teslacrypt | 2959e936b6e7e13a436a2abf4c6d258523924fb625d40544789126c7f54733b4

Analysis

max time kernel
146s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0252943605003f18b33010491a1a95b6_JaffaCakes118.exe
Size

345KB
MD5

0252943605003f18b33010491a1a95b6
SHA1

01158e7529b21878460285a6dac6d0d1979045e2
SHA256

2959e936b6e7e13a436a2abf4c6d258523924fb625d40544789126c7f54733b4
SHA512

72e6bcc04a80a9bcb277bef5b5ceac4685a507d25b545c3f3618600d932ede702ce8f5c601fb3ffbca3e1a382374e999d1b01090cc40fb56e39e1c7766d0f19f
SSDEEP

6144:wul3JU9ThrPjbnZhQQqwZbebQ3KFbpnp9Puqy5fMy8dLgIBYGSex:wulUhrMQ5ZbuSKjuLupgs

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+aqjue.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/17ACF7C62E2BECC2 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/17ACF7C62E2BECC2 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/17ACF7C62E2BECC2 If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/17ACF7C62E2BECC2 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/17ACF7C62E2BECC2 http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/17ACF7C62E2BECC2 http://yyre45dbvn2nhbefbmh.begumvelic.at/17ACF7C62E2BECC2 Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/17ACF7C62E2BECC2

URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/17ACF7C62E2BECC2

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/17ACF7C62E2BECC2

http://yyre45dbvn2nhbefbmh.begumvelic.at/17ACF7C62E2BECC2

http://xlowfznrg4wf7dli.ONION/17ACF7C62E2BECC2

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (572) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2856 cmd.exe

pid	process
2856	cmd.exe

Drops startup file 6 IoCs

Processes:

mdsmfxcccfmf.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe

Executes dropped EXE 1 IoCs

Processes:

mdsmfxcccfmf.exe

pid process

2352 mdsmfxcccfmf.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mdsmfxcccfmf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\wxxtdokjfojy = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\mdsmfxcccfmf.exe\""	mdsmfxcccfmf.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

Processes:

mdsmfxcccfmf.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows NT\Accessories\en-US\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\currency.js	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jre7\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new_partly-cloudy.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\3.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\settings.js	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Common Files\Services\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sm\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\ja-JP\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\TextConv\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\_RECoVERY_+aqjue.png	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\_RECoVERY_+aqjue.txt	mdsmfxcccfmf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\_RECoVERY_+aqjue.html	mdsmfxcccfmf.exe

Drops file in Windows directory 2 IoCs

Processes:

0252943605003f18b33010491a1a95b6_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\mdsmfxcccfmf.exe	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe
File opened for modification	C:\Windows\mdsmfxcccfmf.exe	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeNOTEPAD.EXEIEXPLORE.EXEDllHost.execmd.exe0252943605003f18b33010491a1a95b6_JaffaCakes118.exemdsmfxcccfmf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mdsmfxcccfmf.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31D63291-7F4C-11EF-80EF-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2220 NOTEPAD.EXE

pid	process
2220	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

mdsmfxcccfmf.exe

pid	process
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe
2352	mdsmfxcccfmf.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

0252943605003f18b33010491a1a95b6_JaffaCakes118.exemdsmfxcccfmf.exeWMIC.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1688	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe
Token: SeDebugPrivilege	2352	mdsmfxcccfmf.exe
Token: SeIncreaseQuotaPrivilege	2868	WMIC.exe
Token: SeSecurityPrivilege	2868	WMIC.exe
Token: SeTakeOwnershipPrivilege	2868	WMIC.exe
Token: SeLoadDriverPrivilege	2868	WMIC.exe
Token: SeSystemProfilePrivilege	2868	WMIC.exe
Token: SeSystemtimePrivilege	2868	WMIC.exe
Token: SeProfSingleProcessPrivilege	2868	WMIC.exe
Token: SeIncBasePriorityPrivilege	2868	WMIC.exe
Token: SeCreatePagefilePrivilege	2868	WMIC.exe
Token: SeBackupPrivilege	2868	WMIC.exe
Token: SeRestorePrivilege	2868	WMIC.exe
Token: SeShutdownPrivilege	2868	WMIC.exe
Token: SeDebugPrivilege	2868	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2868	WMIC.exe
Token: SeRemoteShutdownPrivilege	2868	WMIC.exe
Token: SeUndockPrivilege	2868	WMIC.exe
Token: SeManageVolumePrivilege	2868	WMIC.exe
Token: 33	2868	WMIC.exe
Token: 34	2868	WMIC.exe
Token: 35	2868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2868	WMIC.exe
Token: SeSecurityPrivilege	2868	WMIC.exe
Token: SeTakeOwnershipPrivilege	2868	WMIC.exe
Token: SeLoadDriverPrivilege	2868	WMIC.exe
Token: SeSystemProfilePrivilege	2868	WMIC.exe
Token: SeSystemtimePrivilege	2868	WMIC.exe
Token: SeProfSingleProcessPrivilege	2868	WMIC.exe
Token: SeIncBasePriorityPrivilege	2868	WMIC.exe
Token: SeCreatePagefilePrivilege	2868	WMIC.exe
Token: SeBackupPrivilege	2868	WMIC.exe
Token: SeRestorePrivilege	2868	WMIC.exe
Token: SeShutdownPrivilege	2868	WMIC.exe
Token: SeDebugPrivilege	2868	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2868	WMIC.exe
Token: SeRemoteShutdownPrivilege	2868	WMIC.exe
Token: SeUndockPrivilege	2868	WMIC.exe
Token: SeManageVolumePrivilege	2868	WMIC.exe
Token: 33	2868	WMIC.exe
Token: 34	2868	WMIC.exe
Token: 35	2868	WMIC.exe
Token: SeBackupPrivilege	2756	vssvc.exe
Token: SeRestorePrivilege	2756	vssvc.exe
Token: SeAuditPrivilege	2756	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1904	WMIC.exe
Token: SeSecurityPrivilege	1904	WMIC.exe
Token: SeTakeOwnershipPrivilege	1904	WMIC.exe
Token: SeLoadDriverPrivilege	1904	WMIC.exe
Token: SeSystemProfilePrivilege	1904	WMIC.exe
Token: SeSystemtimePrivilege	1904	WMIC.exe
Token: SeProfSingleProcessPrivilege	1904	WMIC.exe
Token: SeIncBasePriorityPrivilege	1904	WMIC.exe
Token: SeCreatePagefilePrivilege	1904	WMIC.exe
Token: SeBackupPrivilege	1904	WMIC.exe
Token: SeRestorePrivilege	1904	WMIC.exe
Token: SeShutdownPrivilege	1904	WMIC.exe
Token: SeDebugPrivilege	1904	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1904	WMIC.exe
Token: SeRemoteShutdownPrivilege	1904	WMIC.exe
Token: SeUndockPrivilege	1904	WMIC.exe
Token: SeManageVolumePrivilege	1904	WMIC.exe
Token: 33	1904	WMIC.exe
Token: 34	1904	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeDllHost.exe

pid process

1200 iexplore.exe
792 DllHost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1200 iexplore.exe
1200 iexplore.exe
1912 IEXPLORE.EXE
1912 IEXPLORE.EXE

pid	process
1200	iexplore.exe
792	DllHost.exe

pid	process
1200	iexplore.exe
1200	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

0252943605003f18b33010491a1a95b6_JaffaCakes118.exemdsmfxcccfmf.exeiexplore.exe

description	pid	process	target process
PID 1688 wrote to memory of 2352	1688	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe	mdsmfxcccfmf.exe
PID 1688 wrote to memory of 2352	1688	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe	mdsmfxcccfmf.exe
PID 1688 wrote to memory of 2352	1688	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe	mdsmfxcccfmf.exe
PID 1688 wrote to memory of 2352	1688	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe	mdsmfxcccfmf.exe
PID 1688 wrote to memory of 2856	1688	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2856	1688	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2856	1688	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2856	1688	0252943605003f18b33010491a1a95b6_JaffaCakes118.exe	cmd.exe
PID 2352 wrote to memory of 2868	2352	mdsmfxcccfmf.exe	WMIC.exe
PID 2352 wrote to memory of 2868	2352	mdsmfxcccfmf.exe	WMIC.exe
PID 2352 wrote to memory of 2868	2352	mdsmfxcccfmf.exe	WMIC.exe
PID 2352 wrote to memory of 2868	2352	mdsmfxcccfmf.exe	WMIC.exe
PID 2352 wrote to memory of 2220	2352	mdsmfxcccfmf.exe	NOTEPAD.EXE
PID 2352 wrote to memory of 2220	2352	mdsmfxcccfmf.exe	NOTEPAD.EXE
PID 2352 wrote to memory of 2220	2352	mdsmfxcccfmf.exe	NOTEPAD.EXE
PID 2352 wrote to memory of 2220	2352	mdsmfxcccfmf.exe	NOTEPAD.EXE
PID 2352 wrote to memory of 1200	2352	mdsmfxcccfmf.exe	iexplore.exe
PID 2352 wrote to memory of 1200	2352	mdsmfxcccfmf.exe	iexplore.exe
PID 2352 wrote to memory of 1200	2352	mdsmfxcccfmf.exe	iexplore.exe
PID 2352 wrote to memory of 1200	2352	mdsmfxcccfmf.exe	iexplore.exe
PID 1200 wrote to memory of 1912	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 1912	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 1912	1200	iexplore.exe	IEXPLORE.EXE
PID 1200 wrote to memory of 1912	1200	iexplore.exe	IEXPLORE.EXE
PID 2352 wrote to memory of 1904	2352	mdsmfxcccfmf.exe	WMIC.exe
PID 2352 wrote to memory of 1904	2352	mdsmfxcccfmf.exe	WMIC.exe
PID 2352 wrote to memory of 1904	2352	mdsmfxcccfmf.exe	WMIC.exe
PID 2352 wrote to memory of 1904	2352	mdsmfxcccfmf.exe	WMIC.exe
PID 2352 wrote to memory of 680	2352	mdsmfxcccfmf.exe	cmd.exe
PID 2352 wrote to memory of 680	2352	mdsmfxcccfmf.exe	cmd.exe
PID 2352 wrote to memory of 680	2352	mdsmfxcccfmf.exe	cmd.exe
PID 2352 wrote to memory of 680	2352	mdsmfxcccfmf.exe	cmd.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

mdsmfxcccfmf.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	mdsmfxcccfmf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	mdsmfxcccfmf.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0252943605003f18b33010491a1a95b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0252943605003f18b33010491a1a95b6_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\mdsmfxcccfmf.exe
  C:\Windows\mdsmfxcccfmf.exe
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2352
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:2220
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1912
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\MDSMFX~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:680
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\025294~1.EXE
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+aqjue.html

Filesize
12KB

MD5
4bde7c9c53f9ed3e09f32af55bafd145

SHA1
8f47a07eedcb9df2d3fca8f98f60824733a76270

SHA256
4f3781635e550e5531ee989f8ad2f83e8c65bc72c575bd4437c9b35f0cd7e10f

SHA512
c282a2fc732a0f1d9eb394af97b87f5399308222ef6e4967b59181ed16b3b5e1ac1e566a7c7a6146295121cfe0d482da3323fa5b365cf72217ce7b06a85d8891

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+aqjue.png

Filesize
64KB

MD5
300307dfbf42b3256c38735cc6de9ec5

SHA1
c102ae4711666943734a607c82a1194891f75974

SHA256
94923fc5730879f9f98cee570e8b0115a4d111bca3ee955c6014fac41ab4ccaa

SHA512
2ba0f5156b759616934ccf70e8f50130d3e5a00643462454f40f510c8f849b510b88ae17409b9baf0845e9fe2223e3b3435c8e30c6695c58037ceaca0d429cee

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+aqjue.txt

Filesize
1KB

MD5
4fc943dff1ca4000d74e32368f0d852f

SHA1
c2e2937fc3788371be7c31601a9e0e5326092269

SHA256
5c8d88aee88028987d1e88dd1489170548d32f2d099bd3f32e523a2f04d93c9b

SHA512
34fdca4074423183e5cc34b6f9f2a069081a5d24dde2e0b9cfeca5ce2a2bc38bb1affc4eaab5b303985eb9a64c7f3f0d9fb0e04cffc4c3c64e4b523ca4bf1159

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
8c15089834bf6e5a552754cfc45bc1bb

SHA1
fa7ae043022567f38764bc1ad67ba77ca6544a77

SHA256
43966bbe20845fdb52d2b723845b4c2a1d7d1b52cf1eafd5df876577da8bdc8d

SHA512
90b35de17e72855cd6cfe4c15a6346e37929936fadd4649249370b82d0090784fb4d55a85c22f07683f1699be523750f37a37510a3dff18c0f9bd8b414a885b7

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
960804298daa73b84ed73ee1262793f0

SHA1
b9dd22b3aeb24cf1c2b8fcb939f1f2090b5b8a84

SHA256
848319bd9b3c68f82230ad4337383b1ebcf02d0aae560592822e29609640f3d4

SHA512
69c3b7a59d45f5b7fc2f4281086e97fb32697047fcaa59d7ca16e8364070106a38af7f7b05371c835c4d3e9e13c660610659b8e8d9dacab0a19f8ba0db6f7e86

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
4557628cc0076a7c281b2252a0f937f6

SHA1
56f041ca2e0fac6665a318351b39bb2d60e5e554

SHA256
0d11043a79112eed2bcf7dcd51f5abc1d86a3df390f6d6a3aa0f3d389370879e

SHA512
d4dd8fb93344a0166d3578b419e446c5fc0cbb2722df25e350e77840ef246f7929693f43090d10f20cbfba193790f560684b709abed1a3f22b33c92355076e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b2c140874bfc75e19cab4a6e1ac9147

SHA1
6f48e11aa6dfbedb02235b8b175696ccfe8143c4

SHA256
515708964f84503fb41c7b4b275d69757f91bb81f5546598136a539a151584f7

SHA512
5808fa035973e6cacfbabd1e7a7b74e510e95a804155be8c092b4daefd2719632fbc9acc22be5925742a98b58ec3a63d8f037544de17f8550bd23f564eef9632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d65fb8b905a578565fcfb9f1d79bc6b7

SHA1
fdb87a76c5fd47023c88a02c4c8528c7db6f281c

SHA256
7a7865a8c63d2c323163cf7cc13a6d4129bf12b8619ca51124bb25a10f2ffa9b

SHA512
6fc9622d0a2ed911a8a3640e053d2ad0dd2a95ade4f7f4bfcaada9ed282322c0d03912d04998eed8f51edbe35fbc47e0c899dfa83763a277596f2601f1a9e37f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e970cc661d2ca89f2c5d02ce1464e07b

SHA1
54482c563e0d9fcc50068578dedf1ecddc16dfc4

SHA256
cb834e251818ed2a19bf9ba932460f4e90e96b3ea09561fdf60708e632cc6c6e

SHA512
0eb25888c0a9b4a938d4acf01cb1554dd4acb7f9182f330bfa73342ebdf7fc19155501a581ea3c38d13e07bfcf939831564d5227c7e166411f7b27d720483e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
247108b5ee5da56cb5d5f586cc61f13e

SHA1
fd52d7c8ce51783c67bb3e5bfdcfccfb8e62af2c

SHA256
dca21789e14fec6a3ee29818d0a58eafd99fa7ba5fda43daa459624bc477c9bd

SHA512
98d1e5e22724c326cea84d29f537b1b0263bdcb13e212437c4042e7994eba116c6d9356ed1ccd57a83d5ff9de4246f98ee23fc374519a2b180e32e3d8c2ca147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f99407ae07414d9df5de284bab3230d

SHA1
f9cf6ee84510982af01cfeac3b0bfacfc4c0a260

SHA256
3f477bb108b4858fc82605d7ce601fbee4bb82586dae857d804fd9722aa4b200

SHA512
5f85c57cdebd8fde8c0b70805c8d5790812f55ad509542ff7d21190bdc08584a72c1aa3d2e5ffd534bd93f450075c87b55cda766f915d78448986a5d17177ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9477fec8f1accf83da5c035c70c2d452

SHA1
4f35f4466b22259da100b82f2f3d8207fd5cc99a

SHA256
c985bf24f9190d08b9f4511aaf6412447e65fe2326c5eb3ac33f85c7fdc20361

SHA512
f1216b3a72a1688af95b5a495f938ad39222d146c05b4d5508d80e812af9953e1a5c5d4b9c3ca77586c5ed9e80770796060ee9ad141aa3d3e6e73f4da4315028

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf83ce53aff7e607d3b8c0f65f3daf8b

SHA1
2140f10638e2cf3707c55d7bf08af91511a4837f

SHA256
d53f493b2552e608c3f69ebba714148a97eb2442e436117f3ac2d0bc9d4ce715

SHA512
f55390a7972645a21ca74ddf04f58b8c72d9d707306f83d0f5e393af7ee898741e6302000009ad71d85e95d11dee74bc275c51278beb24646395bb6eac0b15a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47f0ddf6bdb2bdb52d273f2aa4f61524

SHA1
4e30dbed64fdad72bba49c2a9db9274bd8d68cf5

SHA256
4798193498c105d7a94eff10ff32ed1f294bce0cc6de875b36ede9b8030e7c30

SHA512
5af6b07a75921029fb4910386b21614bb31df3367cba8d9e8e973b3a7318b268b4be72d8dc2e243e76d6da27be8ccf95e2fe57a987fe6650b7fd86e5d4cf2d44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f740b2ae83e3d470af868e6235cd9023

SHA1
099cfafe897924e9a0a55cced61f3d72bceae7b5

SHA256
824cd69467597327db915743910c79c6e9214710ee12ce40159ebce38bfe0f1f

SHA512
941d461843885c9372828e5fc8b6b0ed0becc05e494a303aee89159e644c440e1ab9d5bee69804ad56dd66ad9fea88cc5ed2ad5ec681e695c1761ac1fc2162c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC40D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC49E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\eval\professional\license.rtf

Filesize
35KB

MD5
291ad84aa1e7d2a36bd00b08167b2736

SHA1
e93b41d487db365b751f4b06db409815ad94f330

SHA256
5d356a9f6d08deef8345cf29ae7f24b6c77c6ce56569989ad2422c52e9296594

SHA512
c58d6294b796b86c4e2489a65eabb80d6ce386b38efd90608b46af29755f708112985da913c5dce8163294fa38951c4ae084be8ab1ce856b59913f792dec54e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\eval\ultimatee\license.rtf

Filesize
28KB

MD5
87256cd27af087fb266691577ac21fe0

SHA1
22b83f780183d1dc9f8d1b039abf0b50d47d85e2

SHA256
9b173fc91c3cd85250f6078affa4a7d41fed5e14e5c823ff1db2fde13c389582

SHA512
64f5c259017307e77d24fd82a548aa91346ead2134298396daa6823c4e9988276a8932d787000bba5b01dec22c76111194e6882bb53f246b749fe00a88a33f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\eval\ultimaten\license.rtf

Filesize
35KB

MD5
0b7ffb872839cd6ee8cb8ef5b3d160bc

SHA1
b06758c8d77eab7456e597648c5b33cd70c7577c

SHA256
8ad066e1e69b1c822758ffc1f9dbe19bcc8ec4e585a95bea9375211e8b3eeee0

SHA512
9b0b315d399076c94885b028eb3dfdb828d8376d916a38def58e9a931225194ba52f4ddb2d28ba8282a3b05d78e4733d441c3bc32f32a86203f729ece216deb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\oem\homebasice\license.rtf

Filesize
28KB

MD5
8a216daad2322d18c32f105666dcd805

SHA1
a46152f0a10d15ebca42853d8b5b8245027f5d4d

SHA256
cc500119c555194817ed4562f08267649bcfe215145831ccbe0281fc4aad72a1

SHA512
516e3103ba17e7cdc2569c2dad13bd44c23e5b27d7e5ad7db8b0ed63b469018e66b9a2e9159ed2380e1d672e179f101e5e6c61ed4aaacae2317cd2140671413b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sp1\sources\license\es-es\_default\homepremiume\license.rtf

Filesize
28KB

MD5
733e7cc9bc381035df6873e1de0c9724

SHA1
d798bd9dbc5200d7ec3204bd0eeb6ea235382ccb

SHA256
77f84fed4209d3875b9e86de1d348ea8043e6834d4e313971004da6e577fa31b

SHA512
f22b2f51e83fb69fbf7fcd7b55b5a548613d38c8243cedd4aac0ca023a0a3d61d26274a46c6d64858a074baf7a462a0cbc85be3f10989a179375f9cbf7f1732e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sp1\sources\license\es-es\eval\homebasic\license.rtf

Filesize
35KB

MD5
cdce04cc93685435b69d250d4c630bb6

SHA1
0cdd846343694f9c48d14a790462f2d4dcbbb923

SHA256
b067b9727149cf8411462e4996b33b8a0d521632d36f8178b0ccadce4043ee56

SHA512
a15c1fac1ce171abad1ad5e1f30a70c1c4765eb38fd2ced092c995528252dcd0a420b1d650f168f4b0bf5a4c0a131e237370868905cba203d15e8a7dcf193628

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sp1\sources\license\es-es\oem\startere\license.rtf

Filesize
41KB

MD5
45ffcbc64dd066521f0a61cf32fb8129

SHA1
0d9bf409fcb4bda41794325b372ddd4554efb998

SHA256
9455f86af3b65c04826d4d3a966b021e9ff9149512d92afe2eaec247387630f5

SHA512
e128b5df3d04fdd6c55b8edb91eebf65a7d75e8a85d136909a6e529bb1797ed1cf216d3ed844e46011a2ad4dc80347dbedb3c53e7243c16f30390238808d6882

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7600.16385_es-es_fc29d5bca5556a09\lipeula.rtf

Filesize
9KB

MD5
0b49501d3fab11879972f58241c44563

SHA1
d57b3631bc506ae9952e11eb641807d051ea6362

SHA256
411a69bdcc079a59b5dfda3014d69ba38ef4a0fe71f732553489082f7150609c

SHA512
3900a5ec640b19705b4c7482943e1a0723289feaf521cd94c1509fc4f988bd090353c2276231737b24ed62ce7aa1b92bae7baad3dcb5b923b19166dd384f2d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9a71deeabfc0d8da\license.rtf

Filesize
40KB

MD5
ae526c462abb576e2e3ac7539a57c2d5

SHA1
5da3efddb5addd830ddb3852fb0d2e5103ff55b2

SHA256
9ea3ef5813f6d4ccc037410ff8e0c1ef2d134fa2281e1ffb25e0df6d98bc1f5d

SHA512
aed1602932a5e81cd6c9e74e9a66c25fec01470ed325c9f7cc978afb42c36b9b930f5fdd23ed94c7ad57803f99e55f2242c0d6bf80c7ab811a9924432c7391de

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..m-starter.resources_31bf3856ad364e35_6.1.7600.16385_es-es_30cf7a89f238525a\license.rtf

Filesize
43KB

MD5
64d69e7b0966d6e6ee2b23f3ec7cd208

SHA1
05dc4ed54ad3f7c77fbeb95af52001ec5e8825c9

SHA256
a8743773a2061f30731691dbd558db5f769de34060bcbddce01a65e60e30bedc

SHA512
49beec2a9f81c51c6d6532b92bff885955246c1422d78c6f4d3d93e2acc2476ecc488f5685785473502625e74c9fd283cec5f1c6b782e9558f7c9c0334e04ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7600.16385_es-es_16d3f6301ae8cff8\license.rtf

Filesize
1KB

MD5
444ba661483d5df86b5641cb4c6d9dbb

SHA1
e1753633150ebf33abe3326fd95b06a48d880505

SHA256
75468070f79d4678a3c43dde407c1353a0a18f27a1c5e208e2b0912026a5f073

SHA512
1b1a0bdfbafeac67d29c52b64c4a958d1a45890584356abb665d14c3297658acb0ab1a5d7db883b307b89c3cf383d48371409defbf5e74f347349702a3c4d131

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..rverhyper.resources_31bf3856ad364e35_6.1.7601.17514_es-es_b990ce545164c82b\license.rtf

Filesize
62KB

MD5
ea31b9a036a7341d6db586e07e47f1fc

SHA1
4ddd859290fa66114d074e5cd8fbcae20caad749

SHA256
4c6567c83ce91d859923a446b04e7a4c14981ddfeebe85cd307cf430ddb98e7f

SHA512
ba7878f68e1f465c95ecfc13f8bf8fb6dc50ca635cca1624b6354171c63b1b1d924db7037ac76edbc59d519f373dc1b97d6f2e3ec7a3399df9dfb3d4c3ee270e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b1cda3731d74e249\license.rtf

Filesize
1KB

MD5
9598cc42554daac9ddeffedb8cb7eb3d

SHA1
42648670338c905184a67aa58d8713c2b3182f34

SHA256
0cc95811cb07f5b590d01a4f399cbf3dc98141ee1969a6fd2445cca3c168be53

SHA512
2ae67e7d600cb2fb40116c804b503d0124fb9720e9485863a58cdd8acc93700b2c3b922e79202d1aff2e501c5fc2d6d03872d45b92bc93efeaf9c6353d965291

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7600.16385_es-es_18649662a3c65f12\license.rtf

Filesize
1KB

MD5
f03cff550b75c39f6e63f0665cf18dab

SHA1
7269fd6c41f94d7ff54ddd1c28b115183a6bded4

SHA256
724a0e6e568cca25306c756291b3ba313daa4e0f98220743a50c3042e5e67d52

SHA512
fefb2767433e689c877aef240011763a12a8598b9f9844794f01e14ef1461d308716579d4a92b1c2dfff0da4c554b763179c7200ec4ca777bfd1c7b75f0dc672

Download Submit
C:\Windows\mdsmfxcccfmf.exe

Filesize
345KB

MD5
0252943605003f18b33010491a1a95b6

SHA1
01158e7529b21878460285a6dac6d0d1979045e2

SHA256
2959e936b6e7e13a436a2abf4c6d258523924fb625d40544789126c7f54733b4

SHA512
72e6bcc04a80a9bcb277bef5b5ceac4685a507d25b545c3f3618600d932ede702ce8f5c601fb3ffbca3e1a382374e999d1b01090cc40fb56e39e1c7766d0f19f

Download Submit
memory/792-14072-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/1688-1-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1688-0-0x0000000001D70000-0x0000000001D9F000-memory.dmp

Filesize
188KB

Download
memory/1688-9-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1688-8-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/1688-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/2352-426-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-10986-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-12246-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-13372-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-14071-0x0000000002B50000-0x0000000002B52000-memory.dmp

Filesize
8KB

Download
memory/2352-9920-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-14075-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-14077-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-8683-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-7433-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-5095-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-3894-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-2791-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-1705-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-722-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-382-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-310-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-11-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/2352-10-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download