teslacrypt | 9b1622602d4ae8196316deeb91fbdd1346a4b31453f3762be119e24c84827217

max time kernel
148s
max time network
135s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
26-11-2024 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Size

388KB
MD5

a0340430d4b1c1f6dd4048ab98f2e4b2
SHA1

a43ff275972b4ed9b7f3ece61d7d49375db635e9
SHA256

9b1622602d4ae8196316deeb91fbdd1346a4b31453f3762be119e24c84827217
SHA512

54ca85bee0ded2a742c767565159c0e3121d8cd1d97cebc751d067b1ea45d9fca86b6d5acad5b472eddef23d20afcc8ae3497cdd411fd9f393d80e0c90f2cd8d
SSDEEP

12288:XhTjRwlkwFrnAEryLFcG3yBrZTRDgZ8zOhG6:p4DRw7325gPh

Score

10^/10

teslacrypt defense_evasion discovery execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+ikbfj.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DCDF7FD04C7FAFB2 2. http://kkd47eh4hdjshb5t.angortra.at/DCDF7FD04C7FAFB2 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/DCDF7FD04C7FAFB2 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/DCDF7FD04C7FAFB2 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DCDF7FD04C7FAFB2 http://kkd47eh4hdjshb5t.angortra.at/DCDF7FD04C7FAFB2 http://ytrest84y5i456hghadefdsd.pontogrot.com/DCDF7FD04C7FAFB2 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/DCDF7FD04C7FAFB2

URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/DCDF7FD04C7FAFB2

http://kkd47eh4hdjshb5t.angortra.at/DCDF7FD04C7FAFB2

http://ytrest84y5i456hghadefdsd.pontogrot.com/DCDF7FD04C7FAFB2

http://xlowfznrg4wf7dli.ONION/DCDF7FD04C7FAFB2

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Teslacrypt family
teslacrypt
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (821) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	ypoxowxbhrbu.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Recovery+ikbfj.txt	ypoxowxbhrbu.exe

Executes dropped EXE 2 IoCs

pid	Process
356	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\povgammlhlhb = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\ypoxowxbhrbu.exe\""	ypoxowxbhrbu.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 356 set thread context of 4704	356	ypoxowxbhrbu.exe	92

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sk\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\7A0AC0E6-5781-4C07-86A4-689B8CD80142\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VGX\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Common Files\System\ado\it-IT\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\3082\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\7A0AC0E6-5781-4C07-86A4-689B8CD80142\root\vfs\Windows\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office 15\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\uk-UA\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-MX\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\THMBNAIL.PNG	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sw\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\7A0AC0E6-5781-4C07-86A4-689B8CD80142\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\Recovery+ikbfj.png	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ko\Recovery+ikbfj.txt	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\Recovery+ikbfj.html	ypoxowxbhrbu.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak	ypoxowxbhrbu.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ypoxowxbhrbu.exe	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
File opened for modification	C:\Windows\ypoxowxbhrbu.exe	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ypoxowxbhrbu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ypoxowxbhrbu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	ypoxowxbhrbu.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
948	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
1516	WMIC.exe
1516	WMIC.exe
1516	WMIC.exe
4704	ypoxowxbhrbu.exe
1516	WMIC.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe
4704	ypoxowxbhrbu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
Token: SeDebugPrivilege	4704	ypoxowxbhrbu.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe
Token: 36	1516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3008	WMIC.exe
Token: SeSecurityPrivilege	3008	WMIC.exe
Token: SeTakeOwnershipPrivilege	3008	WMIC.exe
Token: SeLoadDriverPrivilege	3008	WMIC.exe
Token: SeSystemProfilePrivilege	3008	WMIC.exe
Token: SeSystemtimePrivilege	3008	WMIC.exe
Token: SeProfSingleProcessPrivilege	3008	WMIC.exe
Token: SeIncBasePriorityPrivilege	3008	WMIC.exe
Token: SeCreatePagefilePrivilege	3008	WMIC.exe
Token: SeBackupPrivilege	3008	WMIC.exe
Token: SeRestorePrivilege	3008	WMIC.exe
Token: SeShutdownPrivilege	3008	WMIC.exe
Token: SeDebugPrivilege	3008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3008	WMIC.exe
Token: SeRemoteShutdownPrivilege	3008	WMIC.exe
Token: SeUndockPrivilege	3008	WMIC.exe
Token: SeManageVolumePrivilege	3008	WMIC.exe
Token: 33	3008	WMIC.exe
Token: 34	3008	WMIC.exe
Token: 35	3008	WMIC.exe
Token: 36	3008	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 4648 wrote to memory of 1684	4648	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	88
PID 1684 wrote to memory of 356	1684	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	89
PID 1684 wrote to memory of 356	1684	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	89
PID 1684 wrote to memory of 356	1684	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	89
PID 1684 wrote to memory of 5076	1684	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	90
PID 1684 wrote to memory of 5076	1684	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	90
PID 1684 wrote to memory of 5076	1684	a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe	90
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 356 wrote to memory of 4704	356	ypoxowxbhrbu.exe	92
PID 4704 wrote to memory of 1516	4704	ypoxowxbhrbu.exe	93
PID 4704 wrote to memory of 1516	4704	ypoxowxbhrbu.exe	93
PID 4704 wrote to memory of 948	4704	ypoxowxbhrbu.exe	97
PID 4704 wrote to memory of 948	4704	ypoxowxbhrbu.exe	97
PID 4704 wrote to memory of 948	4704	ypoxowxbhrbu.exe	97
PID 4704 wrote to memory of 2924	4704	ypoxowxbhrbu.exe	98
PID 4704 wrote to memory of 2924	4704	ypoxowxbhrbu.exe	98
PID 2924 wrote to memory of 1540	2924	msedge.exe	99
PID 2924 wrote to memory of 1540	2924	msedge.exe	99
PID 4704 wrote to memory of 3008	4704	ypoxowxbhrbu.exe	100
PID 4704 wrote to memory of 3008	4704	ypoxowxbhrbu.exe	100
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102
PID 2924 wrote to memory of 2328	2924	msedge.exe	102

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ypoxowxbhrbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	ypoxowxbhrbu.exe

C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\ypoxowxbhrbu.exe
    C:\Windows\ypoxowxbhrbu.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:356
  - - C:\Windows\ypoxowxbhrbu.exe
      C:\Windows\ypoxowxbhrbu.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4704
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        5⤵
        System Location Discovery: System Language Discovery
        Opens file in notepad (likely ransom note)
        
        PID:948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x128,0x12c,0xc8,0x130,0x7ff88ffb46f8,0x7ff88ffb4708,0x7ff88ffb4718
        6⤵
        
        PID:1540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
        6⤵
        
        PID:2328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
        6⤵
        
        PID:3092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
        6⤵
        
        PID:3380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        6⤵
        
        PID:4092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        6⤵
        
        PID:3968
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
        6⤵
        
        PID:4484
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        
        PID:1420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff689ad5460,0x7ff689ad5470,0x7ff689ad5480
        7⤵
        
        PID:3468
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
        6⤵
        
        PID:1948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
        6⤵
        
        PID:3164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
        6⤵
        
        PID:4840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
        6⤵
        
        PID:4884
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,14127107239900489146,781963157182459036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
        6⤵
        
        PID:3280
    - - C:\Windows\System32\wbem\WMIC.exe
        
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\YPOXOW~1.EXE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4860
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\A03404~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\Recovery+ikbfj.html

Filesize
9KB

MD5
73bf6a584ecdbd326369315e48d0c56b

SHA1
e4bce47942736b6a5fe0cd636410118c67ddfbd7

SHA256
1164e5756e3e02f14ed1c8443ee60c900873d8f9128fa20b3af0ab17aa239bf1

SHA512
3176c72d50433658db2ed45a139383c68ad87a90abbc276cea8af3f8aef9183d065b8b0aec5c8a15adf5e38e8fe235237253b4bd660d30cd7e6341cd40906535

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+ikbfj.png

Filesize
63KB

MD5
6e21b00ac860eaefa6da5e83e5301e88

SHA1
29788deab9ed76d4bd231ad173e259a8236990d3

SHA256
24be6ecd78acb61f1fb0d75a57e9c9942c733063856cfe43768c50d42932bf73

SHA512
5e79f3fda9514ad300a73b6f08d2856a8f5cf32c0dc8a5f9649b5eed23ce41d6869fe3caf3d216b410beaf71c64e48c7441d8340bb36c32c349b9017b5f4e8ca

Download Submit
C:\Program Files\7-Zip\Lang\Recovery+ikbfj.txt

Filesize
1KB

MD5
5875c3141630f82442f5929f811ae1c4

SHA1
92b5b6323ed8afd0aeb177e5eade0794dae705ff

SHA256
bfe8734af92da25c8f8601afd4e894c38c58101955ff5d2f696151719b475de3

SHA512
0249e0fbb3f442a9b975d0033ffb48ee15002a9a62f32099904063a9979782f0323579f3ccf88d4a0ea85e3e04d7df00635ab6893f9672130d8d07def5d92f2f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
560B

MD5
e18bf6c3f455377ff4026a70cbec5516

SHA1
662ed267a12153af8d6d35dcd432b92e7b3dd6b3

SHA256
2675502f8ab6a85fd7c4a6f8586e7c1a8615f2bf3c51895777e823af35abd375

SHA512
41932f01e1d94ed41224bb927a8b4ab71b815b9acce4d8ccbe142dccbf52a2bb99ce564b2fcfcf371cbf2d97fe01fc4981f0fe13903aafc32198655caa399feb

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
560B

MD5
4d70520d6d07ceaddb3c3ea70d108950

SHA1
ab930eda5a3f440b6daa5bc591c108b1eaf7d2d2

SHA256
4e3d8f22c19e8789dd24386a01feb92a21d2d32ce33ba4168c0575074f5f9261

SHA512
0e81960a622888823b123f6acbe0ad28413fc8657495439cc75734bb28a382258cd084c8b7c91325c017ea3d65a1d3ef83bcb53641bc9f5d19a7c9523e5377e6

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
416B

MD5
24a43adb74ed6c3ed17f5cc38834672a

SHA1
4935243ac9e8cb4ca48d8514a34d49655cbe1156

SHA256
cb45e3cbcd95f6fbba301a0ddc5234bbe48b21a6f86dab4c9e825692605e48ea

SHA512
05aff55d4acee40ca2221ce1727e26374d4404866ca61c9fbc272a86b5838da999431c96e3ea4389717976977295f8eb14469e8342b60e66c1aac3eedb1355c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39191fa5187428284a12dd49cca7e9b9

SHA1
36942ceec06927950e7d19d65dcc6fe31f0834f5

SHA256
60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671

SHA512
a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef84d117d16b3d679146d02ac6e0136b

SHA1
3f6cc16ca6706b43779e84d24da752207030ccb4

SHA256
5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000

SHA512
9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0663bcb0-9749-42ad-a44a-173f2bf8279f.tmp

Filesize
24KB

MD5
60d82bd601d64fd00bb0373f5ecd65b8

SHA1
0e8bde426270dfa3ea285c2c5b7282ab37771d4c

SHA256
bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97

SHA512
5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7f026ac6fe4dd32f396c61265b1c9934

SHA1
6d3ddfe3d969356b822b9902c24f07febb066db1

SHA256
8733efb3fcc2b47c664f3ab6453af93b6bdfbc846868c0e8b70942d8764be624

SHA512
6726e026c6ded6e5e68fc9b8fdc1cddd79511e4217468462f9add3adbdc0104c60a055cf87fe8503b0e56be726a883f508a55c0dad19003642464a70dd72e6fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
e963d6f4b1de660c2df30fe7e9e9fa02

SHA1
581718b3b8241d97103154f2cb1d5aef49632491

SHA256
67ca73ef80de674c1b599f947813531ff3be274946d0d077ce820341d7342bba

SHA512
28b5408d53169654a29c2e37b9f25a54bdd0e0bdf3d609d457fcd54c41a3718b30e82c5dd2931ecbdc0b332b1088416c1db212b150ab186e2e4c24a04e07616a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e98d1679e15688ad133f11eee8458ee

SHA1
a4b1a83f0a3f2867954d3146d95d314441950606

SHA256
8aa7eaf918f2969424996a8f3575478006d9d74b308a750f996fe4f5f045554e

SHA512
eb34d52a8df4992444000a93c8d0d11254069b5f43a68a6def21061be03a538f36c42b2e968a8637f12b93235de3140002b0212aa2cdebe0950fd115c04bc72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
962aee5ce1d0e975ba4b1be7cc303701

SHA1
39c14e3949b1e3806d68a8a4ece47baf5e393347

SHA256
3fa991503d1414da0330fc67050c1a1ac86d3d7848f3a1473789aeedd58e3476

SHA512
216e24ff415b931afe389983cb9f0e1e4855ff7b206021d377bdf580eb3fac88d8726f2b8d2df2638fdd37f19b0b0f976393af7d714de78554ed342a860445e5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133741689596842864.txt

Filesize
53KB

MD5
c0097b90e15265b804011b559a67d5b3

SHA1
a333204a3f1ba50ecd0fb690874319ef4f58d569

SHA256
54081d10f25bf951f8f753e399011e6d2ec3d7d01a834a33f68d1d4e3ddebff3

SHA512
dce35c3e6609de1d0ace661ce62fff14dc7b108782b9ded6ee853e86c900f0a2f18acf8ab4549e2a404196687559e8336111185f03bf04b420f0fc75209cb98a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133741699600623649.txt

Filesize
82KB

MD5
33e1daf24dc7f1a19efa602d9caac258

SHA1
6d2042d4f132f360a3af4b207ed62c4282c514e4

SHA256
4674f7cc5afbd5b60887b733829e2ca6395bf49bea891e90f07aeb7c6d0def1a

SHA512
eb000afb0580a25352186e32ff5aaa95ca09ba2402c54f04dc3d4f6fb7dba5886ab29e7eeeebdd5bbe7cbc8e659d1b97beb6c0d24e239d27c0a2d0a3b0564db2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
d052248527b56675ab713cf89ed9e189

SHA1
e17199c44c03439f002d13393334ba9f10837e44

SHA256
1d0c53b2cce18b6508e0e064d503d86e8133d43a4db3c2ad54ed6d12718fffd3

SHA512
82de9b8e04330ee31dda9147e5fcc1c379cdea66f897dbfce3ec0e1765eacc0593a6cbcdd44a086694902ce6bf0e87aeab9ed474c1f1bc9160b3560465e539d7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
ad0b718e7b562ffc26883c458d28d403

SHA1
2bde6f00a239beb273b134bbd48d2f88f0d63b0d

SHA256
39d5d38de0dd242bbce6eed167966147064f4da49fc3871ecd8a4708c9ad57e0

SHA512
67913c256d514a21e0c30ec1b6bc3655087ff073a0248e0a4b3dcee7d95893f95419c8ceaf48017f954499d764181f0418a76987a3efac5a9e138235b986c12f

Download Submit
C:\Windows\ypoxowxbhrbu.exe

Filesize
388KB

MD5
a0340430d4b1c1f6dd4048ab98f2e4b2

SHA1
a43ff275972b4ed9b7f3ece61d7d49375db635e9

SHA256
9b1622602d4ae8196316deeb91fbdd1346a4b31453f3762be119e24c84827217

SHA512
54ca85bee0ded2a742c767565159c0e3121d8cd1d97cebc751d067b1ea45d9fca86b6d5acad5b472eddef23d20afcc8ae3497cdd411fd9f393d80e0c90f2cd8d

Download Submit
memory/356-8-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/1684-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1684-4-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1684-9-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1684-2-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1684-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4648-6-0x0000000000760000-0x0000000000763000-memory.dmp

Filesize
12KB

Download
memory/4648-1-0x0000000000760000-0x0000000000763000-memory.dmp

Filesize
12KB

Download
memory/4648-0-0x0000000000760000-0x0000000000763000-memory.dmp

Filesize
12KB

Download
memory/4704-631-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-10111-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-10110-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-10096-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-10094-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-6765-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-3218-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-10209-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-13-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-21-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-16-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-15-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/4704-14-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download