Overview

overview

8

Static

static

3

f99c2592c8...18.exe

windows7-x64

7

f99c2592c8...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    75s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 05:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f99c2592c84114ad43bfee6515fab69c_JaffaCakes118.exe

  • Size

    845KB

  • MD5

    f99c2592c84114ad43bfee6515fab69c

  • SHA1

    13c963dabcd1e8441fbff0d4742a5a7f0ff251e4

  • SHA256

    4d3e86be151c25b793e824a41d21d3048941a6ba115339fab81f32f1c2733807

  • SHA512

    12cd4ee530bfffad9eae10358a36301b97f996fb334cf69114e805c0b646e5d95ca2899d79c947efa3fb3d1572717bd81f3543eb93c15da89aa44768fa2066b5

  • SSDEEP

    12288:B703zBKDAxXNennnACz2GvL4SEEzv1b3uLYy9gpTVphAq4qr+moK//ksufXZZDN1:6DBKDA+7ztvUwrFX3FeU/BufXZZDN

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 30 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f99c2592c84114ad43bfee6515fab69c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f99c2592c84114ad43bfee6515fab69c_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:112
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:8
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 784
        3⤵
        • Program crash
        PID:4692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 784
        3⤵
        • Program crash
        PID:3740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1112
        3⤵
        • Program crash
        PID:4268
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1148
        3⤵
        • Program crash
        PID:944
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1112
        3⤵
        • Program crash
        PID:2016
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1260
        3⤵
        • Program crash
        PID:2376
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1124
        3⤵
        • Program crash
        PID:1880
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1124
        3⤵
        • Program crash
        PID:5008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1112
        3⤵
        • Program crash
        PID:1556
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1788
        3⤵
        • Program crash
        PID:4304
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1264
        3⤵
        • Program crash
        PID:4712
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8 -ip 8
    1⤵
      PID:4436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 8 -ip 8
      1⤵
        PID:2316
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 8 -ip 8
        1⤵
          PID:2368
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 8 -ip 8
          1⤵
            PID:992
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 8 -ip 8
            1⤵
              PID:2972
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8 -ip 8
              1⤵
                PID:1584
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 8 -ip 8
                1⤵
                  PID:2148
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 8 -ip 8
                  1⤵
                    PID:4128
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 8 -ip 8
                    1⤵
                      PID:4808
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:2888
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:1876
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4108
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:3308
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                          PID:2872
                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                        1⤵
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        • Modifies data under HKEY_USERS
                        • Suspicious use of SetWindowsHookEx
                        PID:3804
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:548
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:4268
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:2708
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Modifies Installed Components in the registry
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:3312
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:1028
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                              PID:3788
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Modifies Installed Components in the registry
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:2928
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                            1⤵
                              PID:2412
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:3048
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                1⤵
                                  PID:2144
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  1⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3660
                                  • C:\Windows\explorer.exe
                                    explorer.exe /LOADSAVEDWINDOWS
                                    2⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:4416
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:696
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:2444
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:2832
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:3716
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:1616
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:2376
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:4140
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:2580
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:2068
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:5052
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:3820
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:4068
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  PID:2000
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:116
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:4544
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:1308
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:4996
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:1992
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:2540
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies Installed Components in the registry
                                  • Modifies registry class
                                  PID:3896
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 8 -ip 8
                                  1⤵
                                    PID:3988
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:3396
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:3372
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:2372
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:3580
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:1984
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4884
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1456
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:1188
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1376
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4224
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3516
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4184
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3032
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1400
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4900
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3620
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3880
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:4448
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4324
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4360
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:1204
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2072
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3772
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4808
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4160
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3760
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4328
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:100
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:916
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3724
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:3980
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 8 -ip 8
                                                                                        1⤵
                                                                                          PID:1896
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:948
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4080
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:4272
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:4788
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4464
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3148
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:3912
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:5052
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:3664
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:4600

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\ProgramData\isecurity.exe
                                                                                                              Filesize

                                                                                                              840KB

                                                                                                              MD5

                                                                                                              2a8e49eac12ac788886fd1fa4081e631

                                                                                                              SHA1

                                                                                                              f3ce0c9a7eb76db3bd23ab375adec69a013b6c85

                                                                                                              SHA256

                                                                                                              f5009ce223b841fe13fdfc77670836995a3843466c12919c77b8a11a2327fb9b

                                                                                                              SHA512

                                                                                                              ae74041dcbb56be0c136be9152fa8568580e9488f41f5811c391abe3a6f0d8ecc6a832e5777e4cf7e13e20e085881024b020f1c9d253fb86a343e7a3c688ab27

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                              Filesize

                                                                                                              471B

                                                                                                              MD5

                                                                                                              d167bef885776a71caa9137918853a44

                                                                                                              SHA1

                                                                                                              938e9840d92645b708450c23ea59d988b79c0f14

                                                                                                              SHA256

                                                                                                              a97ae8fa2227175303e2f3ea42160aced0e5d03108b249f2607aa89d25d78c40

                                                                                                              SHA512

                                                                                                              b79448a89d8f1b8afd68c5d16ac20348d4eee9f49aff3384b2419766f49183b7213e82a57da91230b1b780038fc7d3d6d507913c45e206c53e01745e4fe3ad57

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                              Filesize

                                                                                                              412B

                                                                                                              MD5

                                                                                                              8c71712873e90dfe94631b7c34c2fa17

                                                                                                              SHA1

                                                                                                              0726a5ee8f4659debe78f2bad8ef8a1f0a7be184

                                                                                                              SHA256

                                                                                                              993f0bfe9723fe915c17404b41e47ac177b50d8589c8886cddf48995cdd083e5

                                                                                                              SHA512

                                                                                                              eb79e0aeb5a70d18f7cadee5be19f182134fa6e44b81c1f60e8b24b1c25b9ddb21cdb27df4e766629f1134901cdcd8cbb9dc6cff2fbbf6ea5a663d4bdce6cfe2

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\IconCache.db
                                                                                                              Filesize

                                                                                                              16KB

                                                                                                              MD5

                                                                                                              532e3e4765a77a929c99ec5a66f24ac0

                                                                                                              SHA1

                                                                                                              42ba14fb33e1b9715039e784934a7b0c08144a41

                                                                                                              SHA256

                                                                                                              44771b3ce305589d4ae512b8a79026f9b77820a56e03d1eb23eb4edb1f0a1d2b

                                                                                                              SHA512

                                                                                                              dea658d26292dd728bb5d01b79bd78a3daf13c1e76f237f74aaa8f74cdeb124b14861442ec76efedc9be716b67faec506dff887025afdf5e54c5d3fb387a4ab7

                                                                                                              Download Submit

                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                                                                                              Filesize

                                                                                                              1022B

                                                                                                              MD5

                                                                                                              b2383ed0f7870626bd025e6134aa4f43

                                                                                                              SHA1

                                                                                                              b5954b3bb8f488c8ba4b3b573e45266c74300733

                                                                                                              SHA256

                                                                                                              04e6429a9b4b1818b1968d361808e1cd344eb6e635af78bad84bcfbb9f7c1928

                                                                                                              SHA512

                                                                                                              273ac3dfbd585d2ca5eedc600a32b229efe26dc575c360ca9e040484b7da9e1b447f65b53d485227bf418b9e156a04aa8cffda91a29a075ce39ec15ba9cd9a92

                                                                                                              Download Submit

                                                                                                            • C:\Users\Public\Desktop\Internet Security.lnk
                                                                                                              Filesize

                                                                                                              682B

                                                                                                              MD5

                                                                                                              6f744811cce96a843297c1961bc6da1a

                                                                                                              SHA1

                                                                                                              ae03393d48afc713f04191b4d9afad7678873c64

                                                                                                              SHA256

                                                                                                              279655f2047c22c26106f0e733db8cb4c8b1e4f6c43e45bb8bbb43c2e6c6011a

                                                                                                              SHA512

                                                                                                              aa9edd6a31b613ba128253596c67f6683a295d6ff1b693fce7877764bec79d11e50a31a44bb7fd9e70032d85b47e29ae018262a77b01580811d8a7d2fdfafc06

                                                                                                              Download Submit

                                                                                                            • memory/8-18-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-39-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-54-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-19-0x00000000027B0000-0x00000000027B1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/8-20-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-14-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-53-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-15-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-52-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-51-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-50-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-49-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-35-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-17-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-41-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-42-0x00000000027B0000-0x00000000027B1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/8-43-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-44-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-45-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-46-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-47-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/8-48-0x0000000000400000-0x0000000000A38000-memory.dmp

                                                                                                              Filesize

                                                                                                              6.2MB

                                                                                                              Download

                                                                                                            • memory/112-1-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/112-2-0x0000000000400000-0x0000000000509000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.0MB

                                                                                                              Download

                                                                                                            • memory/112-7-0x0000000000400000-0x0000000000509000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.0MB

                                                                                                              Download

                                                                                                            • memory/112-0-0x0000000000400000-0x0000000000509000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.0MB

                                                                                                              Download

                                                                                                            • memory/548-27-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download

                                                                                                            • memory/2928-34-0x00000000043F0000-0x00000000043F1000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                              Download