Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

3d71e631c6...18.exe

windows7-x64

10

3d71e631c6...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 12:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3d71e631c6d0c0be9b43a58fdd0a0b0f_JaffaCakes118.exe

  • Size

    808KB

  • MD5

    3d71e631c6d0c0be9b43a58fdd0a0b0f

  • SHA1

    84975f32c155ae4f0429732610e79bfa0dfe22b4

  • SHA256

    70ef9ecadb6950c33637b0aa98fdac2a9cb700e7a7c103efaddba6d8a96bca36

  • SHA512

    ff49bd9441b68bfb0d4c76d9dffe46a0ce1b98af133bef34c8dff2358338a0c66b1401cf07d7504d8990f9912cf4829b9c269f8868a387ab29a055da71ff58f0

  • SSDEEP

    12288:GcyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:Gc2+ms5pavs+NpM9nXg79CU

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 42 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d71e631c6d0c0be9b43a58fdd0a0b0f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3d71e631c6d0c0be9b43a58fdd0a0b0f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Users\Admin\x276Ht.exe
      C:\Users\Admin\x276Ht.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Users\Admin\riuyai.exe
        "C:\Users\Admin\riuyai.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3832
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del x276Ht.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3928
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:5020
    • C:\Users\Admin\2xiv.exe
      C:\Users\Admin\2xiv.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:856
      • C:\Users\Admin\2xiv.exe
        "C:\Users\Admin\2xiv.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3992
    • C:\Users\Admin\3xiv.exe
      C:\Users\Admin\3xiv.exe
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4640
      • C:\Users\Admin\3xiv.exe
        C:\Users\Admin\3xiv.exe startC:\Users\Admin\AppData\Roaming\847F5\7DE53.exe%C:\Users\Admin\AppData\Roaming\847F5
        3⤵
        • Executes dropped EXE
        PID:3088
      • C:\Users\Admin\3xiv.exe
        C:\Users\Admin\3xiv.exe startC:\Program Files (x86)\F5615\lvvm.exe%C:\Program Files (x86)\F5615
        3⤵
        • Executes dropped EXE
        PID:3048
      • C:\Program Files (x86)\LP\5338\9AF3.tmp
        "C:\Program Files (x86)\LP\5338\9AF3.tmp"
        3⤵
        • Executes dropped EXE
        PID:2236
    • C:\Users\Admin\4xiv.exe
      C:\Users\Admin\4xiv.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Users\Admin\AppData\Local\50dda471\X
        *0*bc*c7abc055*31.193.3.240:53
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3652
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
            PID:1204
      • C:\Users\Admin\5xiv.exe
        C:\Users\Admin\5xiv.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3960
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del 3d71e631c6d0c0be9b43a58fdd0a0b0f_JaffaCakes118.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3220
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          PID:1240
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2964
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4444
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:904
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3564
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2236
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1904
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3996
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2728
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:1896
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1732
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3268
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4648
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3988
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3620
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4380
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2732
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4060
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4504
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3440
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2564
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:1732
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4444
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4648
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3444
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3772
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:1124
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4040
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2448
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:956
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2160
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4416
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4976
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2240
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2944
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:1140
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4892
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3776
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:2208
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3468
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3876
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:656
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4992
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3336
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:2468
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4280
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:5108
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1068
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4500
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1824
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:628
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3200
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2276
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:3012
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:452
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4692
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3236
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2952
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4296
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:2276
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4136
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:2648
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:2908
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:612
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:2480
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:3392
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:3320
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:1736
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4496
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:2192
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:3036
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:2716
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4496
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:1484
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:4500
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:2288
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:3996
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                  1⤵
                                                                                                                    PID:1824

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                  Reconnaissance

                                                                                                                  Resource Development

                                                                                                                  Initial Access

                                                                                                                  Execution

                                                                                                                  Persistence

                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                  2
                                                                                                                  T1547

                                                                                                                  Active Setup

                                                                                                                  1
                                                                                                                  T1547.014

                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                  1
                                                                                                                  T1547.001

                                                                                                                  Create or Modify System Process

                                                                                                                  1
                                                                                                                  T1543

                                                                                                                  Windows Service

                                                                                                                  1
                                                                                                                  T1543.003

                                                                                                                  Privilege Escalation

                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                  2
                                                                                                                  T1547

                                                                                                                  Active Setup

                                                                                                                  1
                                                                                                                  T1547.014

                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                  1
                                                                                                                  T1547.001

                                                                                                                  Create or Modify System Process

                                                                                                                  1
                                                                                                                  T1543

                                                                                                                  Windows Service

                                                                                                                  1
                                                                                                                  T1543.003

                                                                                                                  Defense Evasion

                                                                                                                  Hide Artifacts

                                                                                                                  1
                                                                                                                  T1564

                                                                                                                  Hidden Files and Directories

                                                                                                                  1
                                                                                                                  T1564.001

                                                                                                                  Modify Registry

                                                                                                                  6
                                                                                                                  T1112

                                                                                                                  Credential Access

                                                                                                                  Unsecured Credentials

                                                                                                                  2
                                                                                                                  T1552

                                                                                                                  Credentials In Files

                                                                                                                  2
                                                                                                                  T1552.001

                                                                                                                  Discovery

                                                                                                                  Peripheral Device Discovery

                                                                                                                  2
                                                                                                                  T1120

                                                                                                                  Process Discovery

                                                                                                                  1
                                                                                                                  T1057

                                                                                                                  Query Registry

                                                                                                                  4
                                                                                                                  T1012

                                                                                                                  System Information Discovery

                                                                                                                  4
                                                                                                                  T1082

                                                                                                                  Lateral Movement

                                                                                                                  Collection

                                                                                                                  Data from Local System

                                                                                                                  2
                                                                                                                  T1005

                                                                                                                  Command and Control

                                                                                                                  Exfiltration

                                                                                                                  Impact

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\Program Files (x86)\LP\5338\9AF3.tmp
                                                                                                                    Filesize

                                                                                                                    101KB

                                                                                                                    MD5

                                                                                                                    8ddb300fe82a1e8ab0b0c9b704725316

                                                                                                                    SHA1

                                                                                                                    899ef3abfa492136996ccffd0958e0c607817835

                                                                                                                    SHA256

                                                                                                                    86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f

                                                                                                                    SHA512

                                                                                                                    3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\2xiv.exe
                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                    MD5

                                                                                                                    930ddf5711ff276332bc5e1eec8cded0

                                                                                                                    SHA1

                                                                                                                    e14b2bdd272fe546c043ab7a2f249955e1820744

                                                                                                                    SHA256

                                                                                                                    4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d

                                                                                                                    SHA512

                                                                                                                    3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\3xiv.exe
                                                                                                                    Filesize

                                                                                                                    287KB

                                                                                                                    MD5

                                                                                                                    3d6f651187a05dfab030fd923b218279

                                                                                                                    SHA1

                                                                                                                    9d0fff6e4d22777a9f3b7c57baea9f34151eca65

                                                                                                                    SHA256

                                                                                                                    b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e

                                                                                                                    SHA512

                                                                                                                    835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\4xiv.exe
                                                                                                                    Filesize

                                                                                                                    265KB

                                                                                                                    MD5

                                                                                                                    45cba518c7a8b41f65690da873e13e3d

                                                                                                                    SHA1

                                                                                                                    5a787a1f7f7bdd22c72b0f9d26818d902b65da8b

                                                                                                                    SHA256

                                                                                                                    c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79

                                                                                                                    SHA512

                                                                                                                    7515485b6d9e90cf4dd00b076c4173f19adffe0215d95edadd4ceb61b46a06c3751aa524c70a3cac738b751bc73802877ef2d16a44b5cc0399c3e85b704249f7

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\5xiv.exe
                                                                                                                    Filesize

                                                                                                                    44KB

                                                                                                                    MD5

                                                                                                                    fd4f97e710556c5769ab1e074a5c02b5

                                                                                                                    SHA1

                                                                                                                    eaac335c1dd2cd449f4d3b4f9b5cdad0cffa6d61

                                                                                                                    SHA256

                                                                                                                    7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18

                                                                                                                    SHA512

                                                                                                                    6f01d7a97497d245cf4144fac30cd169435ad51ea432adf2469e822773c529ff08daf0ffdca80c1aab607490b9f8f7cd06e08f6219c0065b58a773d42c159726

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\50dda471\X
                                                                                                                    Filesize

                                                                                                                    38KB

                                                                                                                    MD5

                                                                                                                    72de2dadaf875e2fd7614e100419033c

                                                                                                                    SHA1

                                                                                                                    5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

                                                                                                                    SHA256

                                                                                                                    c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

                                                                                                                    SHA512

                                                                                                                    e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                    Filesize

                                                                                                                    2KB

                                                                                                                    MD5

                                                                                                                    0c39165dcb876e9982d519c0b91382fb

                                                                                                                    SHA1

                                                                                                                    326f050f0da3bbb2f3daa34cc39e6b7c1ea0bb13

                                                                                                                    SHA256

                                                                                                                    94a379dd45d691a66d538a9113956aedfbe7afd89c93c29e796e4a22a6c128b1

                                                                                                                    SHA512

                                                                                                                    38e5a3b2c0a8138e16b97d31199f9301346a34c332433bbcd6f4b44ee330acc29b0d447446311ba5f12e7ad5e8b7a4a4b844537813cd1bb37d9eeaa977e1973f

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133652622252602371.txt
                                                                                                                    Filesize

                                                                                                                    75KB

                                                                                                                    MD5

                                                                                                                    1446ea2b153d65a819e9bbf4d4e5c4ee

                                                                                                                    SHA1

                                                                                                                    9947842974e8df5f396674d1ba50623ca9d41289

                                                                                                                    SHA256

                                                                                                                    d5bff7962185922941cb2e88950ea716b03159f7cb42363f2f2427a059db7a28

                                                                                                                    SHA512

                                                                                                                    6026f08924c4a8bbbc219190d1d77cd8f94508b431fae39d7ccd2203fd9515f7340f56952fe9ea806e66f1c533e7b9b1cc82c5693e89dd96bf805100e238a301

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7M5I75JN\microsoft.windows[1].xml
                                                                                                                    Filesize

                                                                                                                    97B

                                                                                                                    MD5

                                                                                                                    859ab69c110b39b89cf12fa8ec848a60

                                                                                                                    SHA1

                                                                                                                    115751d92448bb0fd75a162938226fb6b0b30ede

                                                                                                                    SHA256

                                                                                                                    a8feaf799158198356b15e70ab778bfaa95fc80817477d15e355e67a6efc7c5a

                                                                                                                    SHA512

                                                                                                                    6ee7e9cd4d7e53ff6f31eba404a1782a9a0fe524b5aefb3fbf556d56fb70cd036204dd4b46bd87aec3ecd165f4bcfc10742d9cce6665b9e90a4f96723831c989

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Roaming\847F5\5615.47F
                                                                                                                    Filesize

                                                                                                                    996B

                                                                                                                    MD5

                                                                                                                    f6bbe206249742e8f3b69287ffeaa231

                                                                                                                    SHA1

                                                                                                                    b9eb36019893a9fbc50f29e7508f75e2cf747153

                                                                                                                    SHA256

                                                                                                                    974b420bb3f534122300d2a3e1826513cc2a8c92ac40b8c1cafe50fc0a46be5e

                                                                                                                    SHA512

                                                                                                                    ae6150efc32555d05d5f0a3ca77796bff64ec60a05462c44ddf70c0fbb5aa064227527b4086a92997bea7ea1626aa46c9bbfc18694f9c138c6bfaf9e0328a7f8

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Roaming\847F5\5615.47F
                                                                                                                    Filesize

                                                                                                                    1KB

                                                                                                                    MD5

                                                                                                                    7f1f1e3947b4a8847b4830054bb7bcbb

                                                                                                                    SHA1

                                                                                                                    804bc4181698193312391f90bee4a89248c6fa7e

                                                                                                                    SHA256

                                                                                                                    c3147535cc9c9668073d52e6f2b3712fc8e5ca6d40368667233f5719393dbb59

                                                                                                                    SHA512

                                                                                                                    cd06d070c204da4071242b03362d760ef7397f589c7d9a327936702af2e124aad64a9bc56a966dd6475c816841f2a14034cdbf2dc444acddbc84daeff5c68f82

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\AppData\Roaming\847F5\5615.47F
                                                                                                                    Filesize

                                                                                                                    600B

                                                                                                                    MD5

                                                                                                                    94c013981bf1f0a13852a91adcd20596

                                                                                                                    SHA1

                                                                                                                    f2e4178e93782b123edf767e3183e037ff8ca1c3

                                                                                                                    SHA256

                                                                                                                    2691666806b3028d6b4b3c14ca4a79328b589d39d3f45c3bc2d268d84248ce23

                                                                                                                    SHA512

                                                                                                                    6c68063e783b337fb20cea88c7eaaba721416adbadf996684510becdec27f83aeea9345a60505124207dd73f19b5b7b6c8a0b3f4acc1583054788e1ba0edf544

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\riuyai.exe
                                                                                                                    Filesize

                                                                                                                    332KB

                                                                                                                    MD5

                                                                                                                    0a8086c0a81d1623815915a5b22b5c30

                                                                                                                    SHA1

                                                                                                                    2bb22514fab3e8d64d706db454b3dc1db9091360

                                                                                                                    SHA256

                                                                                                                    f755600fba73ffd2bea52e6e4c14985d0911131e8c7b066c6a639b8b2fa51444

                                                                                                                    SHA512

                                                                                                                    00c0d84cd5915f49dc94e24a0b9eca8b6c866887caf5d9f6ee1136cc09edcd1f2ad862c81ae4170359c1d11dd153c1e61d12e03e9f0834acfc46ba770b706875

                                                                                                                    Download Submit

                                                                                                                  • C:\Users\Admin\x276Ht.exe
                                                                                                                    Filesize

                                                                                                                    332KB

                                                                                                                    MD5

                                                                                                                    ad27bc021625bc7692f942a626b3a576

                                                                                                                    SHA1

                                                                                                                    12d961ecb68e63c2cf3c3590da311a9bd5e521f7

                                                                                                                    SHA256

                                                                                                                    39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0

                                                                                                                    SHA512

                                                                                                                    2c51d8fe3cc5d2eb50d7cc5faf76f8b1d35380eb078409b1fa24caa9ca719d3b447d0669f07138330d360471a06bbc1dcca5e7a2eb81179af164a87a9f6b74bb

                                                                                                                    Download Submit

                                                                                                                  • memory/1164-71-0x0000000030670000-0x00000000306BF000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    316KB

                                                                                                                    Download

                                                                                                                  • memory/1732-1154-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/1896-550-0x0000000004C50000-0x0000000004C51000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/1904-375-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2236-700-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    116KB

                                                                                                                    Download

                                                                                                                  • memory/2564-1004-0x000001BE41540000-0x000001BE41640000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/2564-1009-0x000001BE42490000-0x000001BE424B0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2564-1022-0x000001BE42450000-0x000001BE42470000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2564-1041-0x000001BE42A60000-0x000001BE42A80000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2728-382-0x0000024249E00000-0x0000024249E20000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2728-413-0x000002424A1D0000-0x000002424A1F0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2728-394-0x0000024249DC0000-0x0000024249DE0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/2728-378-0x0000024248D00000-0x0000024248E00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/2728-377-0x0000024248D00000-0x0000024248E00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/3048-215-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    428KB

                                                                                                                    Download

                                                                                                                  • memory/3088-89-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    428KB

                                                                                                                    Download

                                                                                                                  • memory/3268-557-0x0000024368370000-0x0000024368390000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/3268-552-0x0000024367220000-0x0000024367320000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/3268-589-0x0000024368740000-0x0000024368760000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/3268-576-0x0000024368330000-0x0000024368350000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/3268-553-0x0000024367220000-0x0000024367320000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/3620-706-0x000001DC9EA40000-0x000001DC9EB40000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/3620-707-0x000001DC9EA40000-0x000001DC9EB40000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/3620-711-0x000001DC9FBA0000-0x000001DC9FBC0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/3620-733-0x000001DC9FF70000-0x000001DC9FF90000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/3620-720-0x000001DC9FB60000-0x000001DC9FB80000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/3992-53-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    56KB

                                                                                                                    Download

                                                                                                                  • memory/3992-50-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    56KB

                                                                                                                    Download

                                                                                                                  • memory/3992-51-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    56KB

                                                                                                                    Download

                                                                                                                  • memory/3992-47-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    56KB

                                                                                                                    Download

                                                                                                                  • memory/4060-871-0x0000027BBEB90000-0x0000027BBEBB0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/4060-855-0x0000027BBDD00000-0x0000027BBDE00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/4060-859-0x0000027BBEBD0000-0x0000027BBEBF0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/4060-885-0x0000027BBF1A0000-0x0000027BBF1C0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                    Download

                                                                                                                  • memory/4060-854-0x0000027BBDD00000-0x0000027BBDE00000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1024KB

                                                                                                                    Download

                                                                                                                  • memory/4380-852-0x0000000004310000-0x0000000004311000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4504-1000-0x0000000004040000-0x0000000004041000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4640-91-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    428KB

                                                                                                                    Download

                                                                                                                  • memory/4640-702-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    428KB

                                                                                                                    Download

                                                                                                                  • memory/4640-213-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    428KB

                                                                                                                    Download

                                                                                                                  • memory/4648-704-0x0000000004000000-0x0000000004001000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download