Overview

overview

10

Static

static

3

73a6a11c2d...18.exe

windows7-x64

10

73a6a11c2d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-07-2024 10:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    73a6a11c2d266a38c47231cf08185cdf_JaffaCakes118.exe

  • Size

    276KB

  • MD5

    73a6a11c2d266a38c47231cf08185cdf

  • SHA1

    788d49570ac3369daa5ece2eda1be818f0273b10

  • SHA256

    3ef340e711b406fba665954a9500b27a99f6940cc20a5ecf1404922c2f985a1b

  • SHA512

    dccc86cd3e9d83785a31990c85d68df3df5e0d9f430ab8287317a674f53e72bb46d7c7130e544490904b037c172a180a3f8b4f0a71ee34f5011b9b3ecd3f930a

  • SSDEEP

    6144:r3LzKycO8rWSfSgl5U+7KhSpuehkv8dnb9YTlCYHTR9:Xzdhg7fKYkcne119

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 15 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 28 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\73a6a11c2d266a38c47231cf08185cdf_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\73a6a11c2d266a38c47231cf08185cdf_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\73a6a11c2d266a38c47231cf08185cdf_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\73a6a11c2d266a38c47231cf08185cdf_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\C6700\1ED1D.exe%C:\Users\Admin\AppData\Roaming\C6700
      2⤵
        PID:4420
      • C:\Users\Admin\AppData\Local\Temp\73a6a11c2d266a38c47231cf08185cdf_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\73a6a11c2d266a38c47231cf08185cdf_JaffaCakes118.exe startC:\Program Files (x86)\00892\lvvm.exe%C:\Program Files (x86)\00892
        2⤵
          PID:1472
        • C:\Program Files (x86)\LP\1DDC\2035.tmp
          "C:\Program Files (x86)\LP\1DDC\2035.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4980
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4120
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3268
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2288
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4980
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3740
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4100
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3564
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1548
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:1208
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3800
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1984
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1972
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2672
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4372
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3688
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1232
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3752
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:5080
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:552
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1948
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3744
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4348
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2964
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4032
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4108
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1828
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:5064
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1764
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:4100
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4224
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4460
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:224
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2416
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4392
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:3864
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4124
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3944
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4048
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4348
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3888
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:916
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:808
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2872

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Modify Registry

      5
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Peripheral Device Discovery

      2
      T1120

      Query Registry

      4
      T1012

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\LP\1DDC\2035.tmp
        Filesize

        97KB

        MD5

        34476c6ae3f87f799aa672ae62ce8b13

        SHA1

        052eecd19bd28180c29c910c486ac27cd7ee9e93

        SHA256

        97566dea7d7b2be42810a4f390d728232a2e046c32c13e768ec8d247c8841fc5

        SHA512

        681e1d3007402a03546880697f99b48ea0fab5febb88b16466902518c806a0c66a85ec3b5e897e46cd715cd404c06257401ce39d20bdce13086db4d177739bb1

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
        Filesize

        471B

        MD5

        8fff048a7c06082010b89d293f839718

        SHA1

        7522f573e742c250340a225b644c53eed1efeb4d

        SHA256

        f262436c723d73cf516b6f95cb59e289841e9c8a4141b098d8a3a92bd27ca0d1

        SHA512

        65c1f1f98ad28d5e9bac8e0d58936b11a3e7944a5c2e53f38089055aab2148ba9c5278a5b7da7efd266da3154cc2cc5dcad5549da575fb2d7f11b4a9d54ad0f7

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
        Filesize

        420B

        MD5

        569fa9f673685eb28b9132f8e36d4e6e

        SHA1

        66bb9bc579e56e1ca3f783684a31e8b555faf521

        SHA256

        3815e390b3c1f6f75fd76b9f06bbc22eba0aae953c4c93e721fcf6a016f84b48

        SHA512

        1c97e43a6150413494a40d23e03720f644ba44d7b0b937380a239537cce53f952c2553574549b8b5b520f61cb7c61d787d129c43117ec90b2c2476b0d866e4b2

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
        Filesize

        2KB

        MD5

        2abee5c06b923e311da4cc5a283b2bcb

        SHA1

        34236647f569baea8351943650dc28432f7d616c

        SHA256

        2946d290e1db6a565b937353fa41d929babfbe13d6db876a4cbdb93b1c6a350b

        SHA512

        cc938b1ecf5407fc40970d415c842691eb33a5425fac95500ed9b3c34ecbb233ac5e8abd83b894e86082403d138f31a1ece55eaec9c83712dbbe60922ade4a36

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133664630327510160.txt
        Filesize

        75KB

        MD5

        d316aba7b5aaf25cff3e629f1289bcdc

        SHA1

        bc72cc004155b1cf50529723d9753ef560af4eaa

        SHA256

        36bb49ee43891f784f2b6db5e9261d20ff0d95e4e24c83d78ecb8735d7e6af71

        SHA512

        ff7c176c3d239d210aefbe47c89d6a2720c4f7baf70cf8dcd32b22edd589e6b0b9245ebf934191630fd13f338e81232103a9045d25e19107f86fbd9a6cd3e494

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RIS1AYJJ\microsoft.windows[1].xml
        Filesize

        97B

        MD5

        832501c56badfa07632e434ee9aff766

        SHA1

        99c8d3c9732abfbbbed9f45e83f6856cea1ca0b8

        SHA256

        86e5b213f18aa9b62de4e9a0e2029ed054389d9de2966246d955b2ecf292bf9d

        SHA512

        6ce79c1459e708dcca3cadaa947b7b87efa44d143cd732ed1fae156e8320fc67ca3475490bda806a8e7d48dc57030446cf8839ab88ade36845e36752bb084671

        Download Submit

      • C:\Users\Admin\AppData\Roaming\C6700\0892.670
        Filesize

        996B

        MD5

        5e7b6a00c22c75547957b0ca71fc358b

        SHA1

        35671d05b9a9f18d5b48ed161d24cf90486b1fed

        SHA256

        085a7532f55faac0e55ae3aaf5fcf5de69818c3b2c05609f195042e6f13fb484

        SHA512

        f0b71dfdb6fd6d1fd9d23ad9c04818feb52dabdde707ea19bf16c82241d3f390a92b0bb05ffd4ba90381cc63b7484dc5a32fb6c970972e7003b1b222f35b7826

        Download Submit

      • C:\Users\Admin\AppData\Roaming\C6700\0892.670
        Filesize

        600B

        MD5

        68c81fcbd0dd56ee9c8e7228edcca241

        SHA1

        5e84d783007d51771303b93131678a736459d35b

        SHA256

        46512a53ae2caf062622edfcbf0bc6eed5cd11489294451bc0398a6dccc42626

        SHA512

        44ae0f1d7d686a6da403cb92a3e995d2f4ae5409c0c6cee2f41a3c3f67b236e412f1a9555a648955184d6d82dc6e51e7a144abfb1dd0133e39eed7a47afab761

        Download Submit

      • C:\Users\Admin\AppData\Roaming\C6700\0892.670
        Filesize

        1KB

        MD5

        28e6d3a6ff1f8ef37303f09960dbebdb

        SHA1

        73c435ff04430dc1127f88b0404dc785f09039d6

        SHA256

        13cfb5d799909874fe6c667bb42ef70e19b098b612da306bc1aa966fe224dcfb

        SHA512

        23629010eb50fa4be180f6bcc9e442667c6c5cd38601cf9dae039400dfc6f4e17a9f9fa9f0ab7c50355dd0942cc22dd309f9496fe9e9450df5e9735e4c63b5d1

        Download Submit

      • \??\PIPE\srvsvc
        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

        Download Submit

      • memory/224-1514-0x0000000004C10000-0x0000000004C11000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1208-468-0x00000000042E0000-0x00000000042E1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1472-125-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/1472-124-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/1548-308-0x000002797C440000-0x000002797C460000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1548-322-0x000002797C850000-0x000002797C870000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1548-292-0x000002797B320000-0x000002797B420000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1548-297-0x000002797C480000-0x000002797C4A0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1548-293-0x000002797B320000-0x000002797B420000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/1764-1226-0x000002368E240000-0x000002368E260000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1764-1258-0x000002368E610000-0x000002368E630000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1764-1235-0x000002368E200000-0x000002368E220000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1828-1219-0x0000000004A60000-0x0000000004A61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1948-934-0x000002AF2B380000-0x000002AF2B3A0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1948-942-0x000002AF2B790000-0x000002AF2B7B0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1948-919-0x000002AF2B3C0000-0x000002AF2B3E0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1972-618-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1984-507-0x0000028511940000-0x0000028511960000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1984-490-0x0000028511530000-0x0000028511550000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1984-476-0x0000028511570000-0x0000028511590000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2936-121-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2936-0-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2936-2-0x0000000000400000-0x0000000000467000-memory.dmp

        Filesize

        412KB

        Download

      • memory/2936-1363-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2936-3-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2936-615-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2936-185-0x0000000000400000-0x0000000000467000-memory.dmp

        Filesize

        412KB

        Download

      • memory/2936-14-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2964-1068-0x000002BA78600000-0x000002BA78700000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/2964-1072-0x000002BA79530000-0x000002BA79550000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2964-1082-0x000002BA794F0000-0x000002BA79510000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2964-1103-0x000002BA79B00000-0x000002BA79B20000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3688-760-0x00000000044F0000-0x00000000044F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3744-1064-0x0000000000D10000-0x0000000000D11000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3752-797-0x000001F4ADE70000-0x000001F4ADE90000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3752-798-0x000001F4AE480000-0x000001F4AE4A0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3752-766-0x000001F4ADEB0000-0x000001F4ADED0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3752-763-0x000001F4ACF50000-0x000001F4AD050000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/3864-1652-0x0000000004100000-0x0000000004101000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3944-1674-0x0000029214E00000-0x0000029214E20000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3944-1661-0x0000029214E40000-0x0000029214E60000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4100-1365-0x0000000004C20000-0x0000000004C21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4100-291-0x00000000041C0000-0x00000000041C1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4372-620-0x0000013A49A20000-0x0000013A49B20000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4372-636-0x000001424BB40000-0x000001424BB60000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4372-656-0x000001424BF50000-0x000001424BF70000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4372-624-0x000001424BB80000-0x000001424BBA0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4392-1550-0x0000025C0C640000-0x0000025C0C660000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4392-1521-0x0000025C0C270000-0x0000025C0C290000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4392-1518-0x0000025C0B120000-0x0000025C0B220000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4392-1516-0x0000025C0B120000-0x0000025C0B220000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4392-1536-0x0000025C0C230000-0x0000025C0C250000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4392-1517-0x0000025C0B120000-0x0000025C0B220000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4420-16-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/4420-15-0x0000000000400000-0x000000000046A000-memory.dmp

        Filesize

        424KB

        Download

      • memory/4460-1385-0x000001E3D8F50000-0x000001E3D8F70000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4460-1373-0x000001E3D8F90000-0x000001E3D8FB0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4460-1398-0x000001E3D9360000-0x000001E3D9380000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4980-614-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

        Download

      • memory/5080-911-0x00000000047E0000-0x00000000047E1000-memory.dmp

        Filesize

        4KB

        Download