cerber | 9abffaee18a87032e9db459d1309da167460acdd98dfc4c7fc4c3941f2cbbaf9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
Size

218KB
MD5

bf244a0d9ac81f0ca62e5b3ddfb7b72c
SHA1

ecbdbcfab600d5cfc2a1ce67bd5a1819ae340a33
SHA256

9abffaee18a87032e9db459d1309da167460acdd98dfc4c7fc4c3941f2cbbaf9
SHA512

d2f5d096b09446cb2c5ea99c33dad75b47e76cc5b0509c6d9d571d89b6f245ef86b3c63e4958d2766ef11f4483fb78af3cba49354912ed7c1f8a5497def44a53
SSDEEP

3072:2ELO8OxPh5XJkC456AhqDpl1nBTVS7R9WsL2VaAsJmzcsxoY9N/M75kDthsQxMWi:2EcNCCBAhqDNu7RhL2oAsUj/DgQxa

Score

10^/10

cerber discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerber Ransomware". ######################################################################### !!! If you are reading this message it means the software "Cerber" has !!! been removed from your computer. !!! HTML instruction ("# DECRYPT MY FILES #.html") always contains a !!! working domain of your personal page! ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53 | | 2. http://pmenboeqhyrpvomq.dd4xo3.top/D43B-1E28-8721-006D-FB53 | | 3. http://pmenboeqhyrpvomq.vkm4l6.top/D43B-1E28-8721-006D-FB53 | | 4. http://pmenboeqhyrpvomq.y5j7e6.top/D43B-1E28-8721-006D-FB53 | | 5. http://pmenboeqhyrpvomq.onion.to/D43B-1E28-8721-006D-FB53 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://pmenboeqhyrpvomq.onion/D43B-1E28-8721-006D-FB53 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53

http://pmenboeqhyrpvomq.dd4xo3.top/D43B-1E28-8721-006D-FB53

http://pmenboeqhyrpvomq.vkm4l6.top/D43B-1E28-8721-006D-FB53

http://pmenboeqhyrpvomq.y5j7e6.top/D43B-1E28-8721-006D-FB53

http://pmenboeqhyrpvomq.onion.to/D43B-1E28-8721-006D-FB53

http://pmenboeqhyrpvomq.onion/D43B-1E28-8721-006D-FB53

Extracted

Path

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .upd_on { color: red; display: block; } .upd_off { display: none; float: left; } .tor { padding: 10px 0; text-align: center; } .url { margin-right: 5px; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community "#Cerber Ransomware". <hr> If you are reading this message it means the software "Cerber" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li>Please wait...<a class="url" href="http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53" id="url_1" target="_blank">http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53</a>(<a href="#updateUrl" onClick="return updateUrl();" style="color: red;">Get a NEW address!</a>)</li> <li><a href="http://pmenboeqhyrpvomq.dd4xo3.top/D43B-1E28-8721-006D-FB53" target="_blank">http://pmenboeqhyrpvomq.dd4xo3.top/D43B-1E28-8721-006D-FB53</a></li> <li><a href="http://pmenboeqhyrpvomq.vkm4l6.top/D43B-1E28-8721-006D-FB53" target="_blank">http://pmenboeqhyrpvomq.vkm4l6.top/D43B-1E28-8721-006D-FB53</a></li> <li><a href="http://pmenboeqhyrpvomq.y5j7e6.top/D43B-1E28-8721-006D-FB53" target="_blank">http://pmenboeqhyrpvomq.y5j7e6.top/D43B-1E28-8721-006D-FB53</a></li> <li><a href="http://pmenboeqhyrpvomq.onion.to/D43B-1E28-8721-006D-FB53" target="_blank">http://pmenboeqhyrpvomq.onion.to/D43B-1E28-8721-006D-FB53</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is Please wait...<a class="url" href="http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53" id="url_2" target="_blank">http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address Please wait...<a class="url" href="http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53" id="url_3" target="_blank">http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is Please wait...<a class="url" href="http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53" id="url_4" target="_blank">http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://pmenboeqhyrpvomq.onion/D43B-1E28-8721-006D-FB53 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> <script> function getXMLHttpRequest() { if (window.XMLHttpRequest) { return new window.XMLHttpRequest; } else { try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } } function getUrlContent(url, callback) { var xhttp = getXMLHttpRequest(); if (xhttp) { xhttp.onreadystatechange = function() { if (xhttp.readyState == 4) { if (xhttp.status == 200) { return callback(xhttp.responseText.replace(/[\s ]+/gm, ""), null); } else { return callback(null, true); } } }; xhttp.open("GET", url + '?_=' + new Date().getTime(), true); xhttp.send(); } else { return callback(null, true); } } function server1(address, callback) { getUrlContent("http://btc.blockr.io/api/v1/address/txs/" + address, function(result, error) { if (!error) { var tx = /"tx":"([\w]+)","time_utc":"[\w-:]+","confirmations":[\d]+,"amount":-/.exec(result); if (tx) { getUrlContent("http://btc.blockr.io/api/v1/tx/info/" + tx[1], function(result, error) { if (!error) { var address = /"vouts":\[{"address":"([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true); } }); } function server2(address, callback) { getUrlContent("http://api.blockcypher.com/v1/btc/main/addrs/" + address, function(result, error) { if (!error) { var tx = /"tx_hash":"([\w]+)","block_height":[\d]+,"tx_input_n":[\d-]+,"tx_output_n":-/.exec(result); if (tx) { getUrlContent("http://api.blockcypher.com/v1/btc/main/txs/" + tx[1], function(result, error) { if (!error) { var address = /"outputs":\[{"value":[\d]+,"script":"[\w]+","spent_by":"[\w]+","addresses":\["([\w]+)"/.exec(result); if (address) { return callback(address[1], null); } else { return callback(null, true); } } else { return callback(null, true); } }); } else { return callback(null, true); } } else { return callback(null, true);

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Cerber family
cerber

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\""	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\""	mfpmp.exe

Contacts a large (529) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	mfpmp.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mfpmp.lnk	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mfpmp.lnk	mfpmp.exe

Executes dropped EXE 4 IoCs

pid	Process
4664	mfpmp.exe
740	mfpmp.exe
1604	mfpmp.exe
872	mfpmp.exe

Loads dropped DLL 9 IoCs

pid	Process
2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
4664	mfpmp.exe
4664	mfpmp.exe
4664	mfpmp.exe
1604	mfpmp.exe
1604	mfpmp.exe
1604	mfpmp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mfpmp = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\""	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mfpmp = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\""	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mfpmp = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\""	mfpmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mfpmp = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\""	mfpmp.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp4099.bmp"	mfpmp.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 4664 set thread context of 740	4664	mfpmp.exe	101
PID 1604 set thread context of 872	1604	mfpmp.exe	107

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.url	mfpmp.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.html	mfpmp.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE	mfpmp.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.html	mfpmp.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.txt	mfpmp.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.vbs	mfpmp.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.ini	mfpmp.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE	mfpmp.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE	mfpmp.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.url	mfpmp.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE	mfpmp.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE	mfpmp.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.vbs	mfpmp.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml	mfpmp.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\# DECRYPT MY FILES #.txt	mfpmp.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini	mfpmp.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\formulas	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
File opened for modification	C:\Windows\formulas	mfpmp.exe
File opened for modification	C:\Windows\formulas	mfpmp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mfpmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mfpmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mfpmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2260	cmd.exe
4728	PING.EXE
3280	cmd.exe
4416	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023ccc-39.dat	nsis_installer_1
behavioral2/files/0x0007000000023ccc-39.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1060	taskkill.exe
3336	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\""	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop	mfpmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\\mfpmp.exe\""	mfpmp.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	mfpmp.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4728	PING.EXE
4416	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe
740	mfpmp.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
Token: SeDebugPrivilege	3336	taskkill.exe
Token: SeDebugPrivilege	740	mfpmp.exe
Token: SeDebugPrivilege	872	mfpmp.exe
Token: 33	5520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5520	AUDIODG.EXE
Token: SeDebugPrivilege	1060	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 2000 wrote to memory of 4636	2000	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	84
PID 4636 wrote to memory of 4664	4636	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	93
PID 4636 wrote to memory of 4664	4636	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	93
PID 4636 wrote to memory of 4664	4636	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	93
PID 4636 wrote to memory of 2260	4636	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	94
PID 4636 wrote to memory of 2260	4636	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	94
PID 4636 wrote to memory of 2260	4636	bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe	94
PID 2260 wrote to memory of 3336	2260	cmd.exe	96
PID 2260 wrote to memory of 3336	2260	cmd.exe	96
PID 2260 wrote to memory of 3336	2260	cmd.exe	96
PID 2260 wrote to memory of 4728	2260	cmd.exe	98
PID 2260 wrote to memory of 4728	2260	cmd.exe	98
PID 2260 wrote to memory of 4728	2260	cmd.exe	98
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 4664 wrote to memory of 740	4664	mfpmp.exe	101
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 1604 wrote to memory of 872	1604	mfpmp.exe	107
PID 740 wrote to memory of 5840	740	mfpmp.exe	109
PID 740 wrote to memory of 5840	740	mfpmp.exe	109
PID 5840 wrote to memory of 5864	5840	msedge.exe	110
PID 5840 wrote to memory of 5864	5840	msedge.exe	110
PID 740 wrote to memory of 5908	740	mfpmp.exe	111
PID 740 wrote to memory of 5908	740	mfpmp.exe	111
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112
PID 5840 wrote to memory of 1504	5840	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
    "C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
      "C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe"
      4⤵
      Adds policy Run key to start application
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Sets desktop wallpaper using registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4ff446f8,0x7ffd4ff44708,0x7ffd4ff44718
        6⤵
        
        PID:5864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        6⤵
        
        PID:1504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        6⤵
        
        PID:4540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
        6⤵
        
        PID:728
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:5272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
        6⤵
        
        PID:5280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
        6⤵
        
        PID:2448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
        6⤵
        
        PID:3648
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
        6⤵
        
        PID:3480
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
        6⤵
        
        PID:2776
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
        6⤵
        
        PID:4036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
        6⤵
        
        PID:876
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
        6⤵
        
        PID:2224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
        6⤵
        
        PID:680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
        6⤵
        
        PID:5668
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9050770182273065088,3265741817559045527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1
        6⤵
        
        PID:1360
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pmenboeqhyrpvomq.wz139z.top/D43B-1E28-8721-006D-FB53?auto
        5⤵
        
        PID:528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x78,0x108,0x7ffd4ff446f8,0x7ffd4ff44708,0x7ffd4ff44718
        6⤵
        
        PID:452
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:4732
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /t /f /im "mfpmp.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3280
      - C:\Windows\system32\taskkill.exe
        
        taskkill /t /f /im "mfpmp.exe"
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4416
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /t /f /im "bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe" > NUL
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /t /f /im "bf244a0d9ac81f0ca62e5b3ddfb7b72c_JaffaCakes118.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3336
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4728

C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
  C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x51c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.html

Filesize
19KB

MD5
2f47de0c0bcc7a202b6e40337c96de6d

SHA1
b54cfbc0b7270c620b00f4a074bb0b3e6925c351

SHA256
63caabbf47c317b0afe5afe95aaae21cb4ed803369c3d7a4efcfba62fe151376

SHA512
e7ab4d92fd640153cf0b4decf0d77ad81d6d837dd4eb42e1643624ebfe613eefe432f6111adc31ef73399831026b64569948549ed0d54f47c1b06f72db601bf7

Download Submit
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
309346dc3ada17d2915b9fdfd35a0552

SHA1
08148c2320740cdf35aa456d914b3f2f7aeb4ff1

SHA256
60e0726cb7de677b236d7bdfe7bc95842e5d5bc6f9c1a8ffef882d39828639bc

SHA512
e9a1a5e901178e6940b17cd64ecc7390e3fbd3bb8fe7b22b1aa82a8d81c8552d4d63387bebe5808ea80ce305c1c0c70a041496178e6f2b96bb6324c0608bf749

Download Submit
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.url

Filesize
90B

MD5
88396120323975cefb9c7cf3b0c41a73

SHA1
5db96a201919a96c5ec99000300e7a80e4909bec

SHA256
9dbcac4ac3f03d1037de5b228b9aac52431664f2903805245f8a708c91f3c3d3

SHA512
a334d6af27cdc38ff8fc92c329090947f2f20abd160b004c04c4c1ee14c344d2ad831f3ea70e053ba8ee14eb06c545ae0364c1701bd9a51307739be03b39d475

Download Submit
C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\# DECRYPT MY FILES #.vbs

Filesize
213B

MD5
1c2a24505278e661eca32666d4311ce5

SHA1
d1deb57023bbe38a33f0894b6a9a7bbffbfdeeee

SHA256
3f0dc6126cf33e7aa725df926a1b7d434eaf62a69f42e1b8ae4c110fd3572628

SHA512
ce866f2c4b96c6c7c090f4bf1708bfebdfcd58ce65a23bdc124a13402ef4941377c7e286e6156a28bd229e422685454052382f1f532545bc2edf07be4861b36c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3914dd88b94755d201797faf9f53521a

SHA1
b3880a0758f8cffa2fe8b9ad36b2570f8691eaf4

SHA256
b0130f543822b795f06f7b0f7d27b42c9e290c7c0c80468de0972606d55dc2a2

SHA512
58525b6343a900bff7a0360e74d1ad91232661e952591592ac905762fc5ac3f2e89efefdbaca287563ad741c82f77a0746b61968b28fd42bfb0fb4249945f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce376b5c6b7075f79bf4f79779796446

SHA1
521f79995173e561104ad572726c2d4ff9098593

SHA256
e0128d1e0c4d945df31c089450ae47da660cf5193f565aced53c565b90f65e31

SHA512
8b03ae23ccb5b30ee6951e9961ab408ffcb0e87f74f66de4b8e3601f9e4d08acba92296ef22848d35b99ceb081017a2b6d0d0ed16322df18ee72cd97c64cc36f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5ef27d1c8213ee76c9fa02a3e86c1f43

SHA1
c6e952337eea95c561c67eb584b103dcc9ab552c

SHA256
878e4397af426074bed0d2671bf344476d37d7bff05a200c500e55fe65978224

SHA512
e850849e40c29717bcb3a674a0bd7ef4ee624a4623308124bce49c55b6c4d52154aa8617bde1daaded5609158346f476b54964c8d3d300e8cc156971c14f7a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\16_9-frame-image-inset.png

Filesize
3KB

MD5
d0b27d901155b40f518d158f5e491028

SHA1
93a71de9454d0e94edad1bf7c3c7659c2cf99c45

SHA256
fef5272cc87850a7e422d6bc5be7986fec6aad06f57746a728d58b7de6dde0f7

SHA512
7b4a732ff48df05c895e07245b1370f1dc530af45f592aa60224bb9c17bf0a7066449cfb2c8f0c93d00ee61f34e8da3663f7f60585846d795cb329015f4b4b72

Download Submit
C:\Users\Admin\AppData\Local\Temp\405.htm

Filesize
1KB

MD5
1c7d2b2fddd34b82883053f74613a7f1

SHA1
5ded4a3340c5baa2f7875a09234200662a5fb6c5

SHA256
f42aa8b08eac61b29a5cddc51819a28a692b69480948f7d003485c0dbddedd8b

SHA512
2d54662a2a3f852d88e27232a93e5807bfa84be55460f4d9c9d2082d22e7818a337d75edb3fcdbf2fd5e6e34721722df16ada243576ace9598701a51797f50db

Download Submit
C:\Users\Admin\AppData\Local\Temp\4to3Squareframe_VideoInset.png

Filesize
3KB

MD5
1e75354ac7277ac7d729e9d934b3fdf9

SHA1
05ec2efcebd31cff1c77d9896c94c11a4722ae32

SHA256
b6c74c438f6cff931161a5ab8b0757ed185ad6c02033deac6503c9381414cac6

SHA512
e6db1edd746250f9c12c63785c4139bcfa29ec4de4cf10e9532588584f4532b6a990f3304306dc888ec6a24f04b94c7f42f615d580bb08e9db395c7244bd065c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cambridge_Bay

Filesize
1KB

MD5
89de3d027493b9dbe3298a06fef9a89d

SHA1
3d8ac130c5dab1becabb0a17cae55c9aa42e50cd

SHA256
4d1380365eaceb6082c783f733af0ec9fd99e947c1c08c84fa6ff1d370b551ea

SHA512
d7699a070cc465d5d960bd3d712fe72f68b24bd6e6bca6e67b5a17fa9581bb0cb02d10bfca2c32949ef86c3156c08e8bacdb33f1bcf4b5b188f149fc52870829

Download Submit
C:\Users\Admin\AppData\Local\Temp\Christmas

Filesize
27B

MD5
02bc5aaee85e8b96af646d479bb3307c

SHA1
1bf41be125fe8058d5999555add1ea2a83505e72

SHA256
e8d8d94f0a94768716701faa977a4d0d6ef93603de925078822f5c7a89cc8fca

SHA512
e01d82ac33729e7ee14516f5d9ff753559f73143c7aa8a25ed4cc65b59dc364b1a020bc28427f8ec43fec8ef139cf30b09e492d77f15d7b09ae83240cdf8bc14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dawson

Filesize
1KB

MD5
0b8717be9826ff70ed75c74131f1a776

SHA1
471eb762c3dafc031ac6a790c7e9201a4f644d60

SHA256
0759787339284a189592ad2a6b8aea00b7c3cf37354ffea6bd9979348d14387b

SHA512
710ebe69e5fef8e57903b588ec453daf6507072f2b539e14c7eb284de96092b573cd2d9e4701ed4cf9773ad6bea77de5fa26cd402d74f54f0ce6733924e4f4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GIF 32 Dithered.irs

Filesize
1KB

MD5
ad7857a8abf9bde686b7507079b9bc75

SHA1
c9ad654502127f32cc9658d9b17b9b84a45c3e4a

SHA256
622ae0e9a6c1012b7aef688cf4b9a57a3659066e23081f67b2565ddd9d55e170

SHA512
5ebf99464292a5a94d610ba04cdfcd53b4fa39b05715948e14a876cd58a83f42759ea0ccb6aa72f75459fcd9199aa988ab5793847b9d7cb4118b059ba8bb7f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InulinWaistcloth.g

Filesize
3KB

MD5
49b34ea2cbae50de619d8128e6fa3b2c

SHA1
35e02fa92a71c32153f9907b72ec9a38833f6cec

SHA256
e6e3a86896d639a24240ef4ebd68228567e28b7f8c382d2680d698d2e2ffe3e6

SHA512
2468f066f6356a8eaa790a31407eabb68e420b047d9153562c28386f13f3768ba767dcbd5b47c5dc9e25c6e8c3c800c84ecf56704a9a58243923535009c92122

Download Submit
C:\Users\Admin\AppData\Local\Temp\Piddle.azc

Filesize
64KB

MD5
3a0a6e99fd25fdcb0b600d3e655e520a

SHA1
97e9ec2b8432c3aec0c5d56650a43c8a922c8766

SHA256
b10f5c24e9c066aef23df3b7cf5311cbb3cc5bcbd414ff40aace396a41422625

SHA512
f9918ce003301c87a954ed26e4c3b6848e5968f165022409b4922a6c8998f885e979d691cb7f165de569e583c20837497aa35638514fe6847798d1a5c29d2935

Download Submit
C:\Users\Admin\AppData\Local\Temp\Piddle.azc

Filesize
148KB

MD5
3e45eef93b3cb1119e3510dc9b5719c8

SHA1
adf13f7d221ee3e0f6f443b01bcde4a10b54e33d

SHA256
b68684a53123fa290b5ea29fbdc4eabb930a3f179a690554366d3ad63a3cdf8b

SHA512
7fe8d4fdd541333c8b6720e8d3902f59a181606d87bcb38c6ae79d3af3e8c92f227fc7f6078c897018921868ece16ba34b521904cfc75d7bdf83132a5f80b665

Download Submit
C:\Users\Admin\AppData\Local\Temp\SetCursor.dll

Filesize
13KB

MD5
eca26c61607b5b8f511f73a2c820de3d

SHA1
cfd03bc71cb462edb70a476c956ba8a9a9a44ea5

SHA256
ba57adfeaf6cbe5db7e19b428552900b083e3cbf19f0d1d30f5c35c9e01f51ea

SHA512
b9a065b75e5f8d81de2c2bc3333ab775450c13b7ec16ed7f17c3963e969b35a4cd4a71533ba7058e2f3398136727a1cb90c1e76a3d489379299d9c89278567fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\alerts.xsd

Filesize
1KB

MD5
275c7bebd1f409bfaa98227f7787d3b3

SHA1
73edaeb7a5de0b98b922414191d69ea6617edcac

SHA256
51e2e5877b9e355118cc27ad284db0bd6fce616a78e64e9d905cf836277376b7

SHA512
3fcbfefa952b0f122fa6798f471805c13643a11fe060bcb8c22ec13ea7d0571717e0177073cdb3c4d43fc755cc476036b7bf0426f621515975c709a503d8433a

Download Submit
C:\Users\Admin\AppData\Local\Temp\avalon-framework.NOTICE.TXT

Filesize
622B

MD5
141edc03b0f0c08bf8847a4d20a2d140

SHA1
8fb3d2fdebb7f5cf86e7d33b22b676f37a6a34eb

SHA256
c19de564c3d24b412a55e8d39cc4aaf4b226ad1d87e41f1dd676e82e6ad2f56a

SHA512
15ddc9e4cc13121c3687494753ce2a3341bfd1c9263150c32620000ca2a1839529f9c497f75c41783e647e49229eb518b382b3ac229cc08c134395b06614d1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\blue 286 bl 2.ADO

Filesize
524B

MD5
a4c0299e39c677afd7a7517d2980bf15

SHA1
8748961f6bda83bec226430bf60589d6b2344211

SHA256
5b2da553b3587b710311b4b6318464456cbb2cdfd1c8bd7a831b3bb36aa8ca23

SHA512
1e0491cbb298f18b192e96d23fd629739ea48de85ee1b7ed3a7e96a3a645d1ca8471580b6bb0545f10d0edc845612d002920071870bf69a7c90ed9705f8f52d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\chunkfast.xsl

Filesize
2KB

MD5
4b3b2473db1fd9f3f04044bb47d000ca

SHA1
a52a3fd19e5a1b72f9285ce4d0451650507a5dea

SHA256
d116d6e0ef1c1b5cb1512e2de16fb266e86960f636e4a608147d214fd2055a76

SHA512
2e110bc9822145b8347fe656b8021d985840a9a44c7659e9524059c94f3617c444900c248a263940f11b32ff82d3efcaa9a400e64d34303055ed9db63aaf3b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\color_mgmt.png

Filesize
4KB

MD5
4039f96ce68791185b4bd6c6836791ac

SHA1
bce49bc0c17ba5c461e77f840b4f7c66f7203202

SHA256
b764c6ade27c74321310e38e47f72d79827ee2ce99d41f3f5b8e2711906f8a70

SHA512
6f6feb92364ff863fa63750f0a0123934a0f7417aaf5a38485642b278b9ad2564520ca8ce4b62c6b794aa0f792dda95b0c99f9a793952ebd445f74d6714e1ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\getOpenDocumentIDs.jsx

Filesize
175B

MD5
a6b21e84cfffda8936b29e7c9a99be33

SHA1
52c8d102768228cf95165ce94482efe077250693

SHA256
16aebcb843ceb74d45a814c633c1f2fc2577bc8ab485da16d20700efca8b80b7

SHA512
f049f65179fd715123f193f18c201ee23b05589dc16f9c08d4d04b4deabde2b01fb63cb905e09ed3bae6ce17ef290b26d19b66fb3a724399f450b0ba8d2ca4af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrBCAA.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\mfpmp.lnk

Filesize
1KB

MD5
d643761bea8094c5df36a455c62dbf8e

SHA1
efd0caa0a405ee3f5e85b44e9dc5a4e747a2ef0e

SHA256
61ebd46982a911e786b1a4707dd1661cc9998d3ea97cb0ae28d0e0da90429e52

SHA512
cfe641aba5aa5e7418673a8d488a28657efc0136cb06f256e786f94eadd67ac5f8495e8aedb51a2eb4c854f1eee88a94fa2b90969bb28e03a8b026fdb6e62d9d

Download Submit
C:\Users\Admin\AppData\Roaming\{9D3B20D5-7968-97DE-9EE7-58760A9EBF19}\mfpmp.exe

Filesize
218KB

MD5
bf244a0d9ac81f0ca62e5b3ddfb7b72c

SHA1
ecbdbcfab600d5cfc2a1ce67bd5a1819ae340a33

SHA256
9abffaee18a87032e9db459d1309da167460acdd98dfc4c7fc4c3941f2cbbaf9

SHA512
d2f5d096b09446cb2c5ea99c33dad75b47e76cc5b0509c6d9d571d89b6f245ef86b3c63e4958d2766ef11f4483fb78af3cba49354912ed7c1f8a5497def44a53

Download Submit
memory/740-399-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-972-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-91-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-1057-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-150-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-153-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-152-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-96-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-95-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-1056-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-93-0x0000000003780000-0x0000000003781000-memory.dmp

Filesize
4KB

Download
memory/740-90-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-956-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-962-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-988-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-997-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-994-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-993-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-992-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-991-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-985-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-980-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-978-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-976-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-974-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-97-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/740-966-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/872-147-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/872-146-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4636-33-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4636-32-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4636-31-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4636-30-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4636-41-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4636-28-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download