cerber | 2a8285f324c9ad8dc54f190aa3627ac9bebd546173ed89d5ecd1ea7b65641c75

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
Size

280KB
MD5

541364a81cb365be420373fce3d1f19b
SHA1

fffb124ed79715769e61f793cd3b47458ab74293
SHA256

2a8285f324c9ad8dc54f190aa3627ac9bebd546173ed89d5ecd1ea7b65641c75
SHA512

c19e4d702ea3656b1f73ff263574459fc572f955dd7b492efe7f360659d93739334d669edaeeb15a0589490d67092087f7349bb964d426bc86ee412480a08732
SSDEEP

6144:TBFKoJwFOa/QA1LaVEiPZHeYyXIK/ZqVhPy/sBybCcRnYnaFX0:20w7/QuLaVEiP7yYPVJyQOYnaG

Score

10^/10

cerber discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Rans0mware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC | | 2. http://52uo5k3t73ypjije.fkgrie.top/7445-38FE-7823-0063-72BC | | 3. http://52uo5k3t73ypjije.mix3hi.top/7445-38FE-7823-0063-72BC | | 4. http://52uo5k3t73ypjije.cmfkru.top/7445-38FE-7823-0063-72BC | | 5. http://52uo5k3t73ypjije.onion.to/7445-38FE-7823-0063-72BC |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/7445-38FE-7823-0063-72BC | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC

http://52uo5k3t73ypjije.fkgrie.top/7445-38FE-7823-0063-72BC

http://52uo5k3t73ypjije.mix3hi.top/7445-38FE-7823-0063-72BC

http://52uo5k3t73ypjije.cmfkru.top/7445-38FE-7823-0063-72BC

http://52uo5k3t73ypjije.onion.to/7445-38FE-7823-0063-72BC

http://52uo5k3t73ypjije.onion/7445-38FE-7823-0063-72BC

Extracted

Path

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. <hr> If you are reading this message it means the software "Cerber Rans0mware" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li><a href="http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC" target="_blank">http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC</a></li> <li><a href="http://52uo5k3t73ypjije.fkgrie.top/7445-38FE-7823-0063-72BC" target="_blank">http://52uo5k3t73ypjije.fkgrie.top/7445-38FE-7823-0063-72BC</a></li> <li><a href="http://52uo5k3t73ypjije.mix3hi.top/7445-38FE-7823-0063-72BC" target="_blank">http://52uo5k3t73ypjije.mix3hi.top/7445-38FE-7823-0063-72BC</a></li> <li><a href="http://52uo5k3t73ypjije.cmfkru.top/7445-38FE-7823-0063-72BC" target="_blank">http://52uo5k3t73ypjije.cmfkru.top/7445-38FE-7823-0063-72BC</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/7445-38FE-7823-0063-72BC" target="_blank">http://52uo5k3t73ypjije.onion.to/7445-38FE-7823-0063-72BC</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is <a href="http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC" target="_blank">http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC" target="_blank">http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC" target="_blank">http://52uo5k3t73ypjije.495iru.top/7445-38FE-7823-0063-72BC</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/7445-38FE-7823-0063-72BC in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> </body> </html>

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Contacts a large (2054) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\\UserAccountControlSettings.exe\""	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\\UserAccountControlSettings.exe\""	UserAccountControlSettings.exe

Deletes itself 1 IoCs

pid	Process
2556	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\UserAccountControlSettings.lnk	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\UserAccountControlSettings.lnk	UserAccountControlSettings.exe

Executes dropped EXE 5 IoCs

pid	Process
2812	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2236	UserAccountControlSettings.exe
1340	UserAccountControlSettings.exe
2772	UserAccountControlSettings.exe

Loads dropped DLL 9 IoCs

pid	Process
2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
2812	UserAccountControlSettings.exe
2812	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2236	UserAccountControlSettings.exe
1340	UserAccountControlSettings.exe
1340	UserAccountControlSettings.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\\UserAccountControlSettings.exe\""	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\\UserAccountControlSettings.exe\""	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\\UserAccountControlSettings.exe\""	UserAccountControlSettings.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountControlSettings = "\"C:\\Users\\Admin\\AppData\\Roaming\\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\\UserAccountControlSettings.exe\""	UserAccountControlSettings.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UserAccountControlSettings.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpE6A7.bmp"	UserAccountControlSettings.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2316 set thread context of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2812 set thread context of 2172	2812	UserAccountControlSettings.exe	38
PID 1340 set thread context of 2772	1340	UserAccountControlSettings.exe	57

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
File opened for modification	C:\Windows\	UserAccountControlSettings.exe
File opened for modification	C:\Windows\	UserAccountControlSettings.exe
File opened for modification	C:\Windows\	UserAccountControlSettings.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserAccountControlSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserAccountControlSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserAccountControlSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserAccountControlSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UserAccountControlSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2820	cmd.exe
2712	PING.EXE
2432	cmd.exe
1056	PING.EXE
2556	cmd.exe
2112	PING.EXE

Kills process with taskkill 3 IoCs

evasion

pid	Process
1496	taskkill.exe
2828	taskkill.exe
1840	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\\UserAccountControlSettings.exe\""	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop	UserAccountControlSettings.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\\UserAccountControlSettings.exe\""	UserAccountControlSettings.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53643761-8CD8-11EF-8334-424588269AE0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435366488"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{536DBCE1-8CD8-11EF-8334-424588269AE0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e8c8cc67df8143428414201caeb66a3e000000000200000000001066000000010000200000000904bcce331d20800587c965ee95d6526aff94c46375173912a7717d5ea840d3000000000e8000000002000020000000c732d81d9d1ba231975fbade09af9f16b11f6ad2a1c6f2953d4a5929580009fd90000000828db9783a648ab0bc591ef2b8008e74fea0c969b55414f0a7d4bcc2b50c3020ae04a676a488b5fc1c5a551e535ccac7e003a6651b7c744ddf5c9f607d50a2f13ba2e4542b6d87fb6b941e96da04777505f6d96652e6109e9a680c0a06d27b677b58ce8c3f844c1d6fa9eac41012ce289c444b7335ee9c5080038643d7d09556a797c86ffc6cf59d3d4ed39928332ef240000000540ff4ef141066723911f278a5fc591470a9b5ce3528caf17208cad3c4b8e098090649c58703486691609e003f53dbcbdc975cdb0b62abae15bd9cfea7491acf	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e8c8cc67df8143428414201caeb66a3e000000000200000000001066000000010000200000007d73da75a24eb003cf13e839648b59c60d92e6c552afa950775ecb160e130000000000000e800000000200002000000048cdac2e5b9f91a829f27c95291a43b71ea6300287716bc1c8977393b5e2dfce2000000011de374eb758bfa1304978a3c66dcf69e4cfed494a547ec2edf4650770ffc671400000002259e92c60e79fa38f936ab98180fe54ead6bc41cb4ace5918d3edbd3d15f9a088603454e845e80fcc94647c0c48b38e416f1ddc57a7ec52d93f8b3fa386aae7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80644016e520db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2112	PING.EXE
2712	PING.EXE
1056	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe
2172	UserAccountControlSettings.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	2172	UserAccountControlSettings.exe
Token: 33	1128	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1128	AUDIODG.EXE
Token: 33	1128	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1128	AUDIODG.EXE
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	1840	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2720	iexplore.exe
2872	iexplore.exe
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2720	iexplore.exe
2720	iexplore.exe
2720	iexplore.exe
2720	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2872	iexplore.exe
2872	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2316 wrote to memory of 2776	2316	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	31
PID 2776 wrote to memory of 2812	2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	32
PID 2776 wrote to memory of 2812	2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	32
PID 2776 wrote to memory of 2812	2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	32
PID 2776 wrote to memory of 2812	2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	32
PID 2776 wrote to memory of 2556	2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	33
PID 2776 wrote to memory of 2556	2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	33
PID 2776 wrote to memory of 2556	2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	33
PID 2776 wrote to memory of 2556	2776	541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe	33
PID 2556 wrote to memory of 1496	2556	cmd.exe	35
PID 2556 wrote to memory of 1496	2556	cmd.exe	35
PID 2556 wrote to memory of 1496	2556	cmd.exe	35
PID 2556 wrote to memory of 1496	2556	cmd.exe	35
PID 2556 wrote to memory of 2112	2556	cmd.exe	37
PID 2556 wrote to memory of 2112	2556	cmd.exe	37
PID 2556 wrote to memory of 2112	2556	cmd.exe	37
PID 2556 wrote to memory of 2112	2556	cmd.exe	37
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2812 wrote to memory of 2172	2812	UserAccountControlSettings.exe	38
PID 2612 wrote to memory of 2236	2612	taskeng.exe	41
PID 2612 wrote to memory of 2236	2612	taskeng.exe	41
PID 2612 wrote to memory of 2236	2612	taskeng.exe	41
PID 2612 wrote to memory of 2236	2612	taskeng.exe	41
PID 2172 wrote to memory of 2720	2172	UserAccountControlSettings.exe	42
PID 2172 wrote to memory of 2720	2172	UserAccountControlSettings.exe	42
PID 2172 wrote to memory of 2720	2172	UserAccountControlSettings.exe	42
PID 2172 wrote to memory of 2720	2172	UserAccountControlSettings.exe	42
PID 2172 wrote to memory of 2372	2172	UserAccountControlSettings.exe	43
PID 2172 wrote to memory of 2372	2172	UserAccountControlSettings.exe	43
PID 2172 wrote to memory of 2372	2172	UserAccountControlSettings.exe	43
PID 2172 wrote to memory of 2372	2172	UserAccountControlSettings.exe	43
PID 2720 wrote to memory of 2128	2720	iexplore.exe	45
PID 2720 wrote to memory of 2128	2720	iexplore.exe	45
PID 2720 wrote to memory of 2128	2720	iexplore.exe	45
PID 2720 wrote to memory of 2128	2720	iexplore.exe	45
PID 2720 wrote to memory of 2276	2720	iexplore.exe	46
PID 2720 wrote to memory of 2276	2720	iexplore.exe	46
PID 2720 wrote to memory of 2276	2720	iexplore.exe	46
PID 2720 wrote to memory of 2276	2720	iexplore.exe	46
PID 2872 wrote to memory of 2860	2872	iexplore.exe	47
PID 2872 wrote to memory of 2860	2872	iexplore.exe	47
PID 2872 wrote to memory of 2860	2872	iexplore.exe	47
PID 2872 wrote to memory of 2860	2872	iexplore.exe	47
PID 2172 wrote to memory of 2020	2172	UserAccountControlSettings.exe	48
PID 2172 wrote to memory of 2020	2172	UserAccountControlSettings.exe	48
PID 2172 wrote to memory of 2020	2172	UserAccountControlSettings.exe	48
PID 2172 wrote to memory of 2020	2172	UserAccountControlSettings.exe	48

C:\Users\Admin\AppData\Local\Temp\541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe
    "C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe
      "C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe"
      4⤵
      Adds policy Run key to start application
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2172
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:537601 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2276
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:2372
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:2020
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /t /f /im "UserAccountControlSettings.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2820
      - C:\Windows\system32\taskkill.exe
        
        taskkill /t /f /im "UserAccountControlSettings.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /t /f /im "541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe" > NUL
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /t /f /im "541364a81cb365be420373fce3d1f19b_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1496
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2112

C:\Windows\system32\taskeng.exe
taskeng.exe {F61184C2-B62D-48CE-931B-913D81C0E4E7} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe
  C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2236
- C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe
  C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1340
- - C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe
    C:\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2772
  - - C:\Windows\SysWOW64\cmd.exe
      /d /c taskkill /t /f /im "" > NUL & ping -n 1 127.0.0.1 > NUL & del "" > NUL
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2432
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /t /f /im ""
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1056

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:1720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html

Filesize
12KB

MD5
d12788e560805a1c5295a01ea0baafbe

SHA1
9a2c5a1e41850e1a8f3d489276b31e89f10ecdf3

SHA256
78ce88673dfa681a0938ba1a97d3db679b279addecb8684b0370fd023d29d672

SHA512
59f2b48a7c7c3f48f11e59d6f73669cb38561d5d98b4c89bd532960789c7813026ba696d6ecde48693f668e4ed9d21766956ecedc9b115b9d6081469438c44ab

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
3a73048fe18698afd17c58cbf67fb1fc

SHA1
fa2ac8b44d05b667d3ecae5759a85a2bad3817b2

SHA256
57a6177e502a025f1df08d0f304f145fd8b08a00ae878ba696ada53f1d1a38b5

SHA512
079809f119812941ed8fee34fb2bed7b8a2650964dd20f7d7cbc8cf298ba851eaba43afccc47ba1c5df758217da3a840793f5ab9d3190fd986187f2294fd2a12

Download Submit
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.url

Filesize
90B

MD5
e5db65a9a24ba65a95c1afe56975996f

SHA1
ec203c8c15f5874deede0e75eb57e79ad0c9fd9c

SHA256
f10d5bd29b64da209e8dffd4bb28d366b89f99ed867d18e72b047ed20b8032ce

SHA512
8b1fcfd2cd67d7f752d968227ab1d49e0981047598996a6a1e831609cda29b6933331b1db07e6ed583b0d7235457c0420ce18f6d9fa1ce0e624b42b2f364c928

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbs

Filesize
231B

MD5
9d8c4bfbd009c4d6001e2125abaa8b02

SHA1
cd040558172b5fca5b200447a281843956243741

SHA256
a652297987f14317100f8c5f7eb26d1bc67eb8a64f0b39b72b5fd5046a9f29b0

SHA512
c4c84f43642b805a105acce9ebc9f01aa0e6ef553ea32be3f8b890fc7440f0b7d3ddf99b9336bce20ce7a3d9b9f6434a704651a8af425ffc8407ba39d5de735f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
606ea73c0571cc208fa678d65a648a5b

SHA1
fbea3472cfa95576c1b5d1f4f6b0932b592b945d

SHA256
cc360cb6f780caaaee7216dd1f9df679df9c18b76aed7c273ee6171a17d171c5

SHA512
4efa89da3801dcf96bae698d4b8c127fb937fe001e0b564dcad0834ec4be75870f58a147f69cf03577203b11692f950b33ce5eb9d89da206c037e5aecc4d368c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7d61895685fcf7118235f05476cc263

SHA1
1d02cf316988d2ef0e95e57d8d6cbec4697d6121

SHA256
89fbf8a65cce029d9dd18ce69a52620157cc125dfefc545fb6868c02e40c7318

SHA512
13417012a3e51eb8a6b22c603a6b748877068585e11b0cf94e48991b19f4420cec70654d33bb291c6c4c4935089bdce2f56ac7b45c873afdea95d78ce8fae582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
102ceabca04a7c8ffc71ba3b0407d16a

SHA1
26640d5e65b084b4429d8eb30b78e8ede967a7d9

SHA256
d4b499df25980cf92e554da95fb664c4e2a191d48ea9e7f8f823e60981afeaba

SHA512
06e51959ad129781b529790468d9fec68d781202d65e90f89281ebdbeae5647291004b3fe427613b1582624ff887f97f21a2b263dfd86af0fa20fe2f37b5a60b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18d4f753dc91453412aa0fb19695ef82

SHA1
4078f91df293937a290dce508ec2c9cf4a438803

SHA256
c84cf2ca6688e803c8ecafb5d21f5a983ea02af19eebd6f541de7819a6fa6321

SHA512
31c6b3e91553b51cd3adaf6aac1f9b1553bf298ab21de56dc55d1c3ff730de3cca36b6fd345459c36aecb85a9af456111cb1ecae4cc65673d4473a162f2a464e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
214a7a8f86514876fa3759700f770559

SHA1
1463ce15b082022d8021474f5762da31dbc62c11

SHA256
6a2416e173d30539ccc5cb9e50f26a853ae791c8dbd4b72f55f70fdcf25c4b4a

SHA512
941d72482d13da577496992be33fd78352ec3ccfe01123ad2ad2757a1a18024976677bf12b9d6ce40b0a4323566866be43f3bb8436f8cb883efdc09d5c9edf29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67a68dfde70892d560167d184727c266

SHA1
0d845e2f28435990f6cfa7e1e2f49b88dd8d9953

SHA256
93299a0db936e8b1581de0c43c1b9b719bf1817ad76a7d1dff15fd9dada5e4d0

SHA512
c2a6423232e8aa336e09328145b63f43a6f012dbf1c65e7be1b00279f5911771e601c159c74af892ad5ec8100a6b7e95de8b5ad4ae20fb9f692cf3e9bf73b0a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
758237d20c92367bb6747192f055d482

SHA1
5da830dce84597f2ea00bc88c7d5a7c8c1d55c44

SHA256
53bef443d747e1cd6af2d788b0748b14aa5cccb527c650adc61c25bd2736170f

SHA512
6381787f25ed724b9ffc671c45d0e6140e05a802011d95b8575a9e93e2432285b96f603bda3e4d287720645dacb4e156d984235ad5b54c77112fc254a7cbf655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d9b2521da763b9f252fcf3f7052a757

SHA1
18208c2c1743de100a8afb0e700a2a0166654381

SHA256
e1f5fdbd2b8ab785fcb96bd624e36aa9d8dea507cad02af96f6e6ff2244e7919

SHA512
b5dccdd8349b15fa62f81d155e8a024098f427f3bb5f07606f47b6c80d1a7a0b358e8761920ea2c3d52332d3ea00c4a155cdc1218ebbc5fd80c5e5c0dd7e8c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9d4616a16f9491ecd0766f06828555f

SHA1
429cce37ac16bbdc4532a42eb75c4bef440cf68f

SHA256
ed3d864d20334e51726a2051e9661ff9584ffd6ef3078f7eaf300f88bdad9f82

SHA512
35830c1e866b84001b5eda0ea7bf04b7ea876959ce7b8352fc8c673d068922f118a4f8ffe240841ae848491bfad9db406083eefb26fc781d395ac8f3db0e4bb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b11ff2e6b03cc42d81c35c5e87ecfd33

SHA1
068685907bed75c0ea388d3af4aa01ab523a3bb9

SHA256
9c1e0db90a5156f4a265d6b462b78e9c25c45a2ae52275296a73633b51fc29e4

SHA512
624f15e8127979a7c415eebcb65373ba7323af4f2fe220627825a1e428ae60b35ae0ed40710caaa7fc0e8219d6773cf7d992e78e8b5d0892ff0850ea3bea401d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab5bad128950270f7691f638e543b422

SHA1
eea349ac3e67e21875fb675817df0c0233d1850e

SHA256
4aa114eef8068cabe3c19439dfd9389f490ac90617dfa0c242f56f4176032cbd

SHA512
de97b18c110756be2b7cfef7a2a6467638ea6d3a5d3554255957b7b378404c8c79d67ec321befffc12d7d555101b621b90dc18597cc7c2b1e347bd634945c55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29f366d3578965da66903a59d8b8ab47

SHA1
1591bab9927d1376580e8e1ba9dae9ce6fe638e7

SHA256
605ad776f0eeb299045f77ed2a6ce59f3eb41e3551c771c6e120f7f1524a915f

SHA512
1f4815bbde792aacd308d922c85683c2f5e344681d11fca1ff75f0066ec99884c7a4e433b5defd26387663aa07e2032cdfbadce7f42fe8664de362f34d859ac8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ff297ccdb049939107503aa02b530ab

SHA1
65bb1f18f915424074159f9cd424d13a3d27a1d5

SHA256
3100ab4cfeb9020cbda3219cf3463ff8ee1f31535d4d320966b40bb105a5207f

SHA512
22a053074e0c658d3a837e8cd68e3c0ac3edea5bc56f1d11f921016dd31f0573430dee43d3818b27bf6425045fc189d7ec490a8c06adc09cacc3deb93d66effb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c26a80878ce3dd6a06f74197066250c

SHA1
5757702c372f0ed9db94f4a97b4e5344a080eb4d

SHA256
c2460cf3c0dca3f48eb4a0d85833572c84122523e4766ae6d7e25c343972e5d1

SHA512
2494d5ea642b1575ac052901407f5f57080bb624813ea1dd3313926c54c7236ffde44077a9954deb8764f97fdee2b449b1b7fbc246e1907ec1b74fe20ae36917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2f65bb2fc1c236103662f3adbcef0d1

SHA1
a4a3baa98f24b12414a51027a96831936759dbc9

SHA256
f63360ee414ef81f8d4a99d375ab356cda5e60033cd347c401afb39443b0ca50

SHA512
41b4d668236e171ee60a8fd74b406509b3b60f49b65e8c7ad80e131bfdd3e9ac8b2ec253e358c6d7d05ff8637b612f57e69297ace18098289b6321df1611caf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b778e249eacf8c14585fb3ed3dac08e9

SHA1
490cbfc4d35784486893226992955e18e5d8b944

SHA256
7a2c3304f0331dbb982cab37dc14e98a903e020dc88c6f8410e7620a2946669b

SHA512
f63eed0a8edf4bda8f1e08b2e44583ce320e74a494be585de29334b4c3a2409dbc259a6c4ae54ba29068983268f689eaa874d5837558f0178178f3f84f1d26f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a100df4e6797f382df0984689d68940b

SHA1
db29511bc357e7c265dbdfc08d6b9adb7f7133fa

SHA256
1252072d0917594fc9b45e24ef9ac9aaef6df5e71b25497fb468509955ab2fad

SHA512
5f2b4b24262ac0f6090607a82eadd770efa54f4bb7b064decdbbae0648758b8c5cd8f6c60718e182a88a7f81293fa4f69e29fe5267ec73aed598c3d146e25b7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
956d3b859a48901c4b3079a93aa44281

SHA1
05a851a8b073aaf8d7da4f0f09943d01e97d02e6

SHA256
5a54d72e6761fc5d006e3d0e27288f6f1cd6394073c4e2e6a112d7801dede57c

SHA512
79055d57d3e57ac3cd779245c5dae14e5a8666a2e5a73a0c8e4875c985efe4ca40c176e46c706984c47af53a88ee072b272a9890b6a8a2bedf425f80c52a329c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3d4ae9e894a3369fa11fd8a6fc19cbc

SHA1
388fc470804423f9c9ba2314184972cd8b330031

SHA256
811ba2084bd56e5d6f49f604c646c9fac3ac8b26599b689039b6eb3671374f56

SHA512
9cb4e849970d568732e64391517d8e0243a51f17efd50c04de6d4657608d68abb54ecb339152f56ade74dd0f37fcc743b9c3a426d78da29194f8bb91d7804a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD84.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE23.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\24.svg

Filesize
1KB

MD5
c971329597cf88d8b5e87cf5557067d4

SHA1
7fc2be6bf2920d5d34c3bd7318288c4aa12c6c88

SHA256
e1fda58d0d4eeb62eb790f7e23594eac460db03a2d2373bfd13e94860dcf38b7

SHA512
045b48c780d3482bee79cecb372f36cb1e705eeda37c6130dd12dbd432bce1fcf04a9b3c68618a9c9995c29c7f93314cd8d2fc6f6c6d44ac150c556926307577

Download Submit
C:\Users\Admin\AppData\Roaming\24.svg

Filesize
1KB

MD5
9daf50b43c9481a9fbe0e30cb77791d5

SHA1
fe90cba11921809d116fb80196978d6e6a45d267

SHA256
1865a2c1705d62d6e87abced8bd3bc5870e5d6826352310638dfdd1409968c04

SHA512
0f1150256a39a231c102ad44b12d443604c25be6eaa34bdd16a862a329e412e8b3848db6f790b4f7c3f53f0ce53bb6fc600664c33965424f6141f544b882f324

Download Submit
C:\Users\Admin\AppData\Roaming\404-4.htm

Filesize
1KB

MD5
47b31ceaa4ee437bcb996584938f55ca

SHA1
00a04f6b1d3a6efcd1c2e24898d08e20c5ceee64

SHA256
c24863f16c118fba14e5cff2beaad3f9bd0017d3f55800837398d5518534207a

SHA512
2add86690e8aff4e905d4c09816fdb1b084c3d69bbdb5a0da347de625c55f11dc12e719c841d6aabbb7e0350170077a628b577aa1aa569b39b4764143cd0627e

Download Submit
C:\Users\Admin\AppData\Roaming\424 bl 3.ADO

Filesize
524B

MD5
4121e8d21f41488b3dde298a32bbea29

SHA1
0f712ecdd7d3668eacff50e3f762aeeb447dbe7b

SHA256
7a4a91cd7b014b48d0abdba2d135ae616dd8169c2e17c05d5fc9bd2319db2890

SHA512
06bfaf1df5e2e804721d9479b8534d49ac9f2621f63e8605da7e3522c8d28ee57b64dec682152f3fe54590f2135298c926d854f1db4feecbf43a5e380505bedd

Download Submit
C:\Users\Admin\AppData\Roaming\5.gif

Filesize
916B

MD5
57a1015fc0f2197730779325a0e5e018

SHA1
af8204e4614fb54cc190a3733df768e18dbd88f6

SHA256
1a0c9dfa249f991788ac49f385fe764d55f645836d5d9394489c0ec66d0cff61

SHA512
26bd5124f7a61353e4f2cb1644c2c9b3d71e2f43930d932e4737066b8a5ab6976de9ae7ea91aeeb4369689cfb722c7262423d63ec4443f2429481155017961c7

Download Submit
C:\Users\Admin\AppData\Roaming\5.gif

Filesize
1KB

MD5
a9df81eb92389517ce63777b7b9a3662

SHA1
7f7508ba5d439ee4a224c0a3887220ad1956443b

SHA256
e150a3fbe37e214e3b095a42720e9c91ddbce8ac1c19ad43b90011d20cafbd5d

SHA512
2482b8eb740489f428f5fb6ac8d8cd8b2ad22ed39950fc1b2c870c0afe3a9205108eb20d0cfc7ec50759aa435ead4dd617b3cfb9a61ee6afcebaa20b21968726

Download Submit
C:\Users\Admin\AppData\Roaming\500-16.htm

Filesize
1KB

MD5
d197ae42c2d6b6671966207673de5978

SHA1
6572b6bc1ce60218761e40a6fbc019f02ef0e655

SHA256
9967682b72536a8b3af2856b07b1a62a6e81903d10798ccd811eb1738578607e

SHA512
16ab22cdac7dcd593a749c3c4be2a889ec4605d9a99c9dc42f16023e0f9b778f08d3d07ec33fcd2333dc6063280f2016b92affbd26035e020697b6088ff6ad13

Download Submit
C:\Users\Admin\AppData\Roaming\6.png

Filesize
727B

MD5
0660ae4c005309abe25e7b6c3a021617

SHA1
a7cea542638dac21ff9c8834a9c7d6a3da18f323

SHA256
12dc18d7187464a428a871e99400390a27eeb3c4ce72bd1f2e92f04363c0224c

SHA512
1f8215a2c9961b7a0d4819b735bded8e9bdef0e70aae72c6e43f3cf318529c59cf6bf8e242ab04745320808ae44adfed66af250848a5ce2a25e98cc8b785f5e3

Download Submit
C:\Users\Admin\AppData\Roaming\6.png

Filesize
355B

MD5
f64cfcfac0c4219edebc96d6d043c84c

SHA1
4cb3f1439c17e8a276b93dae2026b0baa5547524

SHA256
50ee85e5bf9f7dd02ae5435ef0a024e9a8e3da48c645adb6b3fefa1e08f7d57e

SHA512
b6d2f1e612c1cc1b7b1c85704d6645b10cad9c417b2a4b1e56d62b768088827d25816cfe3c442ce370b669cae25ec3495312d09f1960fdbeabaf37af09762abc

Download Submit
C:\Users\Admin\AppData\Roaming\90msp-RKSJ-V

Filesize
4KB

MD5
2ffc46a244c8c828e352ff00ecd1998d

SHA1
027361be101f81885d640bdc37f1d570ae7641ae

SHA256
0bbdb01bac6545d87b2dc2fe5d198ff8120ef7c642a11b554a66bfe0a34e7a17

SHA512
d09fef8fcb254157faef211e2133184f8e6d1e4a33b0074b74fd762c8f4b1881ef1af2b839a1df9cb427c774a3be9f94f12faa7a8f25002d6b1c292f73e6657e

Download Submit
C:\Users\Admin\AppData\Roaming\Adak

Filesize
1KB

MD5
f87cdb72f8a2c9db4cfa4d46b68df843

SHA1
94fb29845e1aa22d72d93e99293b237bcbf176ad

SHA256
b4cd5fe34e86bd59710379115fc9a9b670f1f6a885f9f2c1d87f94ee90aae680

SHA512
0135ff0838bed406025d4b1ae9a95e5f196e06f95fffb0093afeee7b37af2a0cad2cda38033d3fe7d80c8a3b9142758b8fa43f74bd6f7bea5da09d8924e1b192

Download Submit
C:\Users\Admin\AppData\Roaming\Chamfron.e

Filesize
125KB

MD5
514647032a4e7c2dd7767bc17e2bf753

SHA1
5a6f0af0725a28d1698ad4499643e9621e6dc045

SHA256
aa7a5eb67942d2640114a23047836586a291373d2dbf6918e2739b067303179b

SHA512
f8f1afd76c60fe9ba850fdd41aa8fcb4252f44ed0e595fa575e115273b38de81e2676dc0f209ceb122bb4f49b9836039cb9a742603af8a34e09182f8e04f4249

Download Submit
C:\Users\Admin\AppData\Roaming\DAN.zdct

Filesize
1KB

MD5
bfc5c224f5c267bbb9a1ea11a4d8197a

SHA1
e032709043025dc40f4021c4f55ea39503bcfb21

SHA256
21b860d7220947839e49cccbce63b1c43fb02d1a2eacce0fbf389fab35ea128a

SHA512
d85523232f4a3107608cb8968f1590aec742500053a33b8afe4139ad535ffcbd215fd8f4633ac36ad172d687fcf5b1c9b1005c6c2f6c402ca810988459ac0aa6

Download Submit
C:\Users\Admin\AppData\Roaming\ExampleFO2PDFUsingSAXParser.java

Filesize
4KB

MD5
7f9e18fb070fbc43175fcdaacaa674bd

SHA1
455318deab797c8110dad52fd5940865fc70a548

SHA256
204e41af4678e3ccca8dd8e36c3812f80dccbab4185d121cd4b411cd0364bb8b

SHA512
05635cb8710feb946f60cf758d9e027729d4345e4287c98dc283eca2a7efbd24214fbf4952968def90163f67c89b97dd961b3f65f8b5fa3de7d625341b356ee5

Download Submit
C:\Users\Admin\AppData\Roaming\FRA.zdct

Filesize
1KB

MD5
9c691a3a9fb21b771929aae6aaf99b15

SHA1
2ab032406fe583c46b3c96bfd71415d9ebae9c86

SHA256
166422d5c106b2ebf780eab872379b2d0e69f3fe7471acec9c73226401885777

SHA512
076adb358fcd8394c94b8bc0ba939f6f568160c956857e73a7e585ef55e1cfbb05f4d780fcfa46a7683b99b3b00053844ef40de966ff899bc0cdd6daec58a96a

Download Submit
C:\Users\Admin\AppData\Roaming\GIF 32 No Dither.irs

Filesize
1KB

MD5
b37db354d10a73ba88288164bb13182c

SHA1
3649f45a56cf71a0cb551315372546700cd96a0d

SHA256
9840c3e72436433614eab701e18e61f0ce0ab924a9491629463c949186dace4b

SHA512
8afe3071ba61ed20c2034c7501d8953a5a7d313bf4acc1a69f50f369296ad4e34df895c039eadf97afd543b4c4dc27e2d0532705121158ceb2a186725ba76bca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\UserAccountControlSettings.lnk

Filesize
1KB

MD5
34e573e8e99f1822e91e34b69afab524

SHA1
de191960d6f0c013939ea8d9f4437adc831e183a

SHA256
7588f51c4bc8483391579e3e7da0385924da1d828e75246d5fa020295adb1f8c

SHA512
b34e5be7a9fc0dd5244d3ce49b71f9b4cf959bb3b0f540d411801fea7124d55e7d4fd1e2489afd1accbe59b65468eeb68b231cac8413b0312f774ba2295a8991

Download Submit
C:\Users\Admin\AppData\Roaming\TuracoMaestoso.n

Filesize
2KB

MD5
6777f37b4b47394a3b0e3c61b9e82736

SHA1
1612fde4b33547c53aeffa10a22a7155f23bc789

SHA256
e85ae8f05a52e8f1ab828f201a682d5653845c72b9060a5b0ed89a1b06e4c15e

SHA512
9c8c417c77ccbeb9434cc1d85ff3464b5daf17683611e44cb1def10bb89aba8dd9d35b1058e423afb58517a1102c200f33907ad1d7f031826c94dac53f5a4b4a

Download Submit
C:\Users\Admin\AppData\Roaming\arbortext.extensions.xml

Filesize
1KB

MD5
b7a3d5891858ec987692f843d0da635e

SHA1
144dfcf7282b499e4b07b3b4ae10bbb5dc23e08c

SHA256
a021af7e7c49f2c338f12e715d4e2f853f4f53327dadb73b11d089fb43bf6a85

SHA512
c7bb9f9f0cec125ae61617bc2b6ce1b449b736d7bf5d776605d830a4a2e2e9b7957de4b1d146faa403e169052eb54af00f551e392bdc286c190e62df3df3f7f6

Download Submit
C:\Users\Admin\AppData\Roaming\arbortext.extensions.xml

Filesize
1KB

MD5
10444ab4bd31419fe88bf49830ae2b15

SHA1
ebbbd4497377f6650a00ed009cfca77eceb5a4c4

SHA256
5526566d827dde401ed86bc3fca3759616626edac46152556c7ebabc1abfb6d5

SHA512
d562ec53934be093c425bafb2b1fa3e17b2a8360d5903e6fba91f1708eecee5aa9db76abc8c1c8cfd8fe05d2eedd884cc8fb89df35b80b679e7f70ba213e07bd

Download Submit
C:\Users\Admin\AppData\Roaming\article.appendix.title.properties.xml

Filesize
1KB

MD5
adb1a285a2b926f98c062fbb74e1e992

SHA1
1f9799a61072673042a1a3da0fdf3fa93cf10f90

SHA256
4ba4637bffa741ba5619c3de97b6c209b5a9deb330385efc7a588492a98b7b45

SHA512
aa65628e34601645dfcdcb1f5f0347ae84555bd1a99432d4c25a50044dae932385bfa1f50551f6577d184de684f9264743facb53f4aa2e46bdfeff5c85bc6bd7

Download Submit
C:\Users\Admin\AppData\Roaming\article.appendix.title.properties.xml

Filesize
1KB

MD5
d9c90dbe1f927b0baf97f274ed950a82

SHA1
acbd1137e63a2b82dc4eb5cdc365e5891399af74

SHA256
142a6367e72d950b9901baa0ec939b093b47f8c2e14088ab6d2fb4803c3406b3

SHA512
ccd94af7f2e205a5599f6ae6fa96cc6bab7cfd1684eedaf0a36daf678e671b1f57174c82f585868b384bd1454e08bd0852719950d19dd28bdf4551d35a25ce3d

Download Submit
C:\Users\Admin\AppData\Roaming\axf.xsl

Filesize
3KB

MD5
3e6bfa45474395fcab8c295d63fe0ca1

SHA1
532af3f2b90b3b1cbc7fd7401777ae271aff5f74

SHA256
973a3d4fd3db35ef04dcd3b99176f9df936f4729b1880c189f39507e97ba8732

SHA512
058551c718aeff1749dbac4a6d02ff540a8e29c13a9b15ddaaae64afad0fc78b4a91805a69aa210b7c3f14df31ecf539b866fea276bad9dfb2a05a06c702c653

Download Submit
C:\Users\Admin\AppData\Roaming\bridgehead.in.toc.xml

Filesize
1KB

MD5
f83b03661f9ad653468b8ca830f7b594

SHA1
71b1d0c296466c9cc9f3c8d5d91fe353ae97de7d

SHA256
591720b1fa26e16ceb863bee7cb758f3f91183aaef26ffd15fc7a20b35ce8d45

SHA512
b3510966e4d4913257d3312a1943e47d408e467c003964ec7c818403f26a929449af56add595bd8d961453d71bfc7cc3329a7e9dd39be0e30447a60114e68525

Download Submit
C:\Users\Admin\AppData\Roaming\bridgehead.in.toc.xml

Filesize
1004B

MD5
c1cf25885988504b0f6f90f1cb545382

SHA1
5e1f1c88ab034e14dd6f3aeb9da857f5815b4c6e

SHA256
7808de9b4c36f737a88e309454101d3655597393323cafcf87d42e4411baa7b0

SHA512
7adf12507347a9dbc84c93bc38a14c3dd42ba1e2c2f0f937b0915066d437288103b831b33f5dd99ea252a9f2a0a1e6eaf6289cccb04090b8a20ae00cd652660a

Download Submit
C:\Users\Admin\AppData\Roaming\bt_unselected.png

Filesize
2KB

MD5
4693d1d384d0fd3d7f6b0ccb7ac9157c

SHA1
fe9c9a0f48615d75ebe3ab0743b23f7dbd08b323

SHA256
e520e2b3ba4d8280678f73602ee4221b51782aad62ab25db1eac991de31a609a

SHA512
f7290000696d12b1c0f19b907a9d5f15545ee96d8936689427f84ec8a03c1af7aa0eab829badcbb0c6644ed3847e686b7dfcf3513bb3eb6dc27bf0378315c0d5

Download Submit
C:\Users\Admin\AppData\Roaming\caution.tif

Filesize
1KB

MD5
c758bc300dbae3b2ba2ffb06b62d11de

SHA1
db8ceb49d310d2d91f50adead7c4b17e9f90cb6a

SHA256
4b2978dfb4662e49ef227bd1bac21edc4daacc373c421868d2a0f0b882cc47fc

SHA512
40bb4ddbb57fc743e9569b85a06a7c82328d7719efdfc2ccd891160a6d4e2ea7a4c36c67c50244435948faa79ce1c212d8c7eb490e8633815841d137d74fd5f9

Download Submit
C:\Users\Admin\AppData\Roaming\chunker.output.doctype-system.xml

Filesize
1KB

MD5
e930bf24883de57b28a31a733d618645

SHA1
416f7f4e017f619d1ac89a34c1e34a5baad73c56

SHA256
2f3ce5515bead08015d327ba391060bd70614aea8b8c4325470723f824d51a21

SHA512
cfe4c11334a627ba2a5a022bf669a78df88ef9e641596bd7cac6fc590da62490e90f9ff3b1f06a169684820406e452f12be420b13de1b093ff1dd73abaee6b3a

Download Submit
C:\Users\Admin\AppData\Roaming\circle_yellow.png

Filesize
3KB

MD5
b27438aa347f1bc4c68d91bdf2f25a94

SHA1
781bfcf9cc215a641fc3d93b686c37770c2eba15

SHA256
0a2cc44a45e3057335b421f7b0b80bdbbd1578cf38229f43fe56ae1f4d8d6e15

SHA512
e95b5974a5d09e49835a6ffb2733d6a72e8ba06ea4e28aab53c60b00b423133d2b31e645104708b35c049be04d0b7cc9b60435c1ceac83791d6fd153c4524674

Download Submit
C:\Users\Admin\AppData\Roaming\circle_yellow.png

Filesize
4KB

MD5
609ece8785bfb00bcdbfef246b7932db

SHA1
d987409ffc5f1f00ed8adff58d9405e8a4dce658

SHA256
980e6cf2e4deeb6a5a80c0872125b2f42f5dcb9d0a649a0513681d610a7ba694

SHA512
39a5ae8da1dfcc8306011804ee298ad047ee42e5439ac4e76dd53cde8045c2e2193dc6358ba6ef67dced0019778dccaf52a532822becf6a0c5ff6d70b89b59e7

Download Submit
C:\Users\Admin\AppData\Roaming\close_button.png

Filesize
3KB

MD5
f7175f00793a0b7ceb2ed58c4a746c3a

SHA1
28afdb7e48f93395c0a5d8859ef0b93e2469188e

SHA256
a7b5202a960ef8de6573cb10f0e8e365e1c3ecef63b02037a8fb754d3fcd93b0

SHA512
ad8fa912135b027c7ae52ab1d2a9f7a15dd146cee87e4fe7c1868e17b0a2d82a4d01bcf796a8aad8f76c98191630af02b30776ef71c0cf999f1af836c683ff34

Download Submit
C:\Users\Admin\AppData\Roaming\completeTest.png

Filesize
4KB

MD5
79925c43e010b7f773242b65c66296fc

SHA1
677ec09693b2071537aba4c4eb4c14b7504b0c06

SHA256
dac58e21fdfa2e80b413338245985103899adb9f337c602fc77d15fcea550c52

SHA512
cd3aadfc1375d5a54f8bdb3caa68128d22ab66726450fb4eb9ba73e1098d29d0179d6256cde168391e9ca32e44abc4e3e1470bfb2f6139ce5182480defafd91d

Download Submit
C:\Users\Admin\AppData\Roaming\css.stylesheet.dir.xml

Filesize
1KB

MD5
c29954f6f6a53c37aeb7ad23e37ff73b

SHA1
068a87dbd5d5277f0508845838644bd5cb933e9b

SHA256
045323cff6bd1afd75cd8fdb8c7f65569370fcbf6dcbbbc0e24f4c6d5754c45b

SHA512
1760bf9610ae6433b395f2345cf56a06617c64002e3883531e6854b468b2026982883a1a89b33907be3befbb8353aca650a6fbfb42bb543d0c24f2a9416bce35

Download Submit
C:\Users\Admin\AppData\Roaming\css.stylesheet.dir.xml

Filesize
1KB

MD5
2d917ec5e7f78d9682acad79e3bcab6f

SHA1
3ec65e465ff81dfb2383d2e8343a2c971f644b33

SHA256
b28c92e934023af34acf714bdd4c00acc0c9f252b4bad8e914516ff930011d58

SHA512
04b621b7fda48c92e52b3a1877d87a43902278f4ca190322f9a802c65a1c8e593e1f7f7b4295b8192119701e60392210798cec47961bf172c9dae75577d7f565

Download Submit
C:\Users\Admin\AppData\Roaming\cze.fca

Filesize
736B

MD5
88d6f04b392d967599688ee82f343789

SHA1
91818d228042915f86ac8fd846f24a807dbf54d9

SHA256
210e911f0bf21a4edd3cff6e5d3c27bd225621efaf9015ed6d82c8b6fca1c18a

SHA512
a43e762de9c9514d9f3253e1d15d563382c7c39cd61a9c45611288cc53c72b7611976a836e546e26ffbfd891361ac87a787b273a526df12b649dbbd6d65d193f

Download Submit
C:\Users\Admin\AppData\Roaming\diagnostics_pass.png

Filesize
1KB

MD5
50fbb1df4735fde6da6e5c34160da040

SHA1
fb6fc004d59888aaeaa46ab2998c44e8ce02bfb0

SHA256
22600b806af90198ef67933873413cca2d37a724535f04550d862564fd3f5e2c

SHA512
7bacca1e1545d0191da0f9c4e062ce4d83b10c3ff5658bc07631b44c6b2686e8c719bb072dd48d95f328e67cab25d96388e2e414fef1d5205b36d151b6aa2d83

Download Submit
C:\Users\Admin\AppData\Roaming\divide.js

Filesize
167B

MD5
13194de77e275fe71787174454c05075

SHA1
93b61619180fff398e48e352f5731cb71bf88eeb

SHA256
027981c44bb087ccdd6d77f49fc930ca697dae46ed13b39b2a76d67ab8e09b62

SHA512
69ecabf405511caca1e54a3fabc024abdb0be0dfbbf25d817bc539fb65cfc298466c033c2362db811e2272ffb48e68f720c056524a9713407fbf873841175b92

Download Submit
C:\Users\Admin\AppData\Roaming\dotted.js

Filesize
457B

MD5
f06efba39e83f2a70a0328784e1fab8e

SHA1
eac0d7b5a5b790aaa612e0424b72abfda6f1d70e

SHA256
2414dacd7ad46180e10eff934be18688069461be00f83cb9e6fdb84f677d7984

SHA512
943530b778ed16287a65c5f67e183b23b0ab7d9be04dddd693756999182bf9a2f36944e3c9ba0e7ec58ebf668adbe39ca399c688dab2fa20437de0ffa298a115

Download Submit
C:\Users\Admin\AppData\Roaming\down_arrow.gif

Filesize
865B

MD5
8ecfebfbb98d6839606185ab43b12e46

SHA1
f146f2c17599cf17b98eebead3d7207c3de6c02b

SHA256
b40705c3a3a6b1ec1fd376811e31c6eceec3028ee2bd8e8d9b793c9ad6dafcb9

SHA512
f3f1deedb32a51263dd42a54e9d7be2b1af4c18a647d4a9b12409fe695d3388628d55d13af60c2ad602f7af473e1c909214229cf1c18277eac46ec178cc1391f

Download Submit
C:\Users\Admin\AppData\Roaming\download_3.ico

Filesize
2KB

MD5
78174a09c800b5fa05ced6cc5e2c5e24

SHA1
f52253b99e621d66aaae55e3a54bf12b4dd2f612

SHA256
d0473db04aabf9a77f7f5a7937f2ab66356621a73448d2f88aa3415dbeb62b6c

SHA512
d51fbbc9c0cecc520128c632f1685f05ee6aba77a7db3ffd9ef3faea68d519a06883a293f4806efcb5a96af126710ed738bd52194a03aba22c211d7d1b093484

Download Submit
C:\Users\Admin\AppData\Roaming\eamonm.inf

Filesize
2KB

MD5
e8d4282400a1c4709ecb37b933269a98

SHA1
dc9febbb99924c761c77bf69286241efaa803f38

SHA256
cb1765e39a9bfde57e60683657257cdae7c84c88d55be43524168a4010be701e

SHA512
f51e18f1705fa4bcb5bd7f072095ee4f9c37ed1503b038854a4a147344f08deda036e000ac4bcfbbe4d688bc238434d18dea75db645c7648ca63e8c00a6b11ec

Download Submit
C:\Users\Admin\AppData\Roaming\eventViewer.png

Filesize
1KB

MD5
748a5a7a333b6d7391c8424ec2ba7179

SHA1
58ced520776c3c168eff998279262acbea2060a4

SHA256
3d13aee8c13d1f3a1fe13311ee046bc95658aed8408a04004de290c9c351fc94

SHA512
b1273da7adeeeba9e8d992d690411b89eecde98521c62e91e1c2628c0c11d777ff1ae82fd6f9174cf27b6699893b29e72eb33856171034ec2015125e1ed99612

Download Submit
C:\Users\Admin\AppData\Roaming\flash.icon2.ico

Filesize
2KB

MD5
6995fc85569b51656600bafe2d328769

SHA1
f723b92c6ad790ef993afa40c9f4289e7b4c5291

SHA256
34845298147e26a7cdd09f98a895b27a082b4340b1980a9a23a1a858e89c4ce8

SHA512
de5f358bb1bb42e3ad6d691bfe0451268cb972872499c4abdd00b2a8728e73ad9e6500e47d92328d8ce05acb2d1f6a5a80ea65e9020145a301aa08bf2d6819d3

Download Submit
C:\Users\Admin\AppData\Roaming\folder.png

Filesize
3KB

MD5
537b6afacada7212e1fe3a2a18e6fc8a

SHA1
444e48a91d3203d54d2e80c39275430ea90600b4

SHA256
a1a288b69d74311b4ac05e091211233dc801781a8dfa4c6e2f7dae20d513287f

SHA512
41a1c4a96ffa32c0426b107874788c81a9513ff83f42290598a6e04d18d8333f0b8b3c5975e6835a7c1dffa37e8a97e7200c1cf90bf73dff1f38b2779684dda4

Download Submit
C:\Users\Admin\AppData\Roaming\g3_4 x 6 in 300 dpi.IMZ

Filesize
46B

MD5
cd1189f6747a3d39a55c8161d9d5359e

SHA1
f8591dfaa1f090d94b925a59bec4dbc5ea13eba7

SHA256
91236620f96688bec91ed6d98f2372ffea9038007e7ae42089970b87b637f5a1

SHA512
6baaedffb6ff818b59259871181e058604d2d576d5fdf39243952503a0fb08fca1fa47ba3a73163c5b2ecb76be80cadfe8cb2d5510a5e1ccf76f86d921276c06

Download Submit
C:\Users\Admin\AppData\Roaming\generate.section.toc.level.xml

Filesize
1KB

MD5
53d3ecb0cd2596cd97a49d498225b9eb

SHA1
bdb84142b64b2ef9454a08ffb8207b2d2098234c

SHA256
aebbf7076b60c077fdca77deb28a6ffb8524b8fedcae93d3b155f54dee9289d2

SHA512
9904015f0c9bf8e38294eb4a8c40e9ff867bfdd28980c95e164fb179b69a326dc6378d9a5cdd5efc6e58b966db7263775a31cac64f93979c71aca8c912fffe50

Download Submit
C:\Users\Admin\AppData\Roaming\getDocumentInfo.jsx

Filesize
1KB

MD5
b9c8db5dd26818a63fb9e031739f8fab

SHA1
0237909e0b39d6826bada9b63a811925719ddf51

SHA256
98cf791cd08a24c5ca85b59be971caf7776af6d31ac812e3bb949a20f7332ef8

SHA512
c02cb2275c8e0dba6e997fd04405d84aaeb65a3ea3be89d2632cf0a979fe888fee8d85f0068b807b017b1a52eeadd2dba6dc8fec36f95ee3078d5a2c1a8a3fe6

Download Submit
C:\Users\Admin\AppData\Roaming\glib.txt

Filesize
1KB

MD5
b36dea9e37a35611148b84e339b6ec42

SHA1
6fedb260507565077492a2c9bfc3843f08a3231e

SHA256
2ff797880e22505e09ddaa4d205ab5ce700c8d22631e80cc48434d56dc3cff70

SHA512
53ccc4827269d947a385dd27397934b3f33453df60288b03864c486463e1fd69f8a83c2bb3b917f1df1acaab8f0b1cdb959c8e4687835ebf903423e26c4583a8

Download Submit
C:\Users\Admin\AppData\Roaming\goURL_lr_photoshop_kr.csv

Filesize
315B

MD5
e7b835efd565a6bd02237591a64416fa

SHA1
7ea8027ff98e318758a48907a1f69b1b35f63c72

SHA256
67ca7823ea8b02127ea8e4c198585e8442530e7e803b2832666257c4050ad605

SHA512
911bd83c92eaa36464bcb00c45102bc1b5eacfc83cd8d7ccebf920874fd5156a975d1c0bcfe0d96ca0461ddb287f43c2c8204722d93c6f0ea8663d8f75e14f81

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBB75.tmp\System.dll

Filesize
11KB

MD5
ca332bb753b0775d5e806e236ddcec55

SHA1
f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f

SHA256
df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d

SHA512
2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00

Download Submit
\Users\Admin\AppData\Roaming\SFhelper.dll

Filesize
70KB

MD5
d9fb0839c496f06e824e3a5c41572462

SHA1
7978f5ac7ec69d8e33751f8009b37279db50e455

SHA256
55d7dac32b8533e26549f776bd3ca7c87b359fa7de9bfeee1222dec381a8d98c

SHA512
038c604625d6e08922b9befb412f0922de15c0e9cb5118b91419c03b10f727e91c06a0149a80e5acc5f3b976c3f807264d1e5bdfe5fe947962623d0256d731e4

Download Submit
\Users\Admin\AppData\Roaming\{DD459DAE-5E5E-3671-9AE2-982F791F22E2}\UserAccountControlSettings.exe

Filesize
280KB

MD5
541364a81cb365be420373fce3d1f19b

SHA1
fffb124ed79715769e61f793cd3b47458ab74293

SHA256
2a8285f324c9ad8dc54f190aa3627ac9bebd546173ed89d5ecd1ea7b65641c75

SHA512
c19e4d702ea3656b1f73ff263574459fc572f955dd7b492efe7f360659d93739334d669edaeeb15a0589490d67092087f7349bb964d426bc86ee412480a08732

Download Submit
memory/2172-194-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2172-359-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2172-187-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2172-697-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2172-191-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

Filesize
4KB

Download
memory/2172-197-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2172-195-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2172-196-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2172-193-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2172-189-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2172-188-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2316-47-0x0000000000370000-0x000000000038D000-memory.dmp

Filesize
116KB

Download
memory/2316-62-0x0000000000370000-0x000000000038D000-memory.dmp

Filesize
116KB

Download
memory/2776-67-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-80-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-51-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-59-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2776-61-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2776-53-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2812-184-0x0000000000330000-0x000000000034D000-memory.dmp

Filesize
116KB

Download
memory/2812-170-0x0000000000330000-0x000000000034D000-memory.dmp

Filesize
116KB

Download