01f8471b5baa722a8825377ba031baaf19328fb1e01e154d298a3bdbe5f21351

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
Size

652KB
MD5

67b59e779ca2cde9759fdbb3a4f76fd5
SHA1

283d6b3b56462a6f0d0fdb050d2844948d96ecdc
SHA256

01f8471b5baa722a8825377ba031baaf19328fb1e01e154d298a3bdbe5f21351
SHA512

4e2db78905e2f392e5219c729c21dd51e934102d2b21d7a79c4f43340e6c27d73a9a237e394b7bb30a2d4aecda971d92ed3ff91b3c1067339cf7f1df57c18dea
SSDEEP

12288:KIMWh8N44VA55J4NZphtIGSoA4TasL4Qfo2u8lp7d0dR+w653hvR/0055qV1:Kwc4H55J0ZpXae/fo2fl9dqy5ds

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\YOUTUBE.exe = "C:\\Users\\Admin\\AppData\\Roaming\\YOUTUBE.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\lshss.exe = "C:\\Users\\Admin\\AppData\\Roaming\\lshss.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zAPOgK.exe	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3040	lshss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Roaming\\67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe"	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4432 set thread context of 3040	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	90

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3032	reg.exe
3220	reg.exe
1136	reg.exe
2884	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
Token: 1	3040	lshss.exe
Token: SeCreateTokenPrivilege	3040	lshss.exe
Token: SeAssignPrimaryTokenPrivilege	3040	lshss.exe
Token: SeLockMemoryPrivilege	3040	lshss.exe
Token: SeIncreaseQuotaPrivilege	3040	lshss.exe
Token: SeMachineAccountPrivilege	3040	lshss.exe
Token: SeTcbPrivilege	3040	lshss.exe
Token: SeSecurityPrivilege	3040	lshss.exe
Token: SeTakeOwnershipPrivilege	3040	lshss.exe
Token: SeLoadDriverPrivilege	3040	lshss.exe
Token: SeSystemProfilePrivilege	3040	lshss.exe
Token: SeSystemtimePrivilege	3040	lshss.exe
Token: SeProfSingleProcessPrivilege	3040	lshss.exe
Token: SeIncBasePriorityPrivilege	3040	lshss.exe
Token: SeCreatePagefilePrivilege	3040	lshss.exe
Token: SeCreatePermanentPrivilege	3040	lshss.exe
Token: SeBackupPrivilege	3040	lshss.exe
Token: SeRestorePrivilege	3040	lshss.exe
Token: SeShutdownPrivilege	3040	lshss.exe
Token: SeDebugPrivilege	3040	lshss.exe
Token: SeAuditPrivilege	3040	lshss.exe
Token: SeSystemEnvironmentPrivilege	3040	lshss.exe
Token: SeChangeNotifyPrivilege	3040	lshss.exe
Token: SeRemoteShutdownPrivilege	3040	lshss.exe
Token: SeUndockPrivilege	3040	lshss.exe
Token: SeSyncAgentPrivilege	3040	lshss.exe
Token: SeEnableDelegationPrivilege	3040	lshss.exe
Token: SeManageVolumePrivilege	3040	lshss.exe
Token: SeImpersonatePrivilege	3040	lshss.exe
Token: SeCreateGlobalPrivilege	3040	lshss.exe
Token: 31	3040	lshss.exe
Token: 32	3040	lshss.exe
Token: 33	3040	lshss.exe
Token: 34	3040	lshss.exe
Token: 35	3040	lshss.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3040	lshss.exe
3040	lshss.exe
3040	lshss.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4400	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	87
PID 4432 wrote to memory of 4400	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	87
PID 4432 wrote to memory of 4400	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	87
PID 4400 wrote to memory of 1856	4400	csc.exe	89
PID 4400 wrote to memory of 1856	4400	csc.exe	89
PID 4400 wrote to memory of 1856	4400	csc.exe	89
PID 4432 wrote to memory of 3040	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	90
PID 4432 wrote to memory of 3040	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	90
PID 4432 wrote to memory of 3040	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	90
PID 4432 wrote to memory of 3040	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	90
PID 4432 wrote to memory of 3040	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	90
PID 4432 wrote to memory of 3040	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	90
PID 4432 wrote to memory of 3040	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	90
PID 4432 wrote to memory of 3040	4432	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	90
PID 3040 wrote to memory of 3972	3040	lshss.exe	97
PID 3040 wrote to memory of 3972	3040	lshss.exe	97
PID 3040 wrote to memory of 3972	3040	lshss.exe	97
PID 3040 wrote to memory of 1852	3040	lshss.exe	98
PID 3040 wrote to memory of 1852	3040	lshss.exe	98
PID 3040 wrote to memory of 1852	3040	lshss.exe	98
PID 3040 wrote to memory of 4416	3040	lshss.exe	99
PID 3040 wrote to memory of 4416	3040	lshss.exe	99
PID 3040 wrote to memory of 4416	3040	lshss.exe	99
PID 3040 wrote to memory of 2288	3040	lshss.exe	100
PID 3040 wrote to memory of 2288	3040	lshss.exe	100
PID 3040 wrote to memory of 2288	3040	lshss.exe	100
PID 3972 wrote to memory of 2884	3972	cmd.exe	105
PID 3972 wrote to memory of 2884	3972	cmd.exe	105
PID 3972 wrote to memory of 2884	3972	cmd.exe	105
PID 1852 wrote to memory of 3032	1852	cmd.exe	106
PID 1852 wrote to memory of 3032	1852	cmd.exe	106
PID 1852 wrote to memory of 3032	1852	cmd.exe	106
PID 2288 wrote to memory of 3220	2288	cmd.exe	107
PID 2288 wrote to memory of 3220	2288	cmd.exe	107
PID 2288 wrote to memory of 3220	2288	cmd.exe	107
PID 4416 wrote to memory of 1136	4416	cmd.exe	108
PID 4416 wrote to memory of 1136	4416	cmd.exe	108
PID 4416 wrote to memory of 1136	4416	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\efj1qk87.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9972.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9971.tmp"
    3⤵
    PID:1856
- C:\Users\Admin\AppData\Roaming\lshss.exe
  C:\Users\Admin\AppData\Roaming\lshss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lshss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lshss.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lshss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lshss.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\YOUTUBE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\YOUTUBE.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\YOUTUBE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\YOUTUBE.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES9972.tmp

Filesize
1KB

MD5
fb8113eb5db5bd39bf48ddc9e2bd03b7

SHA1
06cac76693b0724fbe85407f3fb63565b9b9fe06

SHA256
52f6ffe2f10d4402f10436dad7d6e0f216037439518c8ad0a492d6685744546a

SHA512
90c08385f1b672352ee67b632751c5eba283fd512740205537b993f0201cdea82bc47b4d56146d379cf549cfd23457bc0efe054a07d0e24122b9c921c95a7046

Download Submit
C:\Users\Admin\AppData\Local\Temp\efj1qk87.dll

Filesize
5KB

MD5
694af46873ea13221462dcd326499327

SHA1
e1e3c05bfbe38c3a1701634cd525586afec2bf30

SHA256
14a45fc727fa53b3f81af901a272ec8a24145a892d3def5f362f6da554cd24c7

SHA512
c675b8aabe4cd2d8d3bfb2dbdba2108577fb4db5f1f95d1ee37334bada9b5034985b3f4fea6cba0ede93a99699d3957abce14cdce4dcdc9bad62a2d3672f6c7c

Download Submit
C:\Users\Admin\AppData\Roaming\lshss.exe

Filesize
16KB

MD5
530f0d4fa63b33fd87407df2aa2f0f9b

SHA1
75b0b9555299e3a2359e76e4c0da330b8ccbbb50

SHA256
2d5db9c5097e230b08caddd3fbeae1f4ef4ad46aacbeb0255a8bcb91e41b30b4

SHA512
4536e2d7d094babb70c4dabf6e03c4c23c7e042a86f64564649538fbc416097bc1b954ad7d6f5b55496a9d0fa03c287d492292231af6dfca93099b23ec9bb245

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC9971.tmp

Filesize
652B

MD5
5760d9eba0301aa88357cc406fe694a3

SHA1
7207196f32ae0f24a9c6a994c802bfdd7f5c26fa

SHA256
456b978792b88ad91332c038b3bff396d9de2b821e8769208e8eda4607854f39

SHA512
6c037f85597f2e4fdddad3192c3b90b1f293eaa48572b0a0e5afe1f65c54743bf93dd9bf545faebfb3ced4d4e779807bd96a9b1302b80dd35c0dc0270583c94a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\efj1qk87.0.cs

Filesize
4KB

MD5
7f1f970af88008f4bc9476dd5c0ca6d4

SHA1
214bf03499bbb4694e15680ce1d32f8550dba208

SHA256
6c56768f4d792f55e7f7d42df418ece4c4840a38aa4314fa7d86671e1b3b6eaa

SHA512
d04d3bbd99f58b268b2dfd30d2c1e353d95551a6ada286b7ff2c7fce608daab3e6662ea9a37487732dcda53e05446ccf14dd90b11e049336906d45145890ab9c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\efj1qk87.cmdline

Filesize
206B

MD5
828cb1ad9224c4162c7be419b70f3abb

SHA1
b0ea26d0cada433727bc3cd560a58cc0a0332d2a

SHA256
ffe326f651b21fb893b37f768bb5762c0ca2d4740907a3c2d58bdfc6368142a8

SHA512
1731c503ceeb1e9848827b176d5b463a34031f8942673975bd3ee8b9ed5d47d058ac2f326da9ae3d8f604e981e5659bd8ac72d378ae10360916fa6cdf155590b

Download Submit
memory/3040-42-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-36-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-51-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-48-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-20-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-47-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-24-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-32-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-46-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-44-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-43-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-40-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-38-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-39-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4400-11-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4400-16-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4432-0-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

Filesize
4KB

Download
memory/4432-35-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4432-34-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4432-33-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

Filesize
4KB

Download
memory/4432-1-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download
memory/4432-2-0x0000000074EF0000-0x00000000754A1000-memory.dmp

Filesize
5.7MB

Download