3e7affe327ebbf84f56bccd753c86122e0a1f0e8bf941547bfbcec775ab3ab94

Analysis

max time kernel
144s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe
Size

608KB
MD5

6a1dd1d327f60aee8509df877c8dc38c
SHA1

a2246029749e47a2532b016f80f5132f431e712f
SHA256

3e7affe327ebbf84f56bccd753c86122e0a1f0e8bf941547bfbcec775ab3ab94
SHA512

c29b9159c1bcb40db1a29cb3d91fc46e5b633db5e09ef52e8996a1d0e9900c153e6b68a7da680747215dbf0b03d34a1259fd17b90da01ff7c45cf1c4abedeaf3
SSDEEP

12288:Ax5WAOBdN/sM6Bn6fKzh1N4mZSZjCQm+OHAp3T2FWdP8CQm+OHAp3T2F99V:OsAOBL/sM6Bn6fKzh1N4mZSbF3HdPmFe

Score

10^/10

defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\RECOVER+khowk.TXT

Ransom Note

__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/DB61BDA74E94356 2. http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/DB61BDA74E94356 3. http://nn54djhfnrnm4dnjnerfsd.replylaten.at/DB61BDA74E94356 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/DB61BDA74E94356 4. Follow the instructions on the site. !!! IMPORTANT INFORMATION: !!! Your personal pages: http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/DB61BDA74E94356 http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/DB61BDA74E94356 http://nn54djhfnrnm4dnjnerfsd.replylaten.at/DB61BDA74E94356 !!! Your personal page Tor-Browser: fwgrhsao3aoml7ej.onion/DB61BDA74E94356 !!! Your personal identification ID: DB61BDA74E94356

URLs

http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/DB61BDA74E94356

http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/DB61BDA74E94356

http://nn54djhfnrnm4dnjnerfsd.replylaten.at/DB61BDA74E94356

http://fwgrhsao3aoml7ej.onion/DB61BDA74E94356

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (875) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	obyjh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	omndmehoq.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	lxdjm.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RECOVER+khowk.PNG	omndmehoq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVER+khowk.PNG	omndmehoq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVER+khowk.HTM	omndmehoq.exe

Executes dropped EXE 4 IoCs

pid	Process
3516	omndmehoq.exe
4316	omndmehoq.exe
1976	obyjh.exe
4540	lxdjm.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\addon_v57 = "C:\\Windows\\omndmehoq.exe"	omndmehoq.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 3516 set thread context of 4316	3516	omndmehoq.exe	102

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeMediumTile.scale-200.png	omndmehoq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png	omndmehoq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-black_scale-100.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-100_contrast-white.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-72.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\JumpListSettings.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-40_altform-unplated_contrast-black.png	omndmehoq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-CN\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\jsaddins\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-400.png	omndmehoq.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-32_altform-unplated.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d11\RECOVER+khowk.PNG	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\RECOVER+khowk.PNG	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_06.jpg	omndmehoq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png	omndmehoq.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\RECOVER+khowk.PNG	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-100.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-125_contrast-white.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-unplated_contrast-black_devicefamily-colorfulunplated.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalMedTile.scale-125_contrast-black.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-125.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\SmallTile.scale-100_contrast-black.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\RECOVER+khowk.PNG	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\AppxMetadata\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	omndmehoq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-125.png	omndmehoq.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-32_contrast-black.png	omndmehoq.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\RECOVER+khowk.PNG	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\1.jpg	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-100.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-100.png	omndmehoq.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\RECOVER+khowk.TXT	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\TriPeaks.Large.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-125_contrast-white.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\RECOVER+khowk.HTM	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-200.png	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RECOVER+khowk.PNG	omndmehoq.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\RECOVER+khowk.PNG	omndmehoq.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\omndmehoq.exe	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe
File opened for modification	C:\Windows\omndmehoq.exe	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omndmehoq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	obyjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lxdjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omndmehoq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1704	vssadmin.exe
548	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	omndmehoq.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1628	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe
4316	omndmehoq.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe
Token: SeDebugPrivilege	4316	omndmehoq.exe
Token: SeBackupPrivilege	4080	vssvc.exe
Token: SeRestorePrivilege	4080	vssvc.exe
Token: SeAuditPrivilege	4080	vssvc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe
3516	omndmehoq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4040 wrote to memory of 4728	4040	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	96
PID 4728 wrote to memory of 3516	4728	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	97
PID 4728 wrote to memory of 3516	4728	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	97
PID 4728 wrote to memory of 3516	4728	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	97
PID 4728 wrote to memory of 884	4728	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	98
PID 4728 wrote to memory of 884	4728	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	98
PID 4728 wrote to memory of 884	4728	6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe	98
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 3516 wrote to memory of 4316	3516	omndmehoq.exe	102
PID 4316 wrote to memory of 1976	4316	omndmehoq.exe	103
PID 4316 wrote to memory of 1976	4316	omndmehoq.exe	103
PID 4316 wrote to memory of 1976	4316	omndmehoq.exe	103
PID 1976 wrote to memory of 1704	1976	obyjh.exe	104
PID 1976 wrote to memory of 1704	1976	obyjh.exe	104
PID 4316 wrote to memory of 1628	4316	omndmehoq.exe	117
PID 4316 wrote to memory of 1628	4316	omndmehoq.exe	117
PID 4316 wrote to memory of 1628	4316	omndmehoq.exe	117
PID 4316 wrote to memory of 4908	4316	omndmehoq.exe	118
PID 4316 wrote to memory of 4908	4316	omndmehoq.exe	118
PID 4908 wrote to memory of 3508	4908	msedge.exe	119
PID 4908 wrote to memory of 3508	4908	msedge.exe	119
PID 4316 wrote to memory of 4540	4316	omndmehoq.exe	120
PID 4316 wrote to memory of 4540	4316	omndmehoq.exe	120
PID 4316 wrote to memory of 4540	4316	omndmehoq.exe	120
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123
PID 4908 wrote to memory of 2420	4908	msedge.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Local\Temp\6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6a1dd1d327f60aee8509df877c8dc38c_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\omndmehoq.exe
    C:\Windows\omndmehoq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\omndmehoq.exe
      C:\Windows\omndmehoq.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\Users\Admin\Documents\obyjh.exe
        
        C:\Users\Admin\Documents\obyjh.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1976
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        6⤵
        Interacts with shadow copies
        
        PID:1704
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_H_e_l_p_RECOVER_INSTRUCTIONS.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:1628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\_H_e_l_p_RECOVER_INSTRUCTIONS.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7c3c46f8,0x7ffa7c3c4708,0x7ffa7c3c4718
        6⤵
        
        PID:3508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        6⤵
        
        PID:2420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        6⤵
        
        PID:1968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
        6⤵
        
        PID:976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
        6⤵
        
        PID:224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
        6⤵
        
        PID:1148
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
        6⤵
        
        PID:292
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
        6⤵
        
        PID:1660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
        6⤵
        
        PID:4692
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
        6⤵
        
        PID:1704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
        6⤵
        
        PID:2280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8009492789435247675,1908388272387305646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
        6⤵
        
        PID:2180
    - - C:\Users\Admin\Documents\lxdjm.exe
        
        C:\Users\Admin\Documents\lxdjm.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4540
      - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        6⤵
        Interacts with shadow copies
        
        PID:548
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\OMNDME~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\6A1DD1~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\RECOVER+khowk.HTM

Filesize
6KB

MD5
50a69a73dce23ee230c1653d00f4c2db

SHA1
11ddc62a2654da48752a070cf72d81eb172878e5

SHA256
f97429fdd3709ac92a276046f1bdc7d32999c84e30f6dcb76dc50e10e4046c27

SHA512
d066037aa5e679b7ef610a32aad74b425b39e46482dd48f6bfd5da5fb657fff49b1453291d0fbb25633238dd229f24cd1222535a678af4ebbf835f58864f1712

Download Submit
C:\Program Files\7-Zip\Lang\RECOVER+khowk.PNG

Filesize
66KB

MD5
87723d7b582f785ad74301fbcc66a5d9

SHA1
3fe2dc2856f6f6a3a63e0b68ca937ff78d8adb72

SHA256
cea893c6dc30810d9a609f4c42916401519e57fa6d97df63c96a144c2c0f7285

SHA512
e3fc87efed64fb36b151312d7a1db29dfaa923b1fa9650cbfd9ffe77b1b775d1b17856f5540d18278f9588e39f4363e31642f69ac719a65ab7996edccbfaa8ad

Download Submit
C:\Program Files\7-Zip\Lang\RECOVER+khowk.TXT

Filesize
2KB

MD5
08a33e93900631b0593f27ff336b0921

SHA1
442e2a6bd6f7bc439add5d8f13e90085ad588e04

SHA256
7f15dca98089cdd7c8b5e632421e371e25d73319bd73556f8b0f9b7d0fbc696f

SHA512
ee40781b11a2a70d51cf6f86bbab8fad9568b863d750dc8ade55dd2350d7cce6e5e58b3227e2004cc2c82ee2c7286f38dfc2f0f37ee24a38f9f986a60c307af4

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
eba4cf30e78f3672543ea74e933b84fb

SHA1
98751a29048bfc42f3418c4106b86661a3637e0c

SHA256
850cc31474a4b35002215ce867af89e7de3b1dd2771f86014f59b904fdba627f

SHA512
7879d5a0773e899bc8457945e24ed94d3d408dc8d1287b737dc05f1cc847b31d44e1947d82d04bda384884af4780257610713385f786af20fa4eb9839eed4852

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
2ba4bde25169e892cda1e398f11a0145

SHA1
4180db197af2369686353e68be875b8a6820d5e8

SHA256
62924d17ef4b51a099b5b3a899ffe54c9558233a3fc90d9f34c5c126fc861559

SHA512
6cbeca10fbbe4da46fa622391cb1fa33dde02445a7af6e1d706c9a0a1b4aed2b357b7058aeb00d6b34b7e68a6344fd38934a3ca376e755f21371cc41e705eeae

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
0d91228add7f99c6a8b1a3f051fb5d59

SHA1
bc74a2e503cd6baebe73f71ad8e0970dd5505dd8

SHA256
dc88860d7240aabee9517a08f08bc0256f66aa769caf2cbf2e07b6f8f8529a46

SHA512
a086074291d3a87a21fb4ac8f0b9da48e3dbb3ab2c364427f2099c20a1200aa902d16f22b54aa0068e24563eb01d3f6a8975196ffe87449dcd8e04c90838d630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d74e6ee7839f8c3fa934b771ac19685e

SHA1
399579cda90483c2da44b4f86495d1f29b8ddcb8

SHA256
ea0a44827e5998f9296870fb204fc78355332279a30ef3af8afc52c7e01398ec

SHA512
1be39e672439ed63fc98b75f0a64a217860570913a30a828c56c8674d45c4d547ddbc7e86b4e214c2415a7752232049c368ff0abdf291c8b2f65fc89563b22bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9021e22a85fbe3a2352fb626c4ca3919

SHA1
291395ad56b8edf32443565b4a86792161732f64

SHA256
7896adfc0c42beed9ffa494f793b21e1569e40def02d85cc7fe9705eaf73174c

SHA512
b01fc8f8ebb2953eb5dd113498ecdcfbe186a9a817fc39f9d9ee534d6f3cfef8560b76281f85aff6b8cf170bb51c0a2903a9362ab2ee82444709e82597033551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5b2ce38ee4a393d0bb364fa2522b0be2

SHA1
7a6e64961234533436c379f497fd87c01eb4c3d2

SHA256
5b492bf38941ad0a87e297db0686ce75ddf0808d3390b5872712213edaf8940c

SHA512
696835629e28be977986ab58b1fb86123687b0c5f12388db8414a28b789e4770006dd8cc59bad59996740c955a49f4f3c9bc5632e25942cabb7b6359803dcd36

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662717143618.txt

Filesize
77KB

MD5
8a7e2add364e120ba042f778c25cbc88

SHA1
3f3f4888df65f59959a3841bb468081c785c9598

SHA256
5f982cfb496f0872ebcc5d76607728126d74cc1e07c535759a81fa02a504149e

SHA512
ec3b19a17eb64cb09d72393eada5e58eaf66ccbe0d4359008d2932beefbcff92afdfb8ce49686162ebdeb8c2bdc719f0be165d339ba0e6b223a1f0092b0a1cc0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663983438946.txt

Filesize
47KB

MD5
126c20db9f2f23d0865ba4aca8679f64

SHA1
229e53dabbba1d1cba56d07b471a3585e56cbaef

SHA256
2a43d2d2e094033c6050eac2fa1c94424fc227281e3a9a4c9dd731dbcc916521

SHA512
437b0e6e7daad2857e0b5b87edcd17e877163ad8632c1417e252d6edd01cba29698d2325bb61aca759feac3ebef70d50ef88886be6fb52fa1055ce3ce5c9c571

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671578469739.txt

Filesize
74KB

MD5
64a65328430017cdb266b3fa0352bf25

SHA1
6e030e3cc6cd487be0d2d134be974ff9d705e2b9

SHA256
1136536d8a333be6b737b5dda06e11217023f3dab795a5a5d89b2785c0fa2ba2

SHA512
20ef505a70e4448bf63d97ce73ac9b7049d8882d3e09043bb5af11e6b372980b47fa2304e42f5d1ac9ea790c37da2eaa5f1fc0153574f69fa0c362f3682f5d09

Download Submit
C:\Users\Admin\Documents\obyjh.exe

Filesize
3KB

MD5
9dfc75037c8deccc2f1840b249b17750

SHA1
ee37e409cfe2b124e63f98f1797aec0330204b82

SHA256
b5680fd682b7f64e577492c097c825e4a5a00baa82a8668f478640c5f8918da1

SHA512
25e9f3546af040f3cf782b4d6c511517ac0c95cfff8b3afec407c5917427f3129c92495f95873fb67ad928a9c7ef234508ecc9ffd8835da260d8fd1e64ead16e

Download Submit
C:\Windows\omndmehoq.exe

Filesize
608KB

MD5
6a1dd1d327f60aee8509df877c8dc38c

SHA1
a2246029749e47a2532b016f80f5132f431e712f

SHA256
3e7affe327ebbf84f56bccd753c86122e0a1f0e8bf941547bfbcec775ab3ab94

SHA512
c29b9159c1bcb40db1a29cb3d91fc46e5b633db5e09ef52e8996a1d0e9900c153e6b68a7da680747215dbf0b03d34a1259fd17b90da01ff7c45cf1c4abedeaf3

Download Submit
memory/3516-19-0x0000000000400000-0x00000000007BF000-memory.dmp

Filesize
3.7MB

Download
memory/3516-11-0x0000000000400000-0x00000000007BF000-memory.dmp

Filesize
3.7MB

Download
memory/4040-4-0x00000000025A0000-0x00000000025A3000-memory.dmp

Filesize
12KB

Download
memory/4040-0-0x00000000025A0000-0x00000000025A3000-memory.dmp

Filesize
12KB

Download
memory/4040-1-0x00000000025A0000-0x00000000025A3000-memory.dmp

Filesize
12KB

Download
memory/4316-535-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-10742-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-2643-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-5444-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-26-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-24-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-18-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-9012-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-10741-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-2644-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-17-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-16-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-10793-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4316-10789-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4728-6-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4728-12-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4728-5-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4728-3-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4728-2-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download