Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

1c8575d5be...18.exe

windows7-x64

8

1c8575d5be...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    37s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2024, 21:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1c8575d5be57704d35f150dc101e5eca_JaffaCakes118.exe

  • Size

    250KB

  • MD5

    1c8575d5be57704d35f150dc101e5eca

  • SHA1

    1eb97ec2d13018f35a91a5d30ef1faf703e195e7

  • SHA256

    40e7148d075f5b528df9b7d60ccd54169faeec3ca41e519bebbe8da813e3b8c1

  • SHA512

    69ffcd817b32c6744ef4ce3839945e2a90d67259bdbf568aa674112a96913d37bff47383b8fcedf0c07edda889c071378b050fd3cada2d4a6dd1b8d90a0d9e54

  • SSDEEP

    6144:yhieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:PeKrJJuf86AYcwoaoSbr

Score
8/10
executionpersistenceupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c8575d5be57704d35f150dc101e5eca_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1c8575d5be57704d35f150dc101e5eca_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\WinRAR\winrar.jse"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4248
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.com/?g8
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4620 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1296
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 4 127.1>nul &del /q "C:\Users\Admin\AppData\Local\Temp\1c8575d5be57704d35f150dc101e5eca_JaffaCakes118.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 4 127.1
        3⤵
        • Runs ping.exe
        PID:5060
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2484
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3344
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
    1⤵
      PID:4376
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1636
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:2392
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3708
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4368
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1360
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1924
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:1656
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:392
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4384
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4352
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2964
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3412
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1732
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3960
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3132
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2484
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4148
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies registry class
        PID:2336
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3412
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:1956
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1832
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:2016
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:3932
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:392
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:1956
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4828
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4448
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:1904
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:1860
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:896
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:3048
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3276
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4640
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:912
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:1904
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1992
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4848
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3320
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4156
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:4228
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:4372
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:628
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4392
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:3180
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:2368
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:1112
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:4384
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4592
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3960
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:1836
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4780
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:5076
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4296
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4992
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:1356
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:836
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:696
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:4116
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:64
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:2168
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:3268
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:3084
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:4068
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:4312
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:3996
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:4172
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:1940
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:3708
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:4776
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:4792
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:4596
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:680
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:2012
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:3840
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:4632
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:3484
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:4008
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:4224
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:3724
                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:1288
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:3240

                                                                                                                                    Network

                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    • C:\Program Files\WinRAR\winrar.jse
                                                                                                                                      Filesize

                                                                                                                                      11KB

                                                                                                                                      MD5

                                                                                                                                      9208c38b58c7c7114f3149591580b980

                                                                                                                                      SHA1

                                                                                                                                      8154bdee622a386894636b7db046744724c3fc2b

                                                                                                                                      SHA256

                                                                                                                                      cb1b908e509020904b05dc6e4ec17d877d394eb60f6ec0d993ceba5839913a0c

                                                                                                                                      SHA512

                                                                                                                                      a421c6afa6d25185ec52a8218bddf84537407fd2f6cabe38c1be814d97920cfff693a48b4f48eb30c98437cbbb8ad30ccd28c3b4b7c24379ef36ac361ddfdbf1

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                      Filesize

                                                                                                                                      471B

                                                                                                                                      MD5

                                                                                                                                      0544357b5442c61ee343154aa83651e0

                                                                                                                                      SHA1

                                                                                                                                      a1d4ba1d65f0f5465598b7ef8bc3a17f904782fc

                                                                                                                                      SHA256

                                                                                                                                      b1d29e68eaa7bacffddbab97dab1e700584fe70c6a6c91f3018c8d87d5ef0f21

                                                                                                                                      SHA512

                                                                                                                                      67a2104c9e1b3322ece85a3cdce556fb762973e8288d40c13c872eeb0da6c5436225aa1220a45d31e5300006bd87943a9ee85f6c32bbbb0d504687ecc7373b46

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                      Filesize

                                                                                                                                      420B

                                                                                                                                      MD5

                                                                                                                                      34110d6e8cbcbeee6452873b5d61c6fd

                                                                                                                                      SHA1

                                                                                                                                      a49ee5ace89c1a6100a0831e706b5dd838afd972

                                                                                                                                      SHA256

                                                                                                                                      57e5eef307a90e2f947551c7ea97009bb4102c08b673c7e2495e8c9a4677c02d

                                                                                                                                      SHA512

                                                                                                                                      e50666878bf052b0a9fd73dc524e9d618abba8b704b73e55e41d2bb1198f6d3dd5569d87ab5f909f4ab79ef733cf4b3495d5e700ce5409bff532b6d626c7b968

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\suggestions[1].en-US
                                                                                                                                      Filesize

                                                                                                                                      17KB

                                                                                                                                      MD5

                                                                                                                                      5a34cb996293fde2cb7a4ac89587393a

                                                                                                                                      SHA1

                                                                                                                                      3c96c993500690d1a77873cd62bc639b3a10653f

                                                                                                                                      SHA256

                                                                                                                                      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                                                                                                      SHA512

                                                                                                                                      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      6c379160fafb9c8c0596cdf797267dba

                                                                                                                                      SHA1

                                                                                                                                      3cc92ce82f82de946ba06f9530fd19aa011eab61

                                                                                                                                      SHA256

                                                                                                                                      07de6354e7944588b6ba8600b30881c394c7dea158e844850623d29550b6c071

                                                                                                                                      SHA512

                                                                                                                                      21103a756faf5990f38efe7bb248a6fd475d34ec04c02ba961fcaf5f0686df0a8d19958409ae265eb9800083526c52d3927fd2207879ba5cadad31bdb153bd12

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
                                                                                                                                      Filesize

                                                                                                                                      36KB

                                                                                                                                      MD5

                                                                                                                                      0e2a09c8b94747fa78ec836b5711c0c0

                                                                                                                                      SHA1

                                                                                                                                      92495421ad887f27f53784c470884802797025ad

                                                                                                                                      SHA256

                                                                                                                                      0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                                                                                      SHA512

                                                                                                                                      61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                                                                                      Filesize

                                                                                                                                      36KB

                                                                                                                                      MD5

                                                                                                                                      ab0262f72142aab53d5402e6d0cb5d24

                                                                                                                                      SHA1

                                                                                                                                      eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                                                                                      SHA256

                                                                                                                                      20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                                                                                      SHA512

                                                                                                                                      bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133643436554378372.txt
                                                                                                                                      Filesize

                                                                                                                                      75KB

                                                                                                                                      MD5

                                                                                                                                      ec861d1b31e9e99a4a6548f1e0b504e1

                                                                                                                                      SHA1

                                                                                                                                      8bf1243597aba54793caf29c5e6c258507f15652

                                                                                                                                      SHA256

                                                                                                                                      9dcf45126bd51fcc0ef73e54cc07f8eec145bc17eef189acd15fba199972d7da

                                                                                                                                      SHA512

                                                                                                                                      30cf8103a2043fd7b1a54ce06ff2ca14ba382040297a177fc612bcf55878f9d0abbe3f7ea0e7be6b6981f7c67f8be09d77730670365af3d52a1e25640a224ffd

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZD788ZAR\microsoft.windows[1].xml
                                                                                                                                      Filesize

                                                                                                                                      96B

                                                                                                                                      MD5

                                                                                                                                      fb128dd23be90403a359178e993c9d0f

                                                                                                                                      SHA1

                                                                                                                                      26fd6915e3556d4cd004f62d06fbca7926807544

                                                                                                                                      SHA256

                                                                                                                                      8da3b3625b4cd2b5eb982bb67a9478c68e411b45c46fb8548a62855069fc1c34

                                                                                                                                      SHA512

                                                                                                                                      7fe9d62e3ce2cc4818e8b16323bf94e1d31b2a492fe5afbc16ac4cb806fcf8449d63e5f5d40fae431fa91d28cf532ccbc74bc5af2fa18b6ee5ebf8c6399febdd

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.mmc
                                                                                                                                      Filesize

                                                                                                                                      255B

                                                                                                                                      MD5

                                                                                                                                      a0c4d2f989198272c1e2593e65c9c6cb

                                                                                                                                      SHA1

                                                                                                                                      0fa5cf2c05483bb89b611e0de9db674e9d53389c

                                                                                                                                      SHA256

                                                                                                                                      f3170aeec265cc49ff0f5dcb7ed7897371b0f7d1321f823f53b9b0e3a30e1d23

                                                                                                                                      SHA512

                                                                                                                                      209798b5b153283bea29974c1433fe8b6c14f2a54e57237d021ecc1013b8dc6931dedcc2fe173d121c719901045fdf2215177ba164c05d703f2e88a196252ec4

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.mmc
                                                                                                                                      Filesize

                                                                                                                                      149B

                                                                                                                                      MD5

                                                                                                                                      b0ad7e59754e8d953129437b08846b5f

                                                                                                                                      SHA1

                                                                                                                                      9ed0ae9bc497b3aa65aed2130d068c4c1c70d87a

                                                                                                                                      SHA256

                                                                                                                                      cf80455e97e3fede569ea275fa701c0f185eeba64f695286647afe56d29e2c37

                                                                                                                                      SHA512

                                                                                                                                      53e6ce64ad4e9f5696de92a32f65d06dbd459fd12256481706d7e6d677a14c15238e5351f97d2eb7bfb129a0d39f2603c4d14305a86821ed56e9face0bc252b6

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Admin\Desktop\MICROSOFT EDGE.mmc
                                                                                                                                      Filesize

                                                                                                                                      252B

                                                                                                                                      MD5

                                                                                                                                      0b7d6914496973c48637995715d6f0d4

                                                                                                                                      SHA1

                                                                                                                                      9ac88bd5741ea9825e77511ddd35ad454f05bb99

                                                                                                                                      SHA256

                                                                                                                                      9d008d6bf529b562faba50a822eba33df5162e98265362cd23fdf5edfa65a5c8

                                                                                                                                      SHA512

                                                                                                                                      ed15ee3776c0eccc4020e006413ecdcdb13ee796376775e2a7fe9d0d7238b6e7633c665f4a78fa3427d9d6bf4309b35876297db2872c26ba0a945dcfc3faf85a

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Public\Desktop\ACROBAT READER DC.mmc
                                                                                                                                      Filesize

                                                                                                                                      268B

                                                                                                                                      MD5

                                                                                                                                      57b00ccb3a351d6e45df0c5865020169

                                                                                                                                      SHA1

                                                                                                                                      c932af20d06642b4f2f0cb839cded241a90ace3d

                                                                                                                                      SHA256

                                                                                                                                      44771198c83ab0ed544795e6d1141330bc8f62129296e13218ef8422a9eab0d5

                                                                                                                                      SHA512

                                                                                                                                      334bf991e5d942a9e7f428948a93863fcacf1280518e5d1992ce36de0e2b3805195e6eadb1fbb70b6c45b371be9a7245c844231eff7c93a8f9b06b0e30d0f529

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Public\Desktop\FIREFOX.mmc
                                                                                                                                      Filesize

                                                                                                                                      212B

                                                                                                                                      MD5

                                                                                                                                      e738deb26be0ae6ee9ea74b117af48dc

                                                                                                                                      SHA1

                                                                                                                                      44905d91300e06cc6b293dcc5bd6688d9243495b

                                                                                                                                      SHA256

                                                                                                                                      363989f254555ef8fb96df9010ca31c6e2035b10af004aeec341fc2ec26d117d

                                                                                                                                      SHA512

                                                                                                                                      12ee06669dddb6bf1f2da6f4be7beb93e17bd9e8480c119cab1ff4c011ee97680d4de7bd8bef68a0426948b2ffb421c32445387c5ed60f1d140e9ff66f96e867

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Public\Desktop\GOOGLE CHROME.mmc
                                                                                                                                      Filesize

                                                                                                                                      250B

                                                                                                                                      MD5

                                                                                                                                      7dde836318d7cdbeef35f3d06a6d7b6d

                                                                                                                                      SHA1

                                                                                                                                      b26b884a2bd94a432a6e1da3acc5a99dc06c1d42

                                                                                                                                      SHA256

                                                                                                                                      951ba6b01bca3f14eabf9a657497bd172a073984e5a07a6bb39fe4ec8622aaa8

                                                                                                                                      SHA512

                                                                                                                                      74e3154552e693338f587e77a1f01762762406f8a782438ca9041888fb529dec7682692636f1dbd5255cd0922149a3b47c1cad0b3cd782f7f38497526fd945e6

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Public\Desktop\Internet Explorer.mmc
                                                                                                                                      Filesize

                                                                                                                                      218B

                                                                                                                                      MD5

                                                                                                                                      4b9f175d36f729bc91274a478a80f85c

                                                                                                                                      SHA1

                                                                                                                                      7bd79be7dc7fcbe207f16c2aa3fab022a70e7809

                                                                                                                                      SHA256

                                                                                                                                      6533906583c1f768d716d7e9b101d35d1198d9c32a06d882aa626b2e4a51ee02

                                                                                                                                      SHA512

                                                                                                                                      e6ae4ff1cf1ab92cd649ceeda9c59794d8bfd1ca4500f672425d4a74aa48a0e938120d2444a2250513437da04767ff5883e81c7fa5dfa7e71b97bb967c0d5874

                                                                                                                                      Download Submit

                                                                                                                                    • C:\Users\Public\Desktop\VLC MEDIA PLAYER.mmc
                                                                                                                                      Filesize

                                                                                                                                      198B

                                                                                                                                      MD5

                                                                                                                                      05a9ce26830a5d720143fff0263529be

                                                                                                                                      SHA1

                                                                                                                                      1b726387ca0cd48235aa0c72b95a56ba9d43c85e

                                                                                                                                      SHA256

                                                                                                                                      d15d32a3cc4c32b19be8951fd62ccf2fd9e8d40691dee12899a715f0aff298f2

                                                                                                                                      SHA512

                                                                                                                                      89c4fea31b80b5b3e413136c20d3edf81c9c6ecb3725c6025fa3bf7ce505aeec9bb3d269179942db5574dd152808e1d36c58604b093ed74a25049f1b4d98f58f

                                                                                                                                      Download Submit

                                                                                                                                    • memory/392-1004-0x0000000003F30000-0x0000000003F31000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/744-0-0x0000000000400000-0x00000000004B1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      708KB

                                                                                                                                      Download

                                                                                                                                    • memory/744-38-0x0000000000400000-0x00000000004B1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      708KB

                                                                                                                                      Download

                                                                                                                                    • memory/896-1297-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1656-265-0x0000000004140000-0x0000000004141000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1732-559-0x00000000042C0000-0x00000000042C1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1832-862-0x0000000004100000-0x0000000004101000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/1860-1158-0x0000027C0DA20000-0x0000027C0DB20000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1860-1193-0x0000027C0EF40000-0x0000027C0EF60000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1860-1181-0x0000027C0EB30000-0x0000027C0EB50000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1860-1161-0x0000027C0EB70000-0x0000027C0EB90000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1860-1157-0x0000027C0DA20000-0x0000027C0DB20000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1860-1156-0x0000027C0DA20000-0x0000027C0DB20000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1904-1445-0x0000020B84500000-0x0000020B84600000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1904-1444-0x0000020B84500000-0x0000020B84600000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1904-1450-0x0000020B852F0000-0x0000020B85310000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1904-1465-0x0000020B852B0000-0x0000020B852D0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1924-132-0x000001D462AD0000-0x000001D462AF0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1924-133-0x000001D4630E0000-0x000001D463100000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1924-103-0x000001D462B10000-0x000001D462B30000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1956-713-0x000001AC1D000000-0x000001AC1D100000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1956-712-0x000001AC1D000000-0x000001AC1D100000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/1956-716-0x000001AC1DEF0000-0x000001AC1DF10000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1956-743-0x000001AC1E4C0000-0x000001AC1E4E0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1956-733-0x000001AC1DEB0000-0x000001AC1DED0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/1956-711-0x000001AC1D000000-0x000001AC1D100000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/2336-709-0x0000000004090000-0x0000000004091000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/3132-575-0x000001C14D540000-0x000001C14D560000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3132-598-0x000001C14D950000-0x000001C14D970000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3132-562-0x000001C14C420000-0x000001C14C520000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3132-563-0x000001C14C420000-0x000001C14C520000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3132-566-0x000001C14D580000-0x000001C14D5A0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3132-561-0x000001C14C420000-0x000001C14C520000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3276-1303-0x000002708FF40000-0x000002708FF60000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3276-1311-0x000002708FF00000-0x000002708FF20000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3276-1323-0x0000027090300000-0x0000027090320000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3276-1298-0x000002708EE00000-0x000002708EF00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3276-1300-0x000002708EE00000-0x000002708EF00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3276-1299-0x000002708EE00000-0x000002708EF00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3412-451-0x0000029EACD60000-0x0000029EACD80000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3412-426-0x0000029EAC990000-0x0000029EAC9B0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3412-441-0x0000029EAC950000-0x0000029EAC970000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3932-877-0x000001BF199A0000-0x000001BF199C0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3932-868-0x000001BF199E0000-0x000001BF19A00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3932-897-0x000001BF1A2B0000-0x000001BF1A2D0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/3932-864-0x000001B717E00000-0x000001B717F00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/3932-863-0x000001B717E00000-0x000001B717F00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/4352-418-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4368-96-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4384-303-0x0000022279550000-0x0000022279570000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4384-272-0x0000022279590000-0x00000222795B0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4384-267-0x0000022278640000-0x0000022278740000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/4384-269-0x0000022278640000-0x0000022278740000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download

                                                                                                                                    • memory/4384-304-0x0000022279B60000-0x0000022279B80000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4448-1154-0x0000000004100000-0x0000000004101000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4640-1442-0x0000000004500000-0x0000000004501000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                      Download

                                                                                                                                    • memory/4828-1011-0x000001940CE90000-0x000001940CEB0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4828-1019-0x000001940CE50000-0x000001940CE70000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4828-1041-0x000001940D460000-0x000001940D480000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      Download

                                                                                                                                    • memory/4828-1005-0x000001940BF40000-0x000001940C040000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      Download