad324d44f947efae7c15826a302915c38bc2c6fcc26ed248c7f5176ac83cdc94c2631b99b2ca2694fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6523c823965591266dbc175ffe8ab409

SHA1
da76f605a74be670f7afd1eecdd2349a3f52f460

SHA256
ffa5baba13508a121da9cb05ac951675d98a872ae4d0a1e7588266f32ced11f6

SHA512
2c18790cc1c9b61906c9a58704387740da25ed85617b8a5d8edff5763a974c3ef15852cf41caae536b86d526b410ae8b5d5037da241f6bf6fba5ef513e75c439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
460789e79116a975d3167f7cbe631ba4

SHA1
44999e89323ee36eda1da2638b74525f1121fb7b

SHA256
93751d0f37ad8b5f107b7231f79abe5c5f822bf3eea04fb07c130f0f3b8b6401

SHA512
e923c5d2a4ddc94aa985ff17e6d4a0bb1dc1a583e554debbf296d78c6117f3105779d28236d892f1f314040dff544cdec9a4cd85122ab1802338e249a86bf46b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4038b5621f0e184db38661762c024dd3

SHA1
9e50ffc3625201ab4dfc8878d42c88204439d19c

SHA256
e6acbdf6a64cce293bd1f4c6780f4e0667adc9327b6849ba000f87a45a645b03

SHA512
7ece89b97f7855f2cbae9da72e76d8c11938290ca0482a509ff827d8ab595605a8f27dbe03b352768f0ebd741f6937e334506c8b920ad0a80fcba628e8ec4124

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1087.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10E8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\11.png

Filesize
565B

MD5
253393cb367ad6078c80c3ee1ced0b10

SHA1
e4e56fde8063f05fd6d09d937fc7256c7ba55557

SHA256
807b0c77c9e27c58a5098011265bc8f494ed411227cac374200819102a29e4f2

SHA512
3a62a4cba60f751cea8562433b0a531ec2ee411ba7a14b25801b42df4b0e2c85e48e1b8d878736175b1b832f279ba1d644f91cd34bf5d3cc1c279a5f503cf075

Download Submit
C:\Users\Admin\AppData\Roaming\11.png

Filesize
939B

MD5
4a039e93f6121c52ce2b2865d10acc5f

SHA1
038fcf66580307ce0e9161e5d32ae1496794bd50

SHA256
1d4130019361b0f8b0d8b7be42a2fb95518cc7326086820fba796ae115ed9bbc

SHA512
7068a5603a0abd8998f60a318a393f8263eab2e89abd18243ab70ec587c75653a6e15e75f45ec975e18e81bd7b8cc100fb3d4833e538d3cbcc9262a472cf5eff

Download Submit
C:\Users\Admin\AppData\Roaming\22.svg

Filesize
1KB

MD5
6314b8f5d4c1b14d970745da99656b0b

SHA1
8231138a4637a9570e3608f0e588bf6a53e5a07b

SHA256
283302fb83e70941d2ef5829a82fd40cbdac95f706b943cf702d4563c4cd6b17

SHA512
b65a5ce5a747f2a78e92d223c818492fb2e4600ffe84ea155c43bc6c644e22663c268182b3dae3ce74b94fe0e51ab18cf8dd34be3c257e2d5a55af0fe1463e30

Download Submit
C:\Users\Admin\AppData\Roaming\22.svg

Filesize
1KB

MD5
a2ab8e5e1896cc0b40a0b75e32f0ffcd

SHA1
8a75de805f8d078670f260a2416af044fa11a322

SHA256
c39c588247604a9bbf523d752e555d04707648047edc8184e96876bf0c7310d4

SHA512
685468e6ee33ec336682332f574753357d757fd3f078a57fbe781ab59af7dc1f2b4253c2b0e76ff380c540936086f720e42aa116727963746efb07eb63f1eb6e

Download Submit
C:\Users\Admin\AppData\Roaming\25.svg

Filesize
1KB

MD5
81608b503510aaff28c4fc9af1a34aef

SHA1
ccaa75d99467f04f48a7ccb3e4a228039782ff1b

SHA256
c5bec41cf09f196558dd562dc223fade4c6de35cb01846dc7decb7a9db4e13df

SHA512
4ea78e56e017ec2a0be2e10e5401c54a27813c55c17eb888e9283e7b95160d45a82562aa1353dba3058a751febcb4f5e1fe6132cd50b2609d25c53cf236b831d

Download Submit
C:\Users\Admin\AppData\Roaming\25.svg

Filesize
1KB

MD5
a92fe98ab272baf0c8d417620d15e705

SHA1
f8c422adbc5a6fe3d7e354eb3cc4f0733c2706af

SHA256
6b13e1e63a6f0af458289f2e48a29416e087c9197948f4ca96b1bf59f0234cf9

SHA512
9e97bb03a6fc6a0cfed821ebf856cfcc5af546e196e403141d5d905811bc961c9242600274f4578e99e0979e4f55678224d42fa0873b3802dc4ef62d748b7ff2

Download Submit
C:\Users\Admin\AppData\Roaming\403-8.htm

Filesize
1KB

MD5
0374c72114201f84bf31ecb733a4034e

SHA1
c81444b9c9a3aa5f17f5ea863ad99f00b33546cc

SHA256
436749a052e67667dd28605c2445ae2df94d60177d3cbbe6038b7fd23366bb7b

SHA512
bd0990857c6693fc4f5d7278e0f28c888fa7b7fc0ad93cba78c4c9a3738c765cd82fb8409208eecbd7555f9b8c8ecd7a6d66e0575c33340c6ab0dc7f5d9b11cb

Download Submit
C:\Users\Admin\AppData\Roaming\ActionInfo.java

Filesize
1KB

MD5
81fa79dfd944fc960b1a93e7e242d13b

SHA1
5e1534edda93c74c30e2bd1b07adcd992f70b1b1

SHA256
d52f3713b6bb99d5a124f352654ea06e6856d521b354b75b8662babf4f2bae9b

SHA512
36b3752c5526dd38f933cd5d430493ebe60779c1dd39076e5fd137d82dd750be95a4e0a01d2bb318df174cb710ed5e8694274330052d11fc638d149844612836

Download Submit
C:\Users\Admin\AppData\Roaming\ActionInfo.java

Filesize
2KB

MD5
0271ffa19b1ff4915b5af0c366318073

SHA1
63b42472b048b89c2df70a3c29132bd9c369eaaf

SHA256
7c786995c5f41b6de727dc5e771a832c79ab22012e31ba394cb9344ef62390c7

SHA512
995b56cb6e15be33f983116ff9ca0d28eba9a94b8c9c4061ef3de90885482ea2319e528d4bb7bc9d06fffc6bc1296d23fb3fae07970bb39e2691a7289cac1128

Download Submit
C:\Users\Admin\AppData\Roaming\AsteroidVertexInputInstanced.hlsli

Filesize
428B

MD5
b7c11d789abdf3d76a17a4fe6657e68d

SHA1
8fc9b7c5b8860510da75571bcec44555e17bc792

SHA256
2ae783861da692bc508457e5755855c365c665ec79e9e9e9158efa5ca423d0fd

SHA512
937640436dbe8cf38539fdb45678283a53e88b0a3abf5ac104d6867f3f7cf8dbf3b1e51503df369b1026b0621b3c1b0f0cc5df0436a414342d94c207665eebdf

Download Submit
C:\Users\Admin\AppData\Roaming\Boa_Vista

Filesize
329B

MD5
a2673ca26da285c18e70b7a54dae5e4b

SHA1
c26824ab3632214cc178e4d9fa60e29545e5973d

SHA256
e221402c6c65173a56abe3854ac85180ce47c27c508ae298b11a0afc3aae3e01

SHA512
4d8157bd08e2b46c0b244d9171b035d1fd60bcc432f84d5abcf07016669bec9ea3ff8c600d87d837c878902ad6060f188cf49fb838401f4d6bafd3c8408fd990

Download Submit
C:\Users\Admin\AppData\Roaming\Brass - Polished.3PP

Filesize
1KB

MD5
b8248786b3eb332dc5214ca2022667dd

SHA1
6e0020d6f5275c868d91eac47e45cd735c9e715d

SHA256
217faf4f69bd6911776f221f6866933c72c7e4fcdbf76a1f1e050ad40228a1b4

SHA512
2312d08778de5ead7e5a1d0a52c0f34fb1f6a28d14830213b1351db5324b3759df33e190afd9cfa68974f2a3172b0b0557a4cf51be3c3a48f313891e259a4fd0

Download Submit
C:\Users\Admin\AppData\Roaming\ExampleFO2PDFUsingSAXParser.java

Filesize
4KB

MD5
7f9e18fb070fbc43175fcdaacaa674bd

SHA1
455318deab797c8110dad52fd5940865fc70a548

SHA256
204e41af4678e3ccca8dd8e36c3812f80dccbab4185d121cd4b411cd0364bb8b

SHA512
05635cb8710feb946f60cf758d9e027729d4345e4287c98dc283eca2a7efbd24214fbf4952968def90163f67c89b97dd961b3f65f8b5fa3de7d625341b356ee5

Download Submit
C:\Users\Admin\AppData\Roaming\GMT+11

Filesize
27B

MD5
41dc583620885308274e1af0be12e78e

SHA1
9f96a25b7539ebc2a5bc0661b65a03992b63e210

SHA256
f3236a2b39954dc659c25482fde3dcdc735b6b6829e3827bedb7c8c8dc72dd54

SHA512
ec50aefdae3b9e276b1ca87677dbb89841a91169350eb88da1bd61b84726c8ffd19de6ab037bc0159a16bd44587f01daa3421298640c168ac2562a66170f9e3e

Download Submit
C:\Users\Admin\AppData\Roaming\GMT-9

Filesize
27B

MD5
3e5e7f59b78835b605d1559e9806d29d

SHA1
aee36c61c7e5ce1e95fc29fe97eda4254d00b323

SHA256
d1fc281b021228c2373cdc886f786432bc0b7d95110b2f0a6bdf8e57cf48be27

SHA512
1670b3e3dbd434a337803518b137aba604865ecd51d5e465b452e51a453288dd1b66b882f22a71f8420418c2a311906d2c6185d888cecf503c578194cacfb7ae

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\sdbinst.lnk

Filesize
1KB

MD5
ab3e160ab0e3dddba7ea46ce6df68aec

SHA1
9e7feacbabbc4d08a617f198b9b264f33673ac9b

SHA256
e6a8f1712692b0e9517be2aaf8f2dd1aabd37e210cc259df84ca52d9afd687d3

SHA512
46378413404cf25d9f28634489269107711b85066e566e27365395d3374787d17fedfe393713e36d684eb4b214bef0e4e4485b0af362df381d6391e1e11cc2eb

Download Submit
C:\Users\Admin\AppData\Roaming\Photocopy.WsN

Filesize
3KB

MD5
662448e48efb6ffd267efc6416891252

SHA1
3edc621636adc986cad512105f78a69f76041116

SHA256
1c8d89ecc3f8645bfaa84d8e474fd1afa5712e2af476e360b5e8dfebae152fa9

SHA512
11f61fd75595cb563641687e8e48a6d15f2ab3eed6e32d4276932bf5c0b57ae2b6dca45e32af8e63f3c1857758bc0aa70d8d0cae06de621505e8a93b54392860

Download Submit
C:\Users\Admin\AppData\Roaming\Scrollwork.h

Filesize
127KB

MD5
de95601df137349ef6e0064b6a87c4d9

SHA1
995c16f51f878b883ef06a0e79cd341d96c8dc07

SHA256
6cc19dcfb44f9b56413935c58b24cb85a93ba24f77265716115842fdeacf1306

SHA512
f32c7bf820c5b5fd8e667c40f1f5c5ee823e4bd240d461e16b17ee86fd5350a485006c96d775aabc687a3b4bff508092e24ba85d319523346ee336d19c56c56f

Download Submit
C:\Users\Admin\AppData\Roaming\Scrollwork.h

Filesize
127KB

MD5
7f5c85dd8e406e8d55882625bb3a0f5a

SHA1
e9b268600ee0a0c656ae53d009e109c79ebde7c4

SHA256
8cd3b7a48edb2d42fc98cf28236a30b48e63a947ee07ac61d7b92ee5efba4601

SHA512
b322b7b657ab7bea0d485948f5fbd2f820ad04f3118071c139ea7adcaf14843f9ca4e216b4a6acedbcaebe550b4d832cd105c7936ae642db91aebfccf877b681

Download Submit
C:\Users\Admin\AppData\Roaming\abstract.title.properties.xml

Filesize
1KB

MD5
65f6724a3f445ee4bbc44788c3b2b5c0

SHA1
d36b1be6a70f9414e39fe303f4e014ce4e59366e

SHA256
d7e074b563e4e8882c0d8aeaf8918ceb3ca9520d32ca8267ef949c67eaf44529

SHA512
648933d8c7a3da5b52c01a9898042696adb6d07f2709e26fb296ccdae0310a05126a65b5ba3319fdf732438f01a451c0f20e41627256e545c47dfe0e2fb37116

Download Submit
C:\Users\Admin\AppData\Roaming\abstract.title.properties.xml

Filesize
2KB

MD5
9ff8b49da25183f3a9513cae4dad8a58

SHA1
214d59717d3b1b9616cdac4fcbe9023748970561

SHA256
cd90a14e12797ffebd094e89fdd6853d59db5e469e380c1986e4a0c11d5d3ef6

SHA512
20d91258d52e081efa1a35b4870d70595c7c4edebee396dffabe1798d13185c3b078478faefabcbdab9e481ae61baaeaae4d7c071ea48b4168ca772e69afb615

Download Submit
C:\Users\Admin\AppData\Roaming\adcvbs.inc

Filesize
623B

MD5
bcbabfdcd7d9ac0be54fac753014c2a2

SHA1
6eee241fe7bb768d20c3bf582352d2182ad360ae

SHA256
2aa353db7a740dd198494903cc1a7b4e3fc49b9f44d5b541cc1ecc51642ea036

SHA512
aae7d4bd387c961f3f8736488473c44931a8ce7dfb73de16acf4d1af7d4e6266317feb21f52209ed0e04ff64435b09f5bc73e9de0ff75ecf034a0cfb79c80b16

Download Submit
C:\Users\Admin\AppData\Roaming\align.fo.pdf

Filesize
4KB

MD5
73f5d492a95cf337b9d4f664eb3e192e

SHA1
dc31a94ba07adc1f398eed03941e5d1088aaaf0a

SHA256
eb66388cf50bbb7cef3332091439b21f0863825eedc83486a0843fafb6dd6de9

SHA512
45d75ef804436974dc280f5bc3e33e8f496965c6aee20b89c18eb3adae93ff3f63142e2a2fb0466f26fb427c6d60ce043839dae0ef4466527917d8c41b208387

Download Submit
C:\Users\Admin\AppData\Roaming\align.fo.pdf

Filesize
4KB

MD5
3b7f4f1598d450604038dac3a3f4df1c

SHA1
26f8d5ef8e66cbdc02db1a61fac8a66557bce246

SHA256
bc9abdb264d3d27327e4d0a099cfe1ca8f12a0142847d139d489525357588097

SHA512
09326d1454843b1fed3f526999713f99922ae78207071b64861bc4eaeffac66d47915d37cd19e2040ffcd28b32807df24bfedb6356f8aa313f16d4abe6ead3b8

Download Submit
C:\Users\Admin\AppData\Roaming\arrow.gif

Filesize
144B

MD5
0b31842824faacd1751abbb01ddf5fa9

SHA1
5674b77233b89be37cdcc2f869072f453c485534

SHA256
6cd839340040110df50a75eb6078718895a178b09769daf36e70978ec6ce4c73

SHA512
cc65c25adbc41813461b15716558ebef11faadbefa82b2afd16b610e54f3b978f8e4736cb7be495aaa8eec7aea295b983dec888fb1138101480d1cd816ca0d36

Download Submit
C:\Users\Admin\AppData\Roaming\arrow.gif

Filesize
524B

MD5
acd6196bc6c59b54092dde35284381dd

SHA1
73bc289c7f4cb2f3874039540694c753a38e6092

SHA256
f6bdad4714cb947ab0e994e98c914add09e34443193c7fc0923f33a1b6f48449

SHA512
d8bac886aa9047130824b867a3fe35aa73ba9f4a0f166c511f991608dba2e3d86718484b0fd9ffa4f3b58d1f63eb276b87aa1e442f852894ea0663f753836a85

Download Submit
C:\Users\Admin\AppData\Roaming\base.dir.xml

Filesize
936B

MD5
f2541b73de50877fa01ca3f9a2861776

SHA1
f03b743d5bc1f94cf1baf5ca39647178050edaf7

SHA256
806ae81f511b8fb16bb9959b9b117b1205b2c9079a0926f2626b76cc555b4d51

SHA512
f6ab00a36cf38bb6688359b81c1bcc38b128f481ccd9b5d72045cf136d268faed508f0341cfb9317e3d258e0a4e822db0d69e155e2a5c4b2c5419c741f0cafd9

Download Submit
C:\Users\Admin\AppData\Roaming\base.dir.xml

Filesize
1KB

MD5
fde6096c4070ec0a24ec499d461a51a4

SHA1
a788f385f8cb45ebfca768aeb9ff4bb98dcc897f

SHA256
6a6642b55210c50979d48d401bc8123be5640c539f4f563781d2015209cf2eb7

SHA512
559e8351d45b9eee0d7347bff5fc40489a8f9ab8b7b8aab21269a0717a9819e1e2b6ba84b83503caf0f5e4bf1eaeac7da272a6b21cc51acdf939e06b24ea092a

Download Submit
C:\Users\Admin\AppData\Roaming\biblioentry.item.separator.xml

Filesize
921B

MD5
0624de35f93fa2da5c041cbe42504f6f

SHA1
fea65b58084a2b72ba5147e88264431c507aa25f

SHA256
b91715aaf83e2b9229d2f12d558415b8a67127746b64d5d29c5110803e5753b3

SHA512
8cc41098b16a42d76b2332e9a6ebd6d832857edba28f80c1bbe2c618d9f508f9b96cdcdc2fad738aea009a76ffc69dee823e8ca851f5196be035e08d39e19846

Download Submit
C:\Users\Admin\AppData\Roaming\biblioentry.item.separator.xml

Filesize
1KB

MD5
72303add72911eefccf4f8c5256ad69e

SHA1
9bdf86496528da6b5edfb2d28b1a70a4697636f7

SHA256
e64f82f25a1d0048fe1d060e42a853982bb4e0020c66080750a30b8285c9d4ad

SHA512
b3c69b29b9e7519f53fe1fcf70314fd9e21583bfb96f916245ffa96942cdeda681fac9c266c935226532341e1662ce8fc4903380b55bb961bd72de8ae1760012

Download Submit
C:\Users\Admin\AppData\Roaming\blue 286 bl 3.ADO

Filesize
524B

MD5
5f24f63bab50f02bf71645653cbb8104

SHA1
072accd7c6da89df9d4abf22dd71f8735a8f8b77

SHA256
098ed2558d4e638d369c200b2f32d36645549e1939f4b0dc05d895558a7c2d33

SHA512
fd108841ab259f7daa7cdd5f84cf3d7900402eda4ae253e6358da482c36568f8a6fe163ab09ef78264a66b1ec16b3d10fa15c2da35e73a1d144a29ce4ed298b1

Download Submit
C:\Users\Admin\AppData\Roaming\body.margin.top.xml

Filesize
1KB

MD5
e74f33a8cb4e16b95fffd7fb1017f1b3

SHA1
63b880e4fb7fe3c67a8cc509ab7d2e4720a764d7

SHA256
835812c4ab398da914901dcfd6094a9adeff1016931ff868c6004a3378dc862c

SHA512
d695d2590c8315469b2234a41c9a9fdda7900070cc8b4a70c4ad846d24dc26a847f0153ac9fe4d7c78007566eefd1f520462654b736355ef376365aec1623422

Download Submit
C:\Users\Admin\AppData\Roaming\body.margin.top.xml

Filesize
956B

MD5
46c6c423067742d452dfe0daab667fe0

SHA1
7b76ecdbd8533f4e121d4adf02ed87b7e45770df

SHA256
b18ea1c788a98c5ebda4cef7a5a2f54b8a675d49d547bc7dfd896269e0e7c1df

SHA512
29e0c9f1e943dd2e13a9c114af2d8c1d48030b66edffb7177b9d77a99441566d3b95948790b486d04b57aa16e9f10d534c2e614ccdad119a27ae7dc5b314a778

Download Submit
C:\Users\Admin\AppData\Roaming\broadening.frz

Filesize
63KB

MD5
4d3e5594341385c334e77c8a23038bfe

SHA1
e7ddc0d28e548967d3157261f0736670efff90a8

SHA256
54dea33c1139347c2be768695c60bdb9835912d9d321fc17cbbb304cb06e266d

SHA512
3c13161f5d9e09be4504a1b8200d1f14132d4f2c12f8b0b22bddea9a6b02470d8c67adad8828b5173a4c3d4cc0fdc151189459a42816195fd4ea45126db1d29e

Download Submit
C:\Users\Admin\AppData\Roaming\broadening.uqe

Filesize
63KB

MD5
f5201793d0b7538173f91f19af6ad812

SHA1
dde3bfb9f4fc6dd2cc50679004b72f86e5892d09

SHA256
d585b92665481cbf8f94c1ab00f3b462a9f24a12f9ed4e97c8d286a9a5642c5e

SHA512
8bfc2910a2ba55693dfd58ee248cc87e43646d71e6f088686e309bd1b75d0dfbf01adf513d8f2d66f777b75addc393e2c846a12c119bc725a7eaecdfab45ecf4

Download Submit
C:\Users\Admin\AppData\Roaming\chunk.toc.xml

Filesize
1017B

MD5
d676d37a6291b4f2c52a9c009646b249

SHA1
e9cc72d677d255c9a931704ceac14f06dae9c670

SHA256
8c2b119b31c6ab582ef93f9f3788f149fdb59a56ba428bbaec05f9640de5b43c

SHA512
0fd48ecf86eece84371a6aaeaa4f7a30e7cb5c2e17a182b802ec59c24f46da8309584b8c69a118ebf91be50f6dccbbc393c0ccbda9a16ecce6482cdc9d94c019

Download Submit
C:\Users\Admin\AppData\Roaming\circle_red_x.png

Filesize
3KB

MD5
3aea056e9b0b58d7f9c38be9133e8d9c

SHA1
5d11d7c5cb35e54a50fcd9278df056c5b797b4ce

SHA256
931f2c3dfd8b6838ee5e002ce4f9b0fc915096f3141bbdb14777c0d2fc44bd7a

SHA512
6ee9d352ea46533563be4bcd721aac87901e565f269fc51ee46545c822205bb6b8221e6c8055309cad1fda9901eee81acf53d5d4a33cec254e516f83f62a522a

Download Submit
C:\Users\Admin\AppData\Roaming\citerefentry.link.xml

Filesize
1KB

MD5
f5318e3b3e9ea56e31cbb672cfa327d8

SHA1
bcd6758368b4583bf80066bc1284f5a96e558efe

SHA256
e0f55229bebe71a2b94cdfb33060a28347ca69ee7480fb42bec2f2edfa464e1f

SHA512
0735d6e8fe1f0aa1e8504a5ecf86c7f576f5a3c47388f895fbd82ada7d9a5b3abbed748f33f29aa6583ddde52a9f80465a12e1586a29a94205b4475ce476873e

Download Submit
C:\Users\Admin\AppData\Roaming\column.gap.body.xml

Filesize
941B

MD5
d83849b50a657019cd5d5999d8e698cf

SHA1
7fdcbe8b3fd0adb9328775c70d60e1ff2fc89f0a

SHA256
abbf9ebf5f0d007384143e6820ddb3be0754a6f512c424fd8c29be39b53da3d3

SHA512
831002d01f906fb983de18c04055a52ef69e85397beee2a6e8ceec07d76dcd08b92e45ed4c8604eea65c4dfd36c7bd33e410a569ba703b19c11bb55f593449ff

Download Submit
C:\Users\Admin\AppData\Roaming\column.gap.front.xml

Filesize
956B

MD5
7bc409b7645ec7b8da88d7476af3d3bc

SHA1
49a73eb68fbbfbbfa799f695703b9a4b0605b91e

SHA256
e1973a32a2a0b16dda8a813c1d1096ac0e91224fbe25d16667ee93e8b76f8c6e

SHA512
0c9aaf3a4ea70d918587ce30917dcc9219a687a30b8b68fbe5969ca6136e5adc919e55d92d79fbe39f73ec3c758fb7487bcf615241948ba054fdd68043edccad

Download Submit
C:\Users\Admin\AppData\Roaming\contact.properties

Filesize
766B

MD5
511e823022328ad18c7de591b7b4be28

SHA1
3df8a77202956648a285ab2b50a32cd78eac4f49

SHA256
1d4e1132b35ecdc2970e0a2d8e2ba0ea5c0ac3b5f702eb8c17bf0255244b5582

SHA512
1be0b63108b6e33d6dbe57fa604b091a0a8b9d21204206c865eb0f6a3ce17a244645f7217b05cb2a2af140af33ba0b5e3946fdddc02270cd42a0c9816051c81f

Download Submit
C:\Users\Admin\AppData\Roaming\copyright.xml

Filesize
427B

MD5
50918be758813ccca5bbab2f2a8647f1

SHA1
f9a4c4cdcb6cae463a9e6c26ba369a81a1b3f76b

SHA256
3259d4766b04cf747efc1515d78864ab036217c6e2062cd1322b60395e3ae83c

SHA512
6097752b641fb40d83d742384d8e2d7e3fd8e0fd3ff758e7ecfc1f479a269a3f77c40616091a89a6b88e0f6f1995d4c9c29c4047d74eb79d18fd86d4d118f54f

Download Submit
C:\Users\Admin\AppData\Roaming\czephon.env

Filesize
2KB

MD5
f2c6b4a6440967b2d4d37375f8ae99f9

SHA1
8ec0b02d115e8e26a1637714869eb010bf6cbf23

SHA256
be91c0f4beb6e274af9037f65b794d24328e8d371e715f5670cca3fc2f5504f1

SHA512
94533bfa47d079578f5e4ebbc0bdb49b067992662bcc8a15a1f32fe49f0b4642c0f99be369a40b84c36e64b5eb3600a6ff241e14cf1bf38f10140a7b01940545

Download Submit
C:\Users\Admin\AppData\Roaming\doc_to_epub.xsl

Filesize
430B

MD5
9fb68cf4fa0825500c0f913de8b2b684

SHA1
2ac9b4bf8f04ee993f2cc213d92979e1b8851a20

SHA256
662919f36942439de1e00a6af515b376781f37ab3fa1257544dea10bc890aafe

SHA512
58c83a224e29337af18e75345c51aecfd4619f25f1d51ea9f68e7dede5d50dbf856afbbcf07346cd333253387062b1579c2a26a85f5319a6cc4f668685b2683f

Download Submit
C:\Users\Admin\AppData\Roaming\dsc_drivers_tile.png

Filesize
4KB

MD5
92ca1541005202ad550de352644c6222

SHA1
9bb3595795ccc2f92e5c9a522556027e279875b1

SHA256
89c05910f4be67dfeecdc5101615683b1561c7fff18073850e43f6252804e281

SHA512
5755a72dc85669003808dda44576d7aa8277abc9a99ffffe236dadef0ac9f807a859202bddc1dd82fec5b73466618db09851e1e4a48ee56bc03872d5f5d3b008

Download Submit
C:\Users\Admin\AppData\Roaming\example.xsl

Filesize
2KB

MD5
ccfab72640a4d5de19096e61cc1111e7

SHA1
e5f992187707c256949fee3987482de01527776f

SHA256
963cca28032d4a5e5fc05cb3cb509ac235bd390161fa862611ee1543ae5b744b

SHA512
93d7a787626f9444527574257a41266512565a5e3543b1026984ec5b2e606b8339d5a5901059b8e7fef502f62be50992d7bbe96522d7536ca4341bb9a4f1cc67

Download Submit
C:\Users\Admin\AppData\Roaming\feedback.link.text.xml

Filesize
1KB

MD5
eb1b38494710a85486706cd26ecbbf0b

SHA1
e82899197415da340691a8faede249a51f139544

SHA256
dce39beb0fa38c782e99c97a2accc4a0bf0f241854a0d7a0c9cd2d2500075d8b

SHA512
ccee19adc0070128deada628d197058eb4ef9ff967c7d67b188ec368edde89a8a1bf46fc8a7027a4a64d0215108145556b7e19753e72bc51d8f21fb1fc6a3332

Download Submit
C:\Users\Admin\AppData\Roaming\frn.fca

Filesize
1KB

MD5
420be751ebc4ba1db0066cd8abdcd653

SHA1
1f046369b9e98c4efa5e342b479d32843467197b

SHA256
5bbd13fa185a62a97a1eeece5278d87f68333bc22e8aab0c26d10dd17a0b1070

SHA512
f8715e5d71570f5d7b81e9bc39efe28de97ecbaa5782559644562da1875adea3ef4693d142378332cfc412077f8530fb9755efa0e98e215e572eae714fc04200

Download Submit
C:\Users\Admin\AppData\Roaming\get_drivers_downloads_icon.png

Filesize
3KB

MD5
2fa931ab0c127cc18731f36317b72fc6

SHA1
b021bc7565202865602ce2953c4e7d06e6fe318c

SHA256
0ef3b86f3372ca83ec1c3523945dcd5dfef986d19790000f3f5fa3c28c86d719

SHA512
f4eda357e8c8ad5cea71ebf34a156221f48d76cf26f2079c6d62bb0837918e6f15994d3345595f41dcaab894eca3b2d14f03fc3f60ec17aa844b77faca6c5a10

Download Submit
C:\Users\Admin\AppData\Roaming\goURL_lr_photoshop_fr.csv

Filesize
518B

MD5
92cf9d652c2ec83c0bbbea280f95f0e3

SHA1
f84ead22ec62ab00f4ebe1fba867221d5a3167cc

SHA256
67e733d428f8a525a4fc0b459ba30e8ae9be02ae0548fe551bf014cd90298df5

SHA512
94b791e01faf7a4c44dca0434bd7543dae345feb123c4071e268471b81d7cb417b25d27ecddbea3377e424129914254b79296fd00c03729f684a9c3ad18efa5a

Download Submit
\Users\Admin\AppData\Local\Temp\nsdAD9E.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
\Users\Admin\AppData\Roaming\AnimGif.dll

Filesize
109KB

MD5
a12772cc4ef12b6ff7aed611e5a00a68

SHA1
a0e097dbd97137a6937e8d3644f3441c6ed33538

SHA256
1518750608126d44484738d36f054fc5b8903f2d9438afc2a0012bdc4b4db6a1

SHA512
8f9c58b7cc1fea94c7ae072da36d192b279997f67d2246d826858c0be0c7e4d461ab017b32c380a2725382bb0ac2a82b08b9ba081119d6f799b806ab709a6109

Download Submit
\Users\Admin\AppData\Roaming\{4B515B6F-3A9B-7D24-0D07-0BB700B153B4}\sdbinst.exe

Filesize
249KB

MD5
da3bc9346be10987c91c372c7e178656

SHA1
871531b578d12416f988bd50fd1efdec42aafb6a

SHA256
99bd6452dad7eb2d9904184db057947f9bf68490b3f13f39534dfc0b479079c0

SHA512
6a0bda49f64409ea3a4dec0818c3fcdeb9ca079d222e3cd16bcc1e59d6f0eb3515cc5fed43ab98b2346585be99bf248f7a0c50b4bbde1d6250ebe39e8a79f55c

Download Submit
memory/1144-195-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1144-417-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1144-185-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1144-211-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1144-194-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1144-191-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1144-189-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1144-187-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1144-186-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1144-635-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1144-632-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2160-47-0x0000000001DB0000-0x0000000001DD6000-memory.dmp

Filesize
152KB

Download
memory/2160-62-0x0000000001DB0000-0x0000000001DD6000-memory.dmp

Filesize
152KB

Download
memory/2448-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-53-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-67-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-80-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-51-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-66-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2448-59-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2448-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2800-168-0x0000000002930000-0x0000000002956000-memory.dmp

Filesize
152KB

Download
memory/2800-182-0x0000000002930000-0x0000000002956000-memory.dmp

Filesize
152KB

Download