Overview

overview

10

Static

static

3

a27f11228b...18.exe

windows7-x64

10

a27f11228b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2024 14:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a27f11228b7c12fce6557da4f406d55b_JaffaCakes118.exe

  • Size

    504KB

  • MD5

    a27f11228b7c12fce6557da4f406d55b

  • SHA1

    e62c6607244af642e62fbd220ff95ab8f5bf7d5a

  • SHA256

    9e7c7af6833c51a346fba9007bd55f00aed8e8e60d0512ce84aae1d38d731e37

  • SHA512

    14e8c40dfd2a8ea6a9764189e0f6b6a9cd3ab0f69a7f3167227f6e1425085718effbdb0bca7b57b7e15b5845edd3dd7fb3e62acc47320631653c80687e97e861

  • SSDEEP

    6144:ofDdhH7Yshky2p5zrCFTYCiCA//aYyjLJtSIJOZudtJj5:ob7H7YsWJzrWTy//qZJcgHt

Score
10/10
cerberdefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.txt

Ransom Note
C_E_R_B_E_R R_A_N_S_O_M_W_A_R_E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable??? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerb3r Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to return your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A | | 2. http://4kqd3hmqgptupi3p.f0jlbj.bid/DC74-4B3F-9D44-005C-965A | | 3. http://4kqd3hmqgptupi3p.gg4dgp.bid/DC74-4B3F-9D44-005C-965A | | 4. http://4kqd3hmqgptupi3p.whmykv.bid/DC74-4B3F-9D44-005C-965A | | 5. http://4kqd3hmqgptupi3p.onion.to/DC74-4B3F-9D44-005C-965A |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://4kqd3hmqgptupi3p.onion/DC74-4B3F-9D44-005C-965A | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.
URLs

http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A

http://4kqd3hmqgptupi3p.f0jlbj.bid/DC74-4B3F-9D44-005C-965A

http://4kqd3hmqgptupi3p.gg4dgp.bid/DC74-4B3F-9D44-005C-965A

http://4kqd3hmqgptupi3p.whmykv.bid/DC74-4B3F-9D44-005C-965A

http://4kqd3hmqgptupi3p.onion.to/DC74-4B3F-9D44-005C-965A

http://4kqd3hmqgptupi3p.onion/DC74-4B3F-9D44-005C-965A

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.html

Ransom Note
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>&#067;erber &#082;ansomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R&nbsp;&nbsp;&nbsp;R A N S O M W A R E</h3> <hr> <p>Cannot you find the files you need?<br>Is the content of the files that you looked for not readable?</p> <p>It is normal because the files' names, as well as the data in your files have been encrypted.</p> <p>Great!<br>You have turned to be a part of a big community "#C3rber Ransomware".</p> <hr> <p><span class="warning">If you are reading this message it means the software "Cerber" has been removed from your computer.</span></p> <hr> <h3>What is encryption?</h3> <p>Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users.</p> <p>To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key.</p> <p>But not only it.</p> <p>It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data.</p> <hr> <h3>Everything is clear for me but what should I do?</h3> <p>The first step is reading these instructions to the end.</p> <p>Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you.</p> <p>After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions.</p> <p>It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them.</p> <p><span class="warning">!Any attempts to get back your files with the third-party tools can be fatal for your encrypted files!</span></p> <p>The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files.</p> <p>Finally it will be impossible to decrypt your files!</p> <p>When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly.</p> <p>You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files.</p> <hr> <p><span class="warning">There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already.</span></p> <hr> <p>For your information the software to decrypt your files (as well as the private key provided together) are paid products.</p> <p>After purchase of the software package you will be able to:</p> <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> <p>If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files.</p> <hr> <div class="info"> <p>There is a list of temporary addresses to go on your personal page below:</p> <ol> <li><span class="upd_off" id="upd_1">Please wait...</span><a class="url" href="http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A" id="url_1" target="_blank">http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://4kqd3hmqgptupi3p.f0jlbj.bid/DC74-4B3F-9D44-005C-965A" target="_blank">http://4kqd3hmqgptupi3p.f0jlbj.bid/DC74-4B3F-9D44-005C-965A</a></li> <li><a href="http://4kqd3hmqgptupi3p.gg4dgp.bid/DC74-4B3F-9D44-005C-965A" target="_blank">http://4kqd3hmqgptupi3p.gg4dgp.bid/DC74-4B3F-9D44-005C-965A</a></li> <li><a href="http://4kqd3hmqgptupi3p.whmykv.bid/DC74-4B3F-9D44-005C-965A" target="_blank">http://4kqd3hmqgptupi3p.whmykv.bid/DC74-4B3F-9D44-005C-965A</a></li> <li><a href="http://4kqd3hmqgptupi3p.onion.to/DC74-4B3F-9D44-005C-965A" target="_blank">http://4kqd3hmqgptupi3p.onion.to/DC74-4B3F-9D44-005C-965A</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> <p>If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it):</p> <ol> <li>take a look at the first address (in this case it is <span class="upd_off" id="upd_2">Please wait...</span><a class="url" href="http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A" id="url_2" target="_blank">http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <span class="upd_off" id="upd_3">Please wait...</span><a class="url" href="http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A" id="url_3" target="_blank">http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> <p>If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions.</p> <p>If you browse the instructions in HTML format:</p> <ol> <li>click the left mouse button on the first address (in this case it is <span class="upd_off" id="upd_4">Please wait...</span><a class="url" href="http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A" id="url_4" target="_blank">http://4kqd3hmqgptupi3p.249isv.bid/DC74-4B3F-9D44-005C-965A</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> <p>If for some reason the site cannot be opened check the connection to the Internet.</p> <hr> <p>Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products.</p> <p>Unlike them we are ready to help you always.</p> <p>If you need our help but the temporary sites are not available:</p> <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address <span class="tor">http://4kqd3hmqgptupi3p.onion/DC74-4B3F-9D44-005C-965A</span> in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> <p>If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation.</p> <p>If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files.</p> <hr> <h3>Additional information:</h3> <p>You will find the instructions for restoring your files in those folders where you have your encrypted files only.</p> <p>The instructions are made in two file formats - HTML and TXT for your convenience.</p> <p>Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files.</p> <p>The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company.</p> <hr> <p>Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data.</p> <p>The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection.</p> <p>Together we make the Internet a better and safer place.</p> <hr> <p>If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support.</p> <hr> <p>Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.</p> </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber
  • Cerber family
    cerber
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Contacts a large (524) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 61 IoCs
    adwarespyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a27f11228b7c12fce6557da4f406d55b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a27f11228b7c12fce6557da4f406d55b_JaffaCakes118.exe"
    1⤵
    • Checks whether UAC is enabled
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\system32\vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2152
      • C:\Windows\system32\wbem\WMIC.exe
        C:\Windows\system32\wbem\wmic.exe shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2800
      • C:\Windows\system32\bcdedit.exe
        C:\Windows\system32\bcdedit.exe /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2704
      • C:\Windows\system32\bcdedit.exe
        C:\Windows\system32\bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2736
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# HELP DECRYPT #.html
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1816
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:537601 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1712
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# HELP DECRYPT #.txt
      2⤵
        PID:2020
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im "a27f11228b7c12fce6557da4f406d55b_JaffaCakes118.exe"
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:216
        • C:\Windows\system32\PING.EXE
          ping -n 1 127.0.0.1
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2740
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2808
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:2396
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x594
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1164
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1076

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Windows Management Instrumentation

    1
    T1047

    Persistence

    Privilege Escalation

    Defense Evasion

    Direct Volume Access

    1
    T1006

    Indicator Removal

    2
    T1070

    File Deletion

    2
    T1070.004

    Modify Registry

    2
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Network Service Discovery

    1
    T1046

    Remote System Discovery

    1
    T1018

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Defacement

    1
    T1491

    Inhibit System Recovery

    3
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.html
      Filesize

      19KB

      MD5

      580b320cf875fb5e648811788556bdec

      SHA1

      271c2e0f8b447aa0c8554cffb568e649640347da

      SHA256

      385083288a8c6ceecb7f88bffd3930bb89d1c247a1ecfa36cd9e645c65ada587

      SHA512

      6501e6626d78f506bcd3884c133acaac7473345a2dcc3f19a78ad6606201a57f6339da86d70971e1c883a5f858bf2a22580eb910ee4be8ae2fed6ff229d227a9

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.txt
      Filesize

      10KB

      MD5

      90202cabb02112812202897186c52da4

      SHA1

      928fafb40bac536319dfc12fd2e2f8b0c86f6ebd

      SHA256

      c7094de5411d52af4a010c67e475b73c9b4f972231f348a21c53d9b00db6bce4

      SHA512

      6918b28245353dc5c67a11fcfd2d787728f2dc5de63c12ab92b436e628593c11f9aab92477e73f25327f658acc9080c2ed85a43fa462cd4c2984220bcb271678

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\# HELP DECRYPT #.url
      Filesize

      90B

      MD5

      b2a7f1d027841d59a4f2aa53338c1b17

      SHA1

      c60dd010c891ee9f3af99e09f40e7641f4822f8a

      SHA256

      bf7a43403d8f19592914069eac50c7a9b6e9bac6e1784e5f856df5118ee0f78b

      SHA512

      b92763756757cacedad855064e2be007589a8deae506bfec2fe03e3bd9af441dfc77bd7fc0d1312ff971023e678622a8ccc27c90c4f019da41c96bfa58d6f0a1

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
      Filesize

      914B

      MD5

      e4a68ac854ac5242460afd72481b2a44

      SHA1

      df3c24f9bfd666761b268073fe06d1cc8d4f82a4

      SHA256

      cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

      SHA512

      5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
      Filesize

      252B

      MD5

      5431d2fce2828fa366767d62424fb305

      SHA1

      5cc2c23f51b5fd4f5c9fff1894215ed180593dc5

      SHA256

      9facd7bb614000fc4771f9dcf42e8290485a6c4cb20e7b3dce2bf4267a92fa7d

      SHA512

      6219a83a1bc4526ed1593e2a3f4c3fe654dbb2f64cf0cbc18158e2cdbdf3039bfdc7a2663704703fdaf176284eea8bf6f60c265d0f636e5bb06477bc590c71c5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      9e12013cba42aa7159ee39945efb6489

      SHA1

      2b1f03a828a84483342b20e826c1ceba90725c2c

      SHA256

      60b47e482d4b66e320d39b2757d74b436b7c22f258fb6e43fa91b8dcb03f45e3

      SHA512

      2b76d9c336dcc1298266827cd412b5ea90345e1251bd3511ad3026bcfbd1fd52d5c6b6ae09d598123e4e1d6be82e4857d0ad009748df8ab15e70402dffd86140

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      e77117ea9e40350dc76effd4bd2e553a

      SHA1

      2fa131d42dfabe71cac3af0c9de79ad6f420ca1e

      SHA256

      66e5bd181c307dae58eb4fbfad9a0cea66cc3b706033bf8a4f5bf950e2a412e0

      SHA512

      1a9206e04ed398bce6c4a7a9d6795c5f613d7482f333fa0d28fc99bb3ee2705ee2976a36f425a8d4808208147c875a6774232a55ee06fcf0a50336195776e69a

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      e277ce9c083ff95c47341901c045f827

      SHA1

      d92aa563945fc01229e065da34c3ec0c1439bc98

      SHA256

      5ac2fdd3d01e036898b985054a2261c8e8d16e021ca881a7b04240278d804973

      SHA512

      39b2eed45e720772726af3d5dce2cf3eacca576ea61fe83abaadfd6d81badf43fc9bfbfbe25fbd36a51f570016b7a2492671e996f9a265090f1d99d3faa80d59

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      c59fb4ec9a941c1160d5bf36e6358243

      SHA1

      73dec031600949b9e691ff2a17ca79c6faa843c0

      SHA256

      7d7b164ee1223d7ad2d8f0772cf6b52b0bc5a1b175b846b9bbfaf5a5800bbf4d

      SHA512

      07eb7b976b2a23f7531848073c8d51431a358423b9c4444cadffd6554eb4ff3eb1456d36fbd1fd2a75e823145111770dc930559744f74a68779b17f232a49ee2

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      895b283bf2dfaed2093d6d52f951ff56

      SHA1

      922dd0adb3f97c6221ffb182f6839974c753d608

      SHA256

      3949a1678ed39a88188aae770c330e9448235a371bb29db93561f0b4b4291b57

      SHA512

      91d0d77ab1f79e1ed891052522205980d1d8d98ffb96adc260a3ccfb0e02de4ec125a2a4c65fd87bad465b6eb9fd4a317042459046e265cf9a47c407b1315413

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      c25b429a571a466427514b03ad12295b

      SHA1

      da5f7794b0d5620a2ff2a9679ffdf18f5b52172a

      SHA256

      aeb0f7e30fe7336debb16ecca5fb16ad698d435149d1def9c4fd5103876ed522

      SHA512

      e38dc87cb96a738ae59f5b328bff99e117965e547316d18fec9209465f13fe7baffd72d590cd6a0dd33d5dc88328b024c2b16623dce7d5f923604cecca9e7cf5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      44b61318c5b11194b73aad383651139e

      SHA1

      0221512ae00c100706517a44be54f26e052fa41a

      SHA256

      f90360087208560a19dfaeeb776edee6f018ccbe56116147d8fe6dd7dcb66f41

      SHA512

      d752ec3afaa934f1500f895ac5e67b5ccb6350a06c1de0068e070b5284ba322e71af336a8b5262140b4884312849880a91815460424a27067b459e887aa3aef2

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      1e199c27b667cbef2ad5d688a043da6c

      SHA1

      d6762424ca88e1f6367a4ff119a124e6d3f6d24e

      SHA256

      f07a7a52264dc4ff0e2b919c735216a8e1a161a5fef9f4db40b0bac1b9180f7e

      SHA512

      11c515258de72554a8375788e8567f3cba04017ad09d36ffb16b563d2e3ffd143f75bf5bed2d5fd33a82f4db8faf7dc10b6e280bba3be5badc728e9788b17859

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      a92169c3b2a06168c55b16bb2196e614

      SHA1

      7d752614793b62e024df5a5985f4ee675d39da23

      SHA256

      c4c18ac611d066a6c61087e80acae31f1f6bb4ae7d69686de2934262f50dd65f

      SHA512

      4380c45d3df893c834191dbe0ccdae932b7aad81d57a93ec339a70d354173a61be954cf96140d752c7b4295f62c0895c8af37d2ecaa860d021d1bc6944f0d978

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      7547a4b8d62df4fe008f535fffc87c14

      SHA1

      b7abde978a087d0935def893b21be1b82cd6ab04

      SHA256

      342a32a3cff66c0946b2af4c6690112734ebc541b1103602ceb9ba28b01b9d81

      SHA512

      ac8324533a2ac4b01924616126ad08ab63a39d7683ad399b9622236c8d096b3c3e95af70c9717ed8dd0026d538c5cf9f8880806d6970a2cee4f7408a767a495d

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      3b021e4e88c1a74c0904418505b7c510

      SHA1

      4d33c555e7d0d58b09dcb32627ac131f8689f719

      SHA256

      38cc6537fe87054fe33b8440a1253dc084fa60f5e6cd3047010b17da685ee96f

      SHA512

      f534aee1231a8a39decab5019ccdc46642fab6296b6500f280597dbbaca189caab01d77629f8782a0b579c074ef5997344255189a697c48ba318944f3f5dbee5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      7b0a2ecf2f0c5b19795efd9e9ff631da

      SHA1

      4eed60553340fca4c462e40ab22dbf6c4cf0c373

      SHA256

      33fac661bc824795b4dbe5707b27d50b068ef615b4137b755abfb519558607ca

      SHA512

      34a88885f08c37f0ee68510766d0a4d76345e132f384690da289b7aa252f9eba5ee2322c11d72e011d0efa7af754c7de502017913c458b49f56e58c900981c99

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      038babd0705232b964039f56fd7651e8

      SHA1

      614c5a2cfbcbc9c76ba24beeed2bc7ed641a5bc5

      SHA256

      2837030a6991257240c5f8fb47e085853b61f57a0fb91062c1dfad50ec3662d0

      SHA512

      70184901289ccc7eac14bed779eb98683a3ee8e1489e54524cf744d3f1629b76050046461d37ae54d1716c44376edb2634cf1d2e7001371ee6903485d77bc494

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      3594023913ca8e610433d322c621c4af

      SHA1

      ff996b2fdaaa9aa579b23bac338f70dfb313d7c6

      SHA256

      a660c919d6b32e7bcee2dbc1a59504426216b4f11dca0694ecc197e9f26abaaf

      SHA512

      834393c3a350754583fad95a403c1e2af45385b51bdf3c618083208adc3f570fdee2b910e105f86c784812504974eaab91669bcd5d63ceda5a7fa52438f9b655

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      7c4bf20041b2d142edc785222966dfad

      SHA1

      2ba05f90230d26a467eadbcdc6991947a3dd1898

      SHA256

      a0dee491e1526b9e91eeb878353e97c0ba7ed4ef95ffefc77438dae7ab50cfce

      SHA512

      af4ff05f714a33e74981a91dbb86dd379b537626b617675fb7a13cad3028fe16030e7bb5be62f35c41b1c2f51c605e1ad2fec4b57b9b19209b14ea9ce89a2a39

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      81964e656a77488f1f5ff177ef784b7e

      SHA1

      e53cf1c2710b552a9e4468ab967bb04e15a27f4c

      SHA256

      78a3be6ca3c9319ccfd56f3981a5c1d8d8d798ea796284008a6e06010ece7186

      SHA512

      a1a62883ee4f92061ff0f05317c6220f71d009cefbc8109c2e93f6fd23133c78a02f636b717945a6581919bf734565af1fa96f71dc7d75ca22e7d5a1c8a312e7

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      18ce01ed6ebd8fc020287157e98a1ef5

      SHA1

      8cf7b5158b247de3143d542f08d5d8a9ff4e9bd7

      SHA256

      6179107df3f18c4430c57030c3c7d317233cb8fafbfdca97215d01ea65328828

      SHA512

      5fc259644e9896979a0c191019366308dd845efa7ae0db536ce774dfae2f47402d5a7394b787733886e3ec6ca7ae378866063aa1a4eedfc51d4b8c24957a0611

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      6480fce9ecc92b3174392a88bfaf2326

      SHA1

      caf6a9265600d5cce2f350f4e2eb7bc5c976f91c

      SHA256

      bee22d58979e2bf75bc77b1152900a4b1d415ce1c5662b886e28f01a51486f1f

      SHA512

      f30378cd159fe1c261e2f87b15f81fd8128b0c1d22b0598fa76b0eff8c3a041d784ef9d20c016005152a204fafd47edcb95f2cd4034e668ad4955ad3de5e4efe

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      31a851c77aa8ed9506df7613b34678b2

      SHA1

      e4f044735e7a3210c96d3687b0c7153e2a694640

      SHA256

      235cd63fe66fcc0c21ecf73a64754595d24f87ec9895b82b93677738f5f3cec3

      SHA512

      d5ae351d98b64d7e7623a4c12719f7110a429ee2dfaf2ff487a92aaa47ebf753f5acd22d35b4bc46f9e4f7a6711dccc294bd5025c9ebe299a5e68e3697c54d71

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      07761237f66f2e6f2e04a4f4a58d244a

      SHA1

      a88ffaeb08a68a0b8947c86786db0976c999bd8a

      SHA256

      451b800e4ef5113e5cbc3ccc7fb3807c031cb224a1702ba1e9d2dd0f524d859e

      SHA512

      5000a6bb0c0cbcd84bdc4d35f95c9c7464b3e7db06992641c1925d92adba94ef35a3089ec116ad4e8c959d44002106b120b36e9971eb6821f7159dd8bb61ce69

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      f0cc37c4cbaacfc829fa5285f20e2673

      SHA1

      8397d4682044385459c4f0aef9e6527b7f2eedbb

      SHA256

      2ef3232333d91b0907256c31e596c44d5449daa3e4a14f00c42b9092893f8bf5

      SHA512

      44680bdc3753d5a856a579def54d0f968d9e64256911ed8aac1ea9afb75004b6214434ea4e10ad5cf3d5e8566861487db8d5cb794bc5cd3a9a5445dd826b229e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
      Filesize

      242B

      MD5

      7e0aaa387f9f86df7c318fa4f7ae6330

      SHA1

      dd42b10caf0fe1fe00c2db25711b4a6be64d02cd

      SHA256

      0e8c0425ac4ac6a6d2dd2930e42f8bc39ad938f0aa726fcce885069894ec8541

      SHA512

      6614d5ee3b564063496871ca6d01959738ba87b7acd22ad1b6994b80a1ef0e2897d09f434fc603e37be1ce1a0513083b79df4907b654de7122d18fd14b3a594a

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FED8ABD1-AC04-11EF-8B64-E6B33176B75A}.dat
      Filesize

      5KB

      MD5

      73f2d274a180d84766683903acf64206

      SHA1

      da564665abb48d154ae636aef28b6708d28c139c

      SHA256

      e442dae592b8391d35159b4b14c58d387f4b4ec1c3bcba17177ddb9369c959cf

      SHA512

      2e41771460049513631cf1b13bf7fcfac2abd180f101a2dbee8b7ee17d145ec8f3c21ecf4fd8d68c7895aeccbb6faabb55589bf2f7af6170c6a37462a5ec431c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CabA7B6.tmp
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TarA827.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      Download Submit

    • memory/2748-357-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-406-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-405-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-403-0x00000000042E0000-0x00000000042E2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2748-387-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-384-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-378-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-381-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-372-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-375-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-369-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-366-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-363-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-360-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-0-0x00000000001B0000-0x00000000001E5000-memory.dmp

      Filesize

      212KB

      Download

    • memory/2748-354-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-351-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-348-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-345-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-342-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-17-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-4-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-3-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-2-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download

    • memory/2748-1-0x0000000000400000-0x0000000000430000-memory.dmp

      Filesize

      192KB

      Download