Analysis Overview
SHA256
e7db1e2ba7dcc5c0e8ceb11c888ec361f0595418d82b792dcdd5844c7d13759f
Threat Level: Known bad
The file 0fdcece65289dc442a99b875eeb9c498_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Modifies WinLogon for persistence
Modifies security service
UAC bypass
Modifies firewall policy service
Windows security bypass
Ramnit
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Windows security modification
Drops startup file
Adds Run key to start application
Checks whether UAC is enabled
Suspicious use of SetThreadContext
UPX packed file
Program crash
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious behavior: EnumeratesProcesses
Modifies Internet Explorer settings
System policy modification
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: LoadsDriver
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-03 17:31
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-03 17:31
Reported
2024-10-03 17:33
Platform
win7-20240903-en
Max time kernel
150s
Max time network
150s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\vrlbercv\\eudnoulm.exe" | C:\Windows\SysWOW64\svchost.exe | N/A |
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Modifies security service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Ramnit
UAC bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Windows\SysWOW64\svchost.exe | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" | C:\Windows\SysWOW64\svchost.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eudnoulm.exe | C:\Windows\SysWOW64\svchost.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eudnoulm.exe | C:\Windows\SysWOW64\svchost.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\EudNoulm = "C:\\Users\\Admin\\AppData\\Local\\vrlbercv\\eudnoulm.exe" | C:\Windows\SysWOW64\svchost.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2804 set thread context of 2780 | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k |
| PID 944 set thread context of 544 | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe |
| PID 3048 set thread context of 2940 | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\svchost.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\svchost.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe | N/A |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fdcece65289dc442a99b875eeb9c498_JaffaCakes118.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fdcece65289dc442a99b875eeb9c498_JaffaCakes118.dll,#1
C:\Users\Admin\AppData\Local\Temp\t32KY8d5k
"t32KY8d5k"
C:\Users\Admin\AppData\Local\Temp\t32KY8d5k
"t32KY8d5k"
C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe
"C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe" elevate
C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe
"C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe" elevate
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe"" admin
C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe
"C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe" admin
C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe
"C:\Users\Admin\AppData\Local\Temp\vdbltwns.exe" admin
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | yummcxgbkyknsbvrui.com | udp |
| US | 8.8.8.8:53 | yyjiujeygdpkippa.com | udp |
| US | 8.8.8.8:53 | yahwvfbingmhmaf.com | udp |
| US | 8.8.8.8:53 | kfbavaqqwrnjlmkrl.com | udp |
| US | 8.8.8.8:53 | vktkpkqmlufmqwvvu.com | udp |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.8.8:53 | kpmqqttppsmtn.com | udp |
| US | 8.8.8.8:53 | jusfrtysjbveoqfam.com | udp |
| US | 8.8.8.8:53 | vfdykmselcv.com | udp |
| US | 8.8.8.8:53 | urktyyncfbxsk.com | udp |
| US | 8.8.8.8:53 | nhlbmffxvyqnebg.com | udp |
| GB | 142.250.187.238:80 | google.com | tcp |
| IE | 34.253.216.9:443 | vfdykmselcv.com | tcp |
| NL | 85.17.31.82:443 | jusfrtysjbveoqfam.com | tcp |
| DE | 195.201.179.207:443 | kfbavaqqwrnjlmkrl.com | tcp |
| DE | 46.165.254.195:443 | vktkpkqmlufmqwvvu.com | tcp |
| DE | 46.165.254.195:443 | vktkpkqmlufmqwvvu.com | tcp |
| US | 8.8.8.8:53 | pjlpwukiqfqyawojk.com | udp |
| US | 8.8.8.8:53 | yplrvvgnusnhhc.com | udp |
| US | 8.8.8.8:53 | wyewxtkaaisyp.com | udp |
| US | 8.8.8.8:53 | lujboicrni.com | udp |
| US | 8.8.8.8:53 | dxlihjvfnaw.com | udp |
| US | 8.8.8.8:53 | cmsokheuh.com | udp |
| US | 8.8.8.8:53 | yasjobmootbenii.com | udp |
| US | 8.8.8.8:53 | excbifohvjwycxpsme.com | udp |
| US | 8.8.8.8:53 | tpireedi.com | udp |
| US | 8.8.8.8:53 | pyrtviuhjofkbbc.com | udp |
| RU | 82.112.184.197:443 | excbifohvjwycxpsme.com | tcp |
| US | 8.8.8.8:53 | jngorreo.com | udp |
| US | 8.8.8.8:53 | wrwbnyjkf.com | udp |
| US | 8.8.8.8:53 | qjfntaopkoipxeq.com | udp |
| US | 8.8.8.8:53 | igknltsa.com | udp |
| US | 8.8.8.8:53 | ejkcuvcajudj.com | udp |
| US | 8.8.8.8:53 | dajjnyedlupjcm.com | udp |
| US | 8.8.8.8:53 | ijmsuhmsljxbtotr.com | udp |
| US | 8.8.8.8:53 | sejrwuivxhqlsafqes.com | udp |
| US | 8.8.8.8:53 | fvvkggqgtfjjyce.com | udp |
| US | 8.8.8.8:53 | ggbvbefqftds.com | udp |
| US | 8.8.8.8:53 | acwyccsiwldmqlpwku.com | udp |
| US | 8.8.8.8:53 | ebhvtigpnlnm.com | udp |
| US | 8.8.8.8:53 | oqlbduxbnlbi.com | udp |
| US | 8.8.8.8:53 | uwcjvetjdp.com | udp |
| US | 8.8.8.8:53 | qhemtiukkv.com | udp |
| US | 8.8.8.8:53 | wfxvtedkwrqcmldako.com | udp |
| US | 8.8.8.8:53 | afbgrxqgaayynvgfaw.com | udp |
| US | 8.8.8.8:53 | qhfuucaspsnwouayf.com | udp |
| US | 8.8.8.8:53 | nwoxnxptevxlepfuxw.com | udp |
| US | 8.8.8.8:53 | akkyqdecjnghqtc.com | udp |
| US | 8.8.8.8:53 | slokdrashvktbvgdduh.com | udp |
| US | 8.8.8.8:53 | nsvwcqyruivqvla.com | udp |
| US | 8.8.8.8:53 | lpfrdruuqxswhkyak.com | udp |
| US | 8.8.8.8:53 | pqasjtvushsjhiqqxa.com | udp |
| US | 8.8.8.8:53 | rmludvia.com | udp |
| US | 8.8.8.8:53 | lkmlcore.com | udp |
| US | 8.8.8.8:53 | periaolu.com | udp |
| US | 8.8.8.8:53 | gwqpxiwlgu.com | udp |
| US | 8.8.8.8:53 | nrsaxnxgpkmnxgf.com | udp |
| US | 8.8.8.8:53 | wxflbhlaxhkqddbb.com | udp |
| US | 8.8.8.8:53 | wyquenvsl.com | udp |
| US | 8.8.8.8:53 | jmlfkfusyhombk.com | udp |
| US | 8.8.8.8:53 | pyaplyjydi.com | udp |
| US | 8.8.8.8:53 | awfwufymolkitdqhwut.com | udp |
| US | 8.8.8.8:53 | kffbswugxk.com | udp |
| US | 8.8.8.8:53 | xbgevmjuqya.com | udp |
| US | 8.8.8.8:53 | erxjeltuqcnbtkubh.com | udp |
| US | 8.8.8.8:53 | libfmnmmkbi.com | udp |
| US | 8.8.8.8:53 | lcudlnkpyoj.com | udp |
| US | 8.8.8.8:53 | rgmraioiqm.com | udp |
| US | 8.8.8.8:53 | ecemuammark.com | udp |
| US | 8.8.8.8:53 | lkybqhbanxcjsidn.com | udp |
| US | 8.8.8.8:53 | kfhmrffoechqgryajnc.com | udp |
| US | 8.8.8.8:53 | nhkyqeetxoqsstgj.com | udp |
| US | 8.8.8.8:53 | ccbbxwkuamaths.com | udp |
| US | 8.8.8.8:53 | fihjtnbejrshvu.com | udp |
| US | 8.8.8.8:53 | akytoytwdfkdc.com | udp |
| US | 8.8.8.8:53 | tjgptxuxtl.com | udp |
| US | 8.8.8.8:53 | gaxnfsewuuudy.com | udp |
| US | 8.8.8.8:53 | gjreursykbm.com | udp |
| US | 8.8.8.8:53 | vxdmtreb.com | udp |
| US | 8.8.8.8:53 | eyrkkcefrc.com | udp |
| US | 8.8.8.8:53 | hpfljqaweoyiamrcpw.com | udp |
| US | 8.8.8.8:53 | oaqlhqawysnxacmsbow.com | udp |
| US | 8.8.8.8:53 | egerktqrrh.com | udp |
| US | 8.8.8.8:53 | llscuekpjpibv.com | udp |
| US | 8.8.8.8:53 | ljntibhc.com | udp |
| US | 8.8.8.8:53 | xomedjxmdgppqjgdjaa.com | udp |
| US | 8.8.8.8:53 | rdnxytcgq.com | udp |
| US | 8.8.8.8:53 | lmofnmhrafvw.com | udp |
| US | 8.8.8.8:53 | xtyjvyrxfcm.com | udp |
| US | 8.8.8.8:53 | ycvhvcqpfwsngccpcnm.com | udp |
| US | 8.8.8.8:53 | leoemsaugiasvirt.com | udp |
| US | 8.8.8.8:53 | gpeixwsyshd.com | udp |
| US | 8.8.8.8:53 | yhfgcbufisdxornck.com | udp |
| US | 8.8.8.8:53 | mcbexsgmjobninfjna.com | udp |
| US | 8.8.8.8:53 | hbenmgoskqcmbrkf.com | udp |
| US | 8.8.8.8:53 | ghjvrkhocmbfjvgkt.com | udp |
| US | 8.8.8.8:53 | ppvmqebx.com | udp |
| US | 8.8.8.8:53 | pcusjfpntuw.com | udp |
| US | 8.8.8.8:53 | scwpgkmmallisjkkag.com | udp |
| US | 8.8.8.8:53 | pysruicoxlmtgogfiwl.com | udp |
| US | 8.8.8.8:53 | rvgilfotdlfglh.com | udp |
| US | 8.8.8.8:53 | sfpeecvovnj.com | udp |
| US | 8.8.8.8:53 | ewvndtvrthoadpitts.com | udp |
| US | 8.8.8.8:53 | armdpidvchlgpyqgc.com | udp |
| US | 8.8.8.8:53 | vwnaoeynisd.com | udp |
| US | 8.8.8.8:53 | adglsupfbrn.com | udp |
| US | 8.8.8.8:53 | ytltnslmp.com | udp |
| US | 8.8.8.8:53 | kamytdpo.com | udp |
| US | 8.8.8.8:53 | pomqkprloee.com | udp |
| US | 8.8.8.8:53 | cfwiahnybdlnh.com | udp |
| US | 8.8.8.8:53 | fxfkecoxwwqkqbbhcqi.com | udp |
| US | 8.8.8.8:53 | oiugelaivjpmd.com | udp |
| US | 8.8.8.8:53 | veoarleqgifcugyi.com | udp |
| US | 8.8.8.8:53 | dcigpnabdthwwddg.com | udp |
| US | 8.8.8.8:53 | ybtxwqagmkdlureo.com | udp |
| US | 8.8.8.8:53 | etfugwehy.com | udp |
| US | 8.8.8.8:53 | mxqayqte.com | udp |
| US | 8.8.8.8:53 | dqcfdagyhgk.com | udp |
| US | 8.8.8.8:53 | xplcxhseyefbfofcxqi.com | udp |
| US | 8.8.8.8:53 | ocejioseopnyhh.com | udp |
| US | 8.8.8.8:53 | bcxmfbhdfxhvxdsdx.com | udp |
| US | 8.8.8.8:53 | nnfjvhymbtivx.com | udp |
| US | 8.8.8.8:53 | fcgejxldqypasmlav.com | udp |
| US | 8.8.8.8:53 | rdluchxfvejhhfrtkld.com | udp |
| US | 8.8.8.8:53 | suxlnkadqwqavihf.com | udp |
| US | 8.8.8.8:53 | wbylawgnume.com | udp |
| US | 8.8.8.8:53 | mxjmrsce.com | udp |
| US | 8.8.8.8:53 | ovjdjowwfiejsv.com | udp |
| US | 8.8.8.8:53 | llerggqhwlicvekr.com | udp |
| US | 8.8.8.8:53 | plhwarkytmmockwbjeb.com | udp |
| US | 8.8.8.8:53 | fvgotugnkdgr.com | udp |
| US | 8.8.8.8:53 | tnmgwclsulchxwefk.com | udp |
| US | 8.8.8.8:53 | grrfusycbutgcdfnsuv.com | udp |
| US | 8.8.8.8:53 | rjtacprqemcrhwg.com | udp |
| US | 8.8.8.8:53 | jnqknbdjkcu.com | udp |
| US | 8.8.8.8:53 | uelmqkkjhynkscodc.com | udp |
| US | 8.8.8.8:53 | bkecrywrasvbillu.com | udp |
| US | 8.8.8.8:53 | qdrudkrc.com | udp |
| US | 8.8.8.8:53 | uiapugfe.com | udp |
| US | 8.8.8.8:53 | ofheubnonpg.com | udp |
| US | 8.8.8.8:53 | hxleirremopog.com | udp |
| US | 8.8.8.8:53 | hawfbmpvawyb.com | udp |
| US | 8.8.8.8:53 | ufonanyrlfp.com | udp |
| US | 8.8.8.8:53 | xbopodbuqykdseh.com | udp |
| US | 8.8.8.8:53 | jwfosebwnkmry.com | udp |
| US | 8.8.8.8:53 | jukwtxdhybypevngin.com | udp |
| US | 8.8.8.8:53 | quqmnejqwtdeqvlwb.com | udp |
| US | 8.8.8.8:53 | vaywiscedyxygrrvqi.com | udp |
| US | 8.8.8.8:53 | wubgyufncyfufyelf.com | udp |
| US | 8.8.8.8:53 | fhlifjixtfb.com | udp |
| US | 8.8.8.8:53 | tjbwbuoiklfubewlnd.com | udp |
| US | 8.8.8.8:53 | bdwmhihxty.com | udp |
| US | 8.8.8.8:53 | wigwdjpfb.com | udp |
| US | 8.8.8.8:53 | xfeilynams.com | udp |
| US | 8.8.8.8:53 | wlgywycen.com | udp |
| US | 8.8.8.8:53 | vyxhnejpetmn.com | udp |
| US | 8.8.8.8:53 | wikuemkpdnwtucshvk.com | udp |
| US | 8.8.8.8:53 | kauekfvsf.com | udp |
| US | 8.8.8.8:53 | jiyrwudoyejk.com | udp |
| US | 8.8.8.8:53 | niyausoqe.com | udp |
| US | 8.8.8.8:53 | cyanwmfcnstduhribs.com | udp |
| US | 8.8.8.8:53 | bybrejuyorgwoa.com | udp |
| US | 8.8.8.8:53 | nakmsjtcto.com | udp |
| US | 8.8.8.8:53 | dqrjixyvbssx.com | udp |
| US | 8.8.8.8:53 | kffwygqbtpdh.com | udp |
| US | 8.8.8.8:53 | nneuuppagyuybj.com | udp |
| US | 8.8.8.8:53 | mhwalylagjuopwv.com | udp |
| US | 8.8.8.8:53 | epigxtiannc.com | udp |
| US | 8.8.8.8:53 | ttfxwmakjxmhm.com | udp |
| US | 8.8.8.8:53 | wjcfllgi.com | udp |
| US | 8.8.8.8:53 | cbdtgbrybqehdhy.com | udp |
| US | 8.8.8.8:53 | myhbdthckcdfhgci.com | udp |
| US | 8.8.8.8:53 | oiymosdjxwpamce.com | udp |
| US | 8.8.8.8:53 | mlflokkkspswyfnfbc.com | udp |
| US | 8.8.8.8:53 | thbihlxurob.com | udp |
| US | 8.8.8.8:53 | qheiqcyxrqv.com | udp |
| US | 8.8.8.8:53 | cpcogmsdwgbtiuqclsm.com | udp |
| US | 8.8.8.8:53 | qjisnelmcjtg.com | udp |
| US | 8.8.8.8:53 | cbcpyghktahyrwr.com | udp |
| US | 8.8.8.8:53 | bsnuypumhfybnugcd.com | udp |
| US | 8.8.8.8:53 | dkxmsbjiejuo.com | udp |
| US | 8.8.8.8:53 | vcfgpasvqbwornhao.com | udp |
| US | 8.8.8.8:53 | gfogxedvjwn.com | udp |
| US | 8.8.8.8:53 | gehrbfqvihbryav.com | udp |
| US | 8.8.8.8:53 | hyqpnvxfaxow.com | udp |
| US | 8.8.8.8:53 | ljebhtoefnttelekfl.com | udp |
| US | 8.8.8.8:53 | nmuhxjywumbhtp.com | udp |
| US | 8.8.8.8:53 | nduktixjnlisu.com | udp |
| US | 8.8.8.8:53 | eklmxfotbaofoloon.com | udp |
| US | 8.8.8.8:53 | vcmkrmpjcheyag.com | udp |
| US | 8.8.8.8:53 | mpnwxwqketycp.com | udp |
| US | 8.8.8.8:53 | jwbknfukacrgpyk.com | udp |
| US | 8.8.8.8:53 | tvqnkxbuncehk.com | udp |
| US | 8.8.8.8:53 | jlkhbdbmdrqipuexn.com | udp |
| US | 8.8.8.8:53 | imgggbjtifnvqna.com | udp |
| US | 8.8.8.8:53 | xyylttlorypluq.com | udp |
| US | 8.8.8.8:53 | ddpifoyenogceql.com | udp |
| US | 8.8.8.8:53 | fjwpmgvdihxupipv.com | udp |
| US | 8.8.8.8:53 | khdtsbkng.com | udp |
| US | 8.8.8.8:53 | xtlctubpuyy.com | udp |
| US | 8.8.8.8:53 | ygdgmmfyk.com | udp |
| US | 8.8.8.8:53 | scdthwrswp.com | udp |
| US | 8.8.8.8:53 | uxpunbkg.com | udp |
| US | 8.8.8.8:53 | eyyjatakvjcfnvw.com | udp |
| US | 8.8.8.8:53 | nvpwlkrdb.com | udp |
| US | 8.8.8.8:53 | djheajwvgodxa.com | udp |
| US | 8.8.8.8:53 | wnrgcbvoadriawdy.com | udp |
| GB | 142.250.187.238:80 | google.com | tcp |
| GB | 142.250.187.238:80 | google.com | tcp |
Files
memory/2728-0-0x00000000000C0000-0x00000000000C1000-memory.dmp
\Users\Admin\AppData\Local\Temp\t32KY8d5k
| MD5 | 33ace2a98e6aa56dbd6f1ae58a9af9ae |
| SHA1 | 67de6edab77318d997f002c9884dd08069612570 |
| SHA256 | 8bf10012bf59dbc3f6509bbf1dc12490779fc5962aa37fcebbcc434e2612371c |
| SHA512 | ea77d71297f7ef842f0c1c7b6f8eb53f8d6d3f223d4f5d2bb4214102601a1197f038a1339d5245ed87671947e90910b78cbe7081d05c0e5cedd55b0726e362f5 |
memory/2804-13-0x0000000000020000-0x0000000000023000-memory.dmp
memory/2804-12-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2728-11-0x0000000074891000-0x0000000074892000-memory.dmp
memory/2728-9-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2728-10-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2804-14-0x0000000072940000-0x0000000072A93000-memory.dmp
memory/2780-24-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2780-31-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2780-36-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2780-47-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2780-46-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2780-34-0x0000000000270000-0x0000000000271000-memory.dmp
memory/2780-33-0x0000000000260000-0x0000000000261000-memory.dmp
memory/2780-30-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2780-29-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2780-26-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2780-22-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2804-21-0x0000000000240000-0x0000000000270000-memory.dmp
memory/2780-19-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2804-45-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2804-44-0x0000000000020000-0x0000000000023000-memory.dmp
memory/2716-40-0x0000000000050000-0x0000000000051000-memory.dmp
memory/2716-38-0x0000000020010000-0x000000002001D000-memory.dmp
memory/2716-49-0x0000000000050000-0x0000000000051000-memory.dmp
memory/2716-48-0x0000000000070000-0x0000000000071000-memory.dmp
memory/2716-50-0x0000000020010000-0x000000002001D000-memory.dmp
memory/1520-61-0x0000000020010000-0x000000002002E000-memory.dmp
memory/1520-70-0x0000000020010000-0x000000002002E000-memory.dmp
memory/2728-69-0x00000000000C0000-0x00000000000C1000-memory.dmp
memory/2780-68-0x000000007727F000-0x0000000077280000-memory.dmp
memory/2780-67-0x0000000077280000-0x0000000077281000-memory.dmp
memory/2716-55-0x0000000020010000-0x000000002001D000-memory.dmp
memory/2716-57-0x0000000020010000-0x000000002001D000-memory.dmp
memory/2716-56-0x0000000020010000-0x000000002001D000-memory.dmp
memory/2716-54-0x0000000000060000-0x0000000000061000-memory.dmp
memory/1520-81-0x0000000020010000-0x000000002002E000-memory.dmp
memory/2780-92-0x0000000077280000-0x0000000077281000-memory.dmp
memory/2780-91-0x0000000000400000-0x0000000000436000-memory.dmp
memory/1520-90-0x0000000020010000-0x000000002002E000-memory.dmp
memory/1520-82-0x0000000020010000-0x000000002002E000-memory.dmp
memory/1520-93-0x0000000020010000-0x000000002002E000-memory.dmp
memory/2780-114-0x0000000000400000-0x0000000000436000-memory.dmp
memory/944-115-0x0000000072940000-0x0000000072A93000-memory.dmp
memory/944-121-0x0000000000260000-0x0000000000290000-memory.dmp
memory/944-130-0x0000000000400000-0x0000000000430000-memory.dmp
memory/544-135-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2520-137-0x0000000000120000-0x0000000000150000-memory.dmp
memory/2940-157-0x0000000000400000-0x0000000000436000-memory.dmp
memory/3048-153-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2940-161-0x0000000000400000-0x0000000000436000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-03 17:31
Reported
2024-10-03 17:33
Platform
win10v2004-20240802-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Modifies security service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Ramnit
UAC bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3168 set thread context of 4132 | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k |
| PID 1272 set thread context of 4800 | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe |
| PID 3496 set thread context of 4736 | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\svchost.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\svchost.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "516412766" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135162" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135162" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "716100199" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4A572369-81AD-11EF-B1C5-4E01FFCF908D} = "0" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135162" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31135162" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31135162" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\VersionManager | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "516412766" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "518444056" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "518444056" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434741649" | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious behavior: LoadsDriver
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\t32KY8d5k | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe | N/A |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fdcece65289dc442a99b875eeb9c498_JaffaCakes118.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fdcece65289dc442a99b875eeb9c498_JaffaCakes118.dll,#1
C:\Users\Admin\AppData\Local\Temp\t32KY8d5k
"t32KY8d5k"
C:\Users\Admin\AppData\Local\Temp\t32KY8d5k
"t32KY8d5k"
C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1796 -ip 1796
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 204
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:17410 /prefetch:2
C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4504 -ip 4504
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 204
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:17416 /prefetch:2
C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe
"C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe" elevate
C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe
"C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe" elevate
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe"" admin
C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe
"C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe" admin
C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe
"C:\Users\Admin\AppData\Local\Temp\cyenjhkm.exe" admin
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.bing.com | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.117.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 161.19.199.152.in-addr.arpa | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
Files
memory/1576-0-0x0000000000610000-0x0000000000611000-memory.dmp
memory/1576-3-0x0000000075681000-0x0000000075682000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\t32KY8d5k
| MD5 | 33ace2a98e6aa56dbd6f1ae58a9af9ae |
| SHA1 | 67de6edab77318d997f002c9884dd08069612570 |
| SHA256 | 8bf10012bf59dbc3f6509bbf1dc12490779fc5962aa37fcebbcc434e2612371c |
| SHA512 | ea77d71297f7ef842f0c1c7b6f8eb53f8d6d3f223d4f5d2bb4214102601a1197f038a1339d5245ed87671947e90910b78cbe7081d05c0e5cedd55b0726e362f5 |
memory/3168-5-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3168-7-0x00000000001C0000-0x00000000001C3000-memory.dmp
memory/3168-8-0x0000000075480000-0x00000000755DD000-memory.dmp
memory/4132-11-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4132-14-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4132-16-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4132-22-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4132-20-0x00000000005B0000-0x00000000005B1000-memory.dmp
memory/4132-19-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/3168-25-0x00000000001C0000-0x00000000001C3000-memory.dmp
memory/1796-24-0x0000000000380000-0x0000000000381000-memory.dmp
memory/1796-23-0x00000000003A0000-0x00000000003A1000-memory.dmp
memory/3168-18-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1576-26-0x0000000000610000-0x0000000000611000-memory.dmp
memory/4132-27-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4132-28-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4132-31-0x0000000077C42000-0x0000000077C43000-memory.dmp
memory/4132-33-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4132-34-0x0000000000400000-0x0000000000436000-memory.dmp
memory/4132-35-0x0000000077C42000-0x0000000077C43000-memory.dmp
memory/1272-57-0x0000000070300000-0x000000007045D000-memory.dmp
memory/1272-56-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1272-55-0x00000000001C0000-0x00000000001C3000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
| MD5 | b85b3b492f6b920450a0e4af9b8abf54 |
| SHA1 | 19cb7b9396882cc7f7571f7d9015d7cef122e43e |
| SHA256 | 16dd95fe5aa6b58597d7744013980297618e69fe0073698614ce45c871d3ec42 |
| SHA512 | fc3693fb9d9319b99bd1472d4c05c103d6e9f7835c4456450c8d270b84245fa02b0744616f83126a79507963817d1d6411abca8a62e092d8dcf6151c6e3f0b79 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
| MD5 | 6de4427d02d49cee2c46a8fead1fafa8 |
| SHA1 | bee49bf0e4452ca72442face8e655bf4a8c3af17 |
| SHA256 | 46d5cd7ff558e5c788807eb674587359c6a660cef091eb420676977e49833d53 |
| SHA512 | c80311bb92f9f49de96d06e9a76a3ef0310365999f00f401fd003d438b66744a88f093b5887e1723c6b8179798697ec24c4b2bda489323337f6cec6d28ef6434 |
memory/1272-67-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1272-66-0x00000000001C0000-0x00000000001C3000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1F2B.tmp
| MD5 | 1a545d0052b581fbb2ab4c52133846bc |
| SHA1 | 62f3266a9b9925cd6d98658b92adec673cbe3dd3 |
| SHA256 | 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1 |
| SHA512 | bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d |
memory/4800-73-0x0000000000400000-0x0000000000436000-memory.dmp
memory/3496-76-0x0000000070730000-0x000000007088D000-memory.dmp
memory/3496-86-0x0000000000400000-0x0000000000430000-memory.dmp
memory/4736-87-0x0000000000400000-0x0000000000436000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IFM58U6K\suggestions[1].en-US
| MD5 | 5a34cb996293fde2cb7a4ac89587393a |
| SHA1 | 3c96c993500690d1a77873cd62bc639b3a10653f |
| SHA256 | c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad |
| SHA512 | e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee |