Overview

overview

10

Static

static

3

aabbda269f...18.dll

windows7-x64

10

aabbda269f...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    100s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2024 10:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aabbda269fc690bf1270e2f2a727030f_JaffaCakes118.dll

  • Size

    1.2MB

  • MD5

    aabbda269fc690bf1270e2f2a727030f

  • SHA1

    1169a82250440dc8ce225e7f936c47e05b1b858e

  • SHA256

    38d90b577fe406506b98dcfa44671fb4623e64a226880bbf52658901e4c9bf0e

  • SHA512

    e524f3c97d7492ffadfac9fdb6e5adcf90d9583e8c9262544757fa43902f715656c14c7ae33f1982930e454174dc703bc24bd4a963aa1479de992bb93b39fee8

  • SSDEEP

    24576:nuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NGpt:J9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

    botnetpayload
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\aabbda269fc690bf1270e2f2a727030f_JaffaCakes118.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:5024
  • C:\Windows\system32\mmc.exe
    C:\Windows\system32\mmc.exe
    1⤵
      PID:2896
    • C:\Users\Admin\AppData\Local\Eq3\mmc.exe
      C:\Users\Admin\AppData\Local\Eq3\mmc.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      PID:3556
    • C:\Windows\system32\raserver.exe
      C:\Windows\system32\raserver.exe
      1⤵
        PID:1792
      • C:\Users\Admin\AppData\Local\bFkYqBuno\raserver.exe
        C:\Users\Admin\AppData\Local\bFkYqBuno\raserver.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        PID:4496
      • C:\Windows\system32\WMPDMC.exe
        C:\Windows\system32\WMPDMC.exe
        1⤵
          PID:508
        • C:\Users\Admin\AppData\Local\BAWF3B4Xm\WMPDMC.exe
          C:\Users\Admin\AppData\Local\BAWF3B4Xm\WMPDMC.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:3752
        • C:\Windows\system32\SystemPropertiesProtection.exe
          C:\Windows\system32\SystemPropertiesProtection.exe
          1⤵
            PID:1640
          • C:\Users\Admin\AppData\Local\0jHz5cX0Y\SystemPropertiesProtection.exe
            C:\Users\Admin\AppData\Local\0jHz5cX0Y\SystemPropertiesProtection.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            PID:4220
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3996
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4320
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1464
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3620
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2836
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:4276
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2292
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of SendNotifyMessage
            PID:652
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:1832
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2840
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:4676
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:4736
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:1424
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3460
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:3212
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:2168
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:5080
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:1848
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:2336
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3892
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4140
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:3460
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2560
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4852
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:4776
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2944
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4208
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:2288
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:3488
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:1712
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:1880
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:5076
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4624
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4916
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3760
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2508
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:4120
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:5088
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:5024
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:2836

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                        Filesize

                                                                        471B

                                                                        MD5

                                                                        7fffd2d841532ad35f039a55b6b9958c

                                                                        SHA1

                                                                        bd92a034d1f9410146c52d145420a6fdc085533d

                                                                        SHA256

                                                                        719d274ebcde47cac13abbc65fc2063d322593fc2570ede5b38638f58926a538

                                                                        SHA512

                                                                        20d695a14bb7f4e0799d360a4d75b8f5266063861548c07bd178da28b6d8cffbdaf8c66ad29684ef8083220db6648632efc0c5a64946644d9c3ab7a191c938d4

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                        Filesize

                                                                        420B

                                                                        MD5

                                                                        f014b63a9ad76e29ce9370a79f25111f

                                                                        SHA1

                                                                        8ea96f5da9f58ac6eedd293d5190c4d681d5f35b

                                                                        SHA256

                                                                        b880173bcd4c852950f6860daa288a624ef00695fca30a065c510b7e92bdac2c

                                                                        SHA512

                                                                        9f949af28c519b61c5c000437042f9e930c1470e699bcfb5521918c6cb1024f395e22908d88d2eb95c57e68d5730ea411913ee3c82c617c8823ea10aff4c301f

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\0jHz5cX0Y\SYSDM.CPL
                                                                        Filesize

                                                                        1.2MB

                                                                        MD5

                                                                        a82dd07c9b62daff98c0cd6d0b374e27

                                                                        SHA1

                                                                        41f98fa1500ddac41015eb2238d6e498693b2200

                                                                        SHA256

                                                                        6abfa953dc1bde74b6c74901cc6b9d3f54fa17816b1e84a4b28994df5eec071b

                                                                        SHA512

                                                                        805e1b14d0d9e7b9645cfb095456b3f91b2aa2867354901f9a23d483f0f6e7b60dbf596b7a7361a2276775eb9e9cbaf497c4947b5c7630da02688da61f9815ac

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\0jHz5cX0Y\SystemPropertiesProtection.exe
                                                                        Filesize

                                                                        82KB

                                                                        MD5

                                                                        26640d2d4fa912fc9a354ef6cfe500ff

                                                                        SHA1

                                                                        a343fd82659ce2d8de3beb587088867cf2ab8857

                                                                        SHA256

                                                                        a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37

                                                                        SHA512

                                                                        26162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\BAWF3B4Xm\WMPDMC.exe
                                                                        Filesize

                                                                        1.5MB

                                                                        MD5

                                                                        59ce6e554da0a622febce19eb61c4d34

                                                                        SHA1

                                                                        176a4a410cb97b3d4361d2aea0edbf17e15d04c7

                                                                        SHA256

                                                                        c36eba7186f7367fe717595f3372a49503c9613893c2ab2eff38b625a50d04ba

                                                                        SHA512

                                                                        e9b0d310416b66e0055381391bb6b0c19ee26bbcf0e3bb9ea7d696d5851e6efbdd9bdeb250c74638b7d73b20528ea1dfb718e75ad5977aaad77aae36cc7b7e18

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\BAWF3B4Xm\dwmapi.dll
                                                                        Filesize

                                                                        1.2MB

                                                                        MD5

                                                                        095e7b7a15e733757f8eb520b302aa59

                                                                        SHA1

                                                                        ebcdfdbaf92c50a144667d5e391b05caafe56d61

                                                                        SHA256

                                                                        fd26059c212783cfe464bdf22911878ca128a8ff4d28f0c4e4c62f5ff7be26fe

                                                                        SHA512

                                                                        f5cc9551ec74b3030240380da4b5109e810a089009dd7cbc992f9c67fd4a7577bb0d379c6bacbb47411470e69b66e586557848b79bae762c0c7ad408f020107b

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Eq3\MFC42u.dll
                                                                        Filesize

                                                                        1.2MB

                                                                        MD5

                                                                        9bc2e035813dffa457205f22ba59c3b2

                                                                        SHA1

                                                                        7f7e8f8099b47d07b5545e31907f2282bdabfab6

                                                                        SHA256

                                                                        0f96cff8b4d5ffe16989a6bbd05ad5ea6c8d7e33b005356810d7f36162938758

                                                                        SHA512

                                                                        3014755258bec3b4af2ef8b96d20a50bc254409d6522d502d47223e67172678c0d241f8613e31a1c1ae86ef69206512cfd52c679d85389bebfd65735748216c0

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Eq3\mmc.exe
                                                                        Filesize

                                                                        1.8MB

                                                                        MD5

                                                                        8c86b80518406f14a4952d67185032d6

                                                                        SHA1

                                                                        9269f1fbcf65fefbc88a2e239519c21efe0f6ba5

                                                                        SHA256

                                                                        895eef1eda5700a425934ae3782d4741dfefb7deafa53891bde490150187b98a

                                                                        SHA512

                                                                        1bbdaa3ae8b5716ad2bd517055533e286ddb8a6c23cbc7aa602143dbb1ae132b513088ab61527c49737c554269c51416cceb80206ac8128ac6b003f1864eb099

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        dce508c5c1f1bea2a42005ed4b5ff725

                                                                        SHA1

                                                                        2bdf3bc66ac80c52a64d9ae119e76666622d7f50

                                                                        SHA256

                                                                        c90d4da2b36a8ea9d4ee300e49161a5080a28eb0a1953879e58fcf376628c0a8

                                                                        SHA512

                                                                        8ce3b2cb061c051492fba1b4facabfde298665e73bbaaa04c9b78dae82c1158659ce3853cdb5c388c44843d0f5729260a73ff38af991166f7ec2a5925dac33ed

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133685387728663303.txt
                                                                        Filesize

                                                                        74KB

                                                                        MD5

                                                                        459a3c0fa5e832049f7fe20a24f6b010

                                                                        SHA1

                                                                        c6612155a83c8f52d3a2c25a4cc84fcdc146caf0

                                                                        SHA256

                                                                        90be670d8e3963e7a5e3eb4c714b78302e2eebb77653e3dba3f819872c042da6

                                                                        SHA512

                                                                        f328f63e0f3eff216021b628ebad7c4f4a61ec53e592cd414195a29ae12ead9c93d5019fd2534e0f36ee358530891d40e70069d4ec47f29a44599df1e3ed7429

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PNRCYTYY\microsoft.windows[1].xml
                                                                        Filesize

                                                                        97B

                                                                        MD5

                                                                        5e22ac0cbcc2cfca04d1b6983de47d88

                                                                        SHA1

                                                                        2cec1efb9cc1a5882ea7880bfcbe947c3361c37f

                                                                        SHA256

                                                                        15c78df0dc6078f22a8655187b6bc79f1142f5ca86fc151e361b748b119bdc4d

                                                                        SHA512

                                                                        fe181661eb50f5460f51015d576f688ffd9aa9a9c8e2dd1308416a15e2784d5fd1c0dfb3e2819c357c999aa9be208b372b185616e17c3691cf798e4e861bf870

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\bFkYqBuno\WTSAPI32.dll
                                                                        Filesize

                                                                        1.2MB

                                                                        MD5

                                                                        bba5ef7ebe5197b3cffa35f8a240ba27

                                                                        SHA1

                                                                        09b206907198522647b4c7aa754031b7dc6ca658

                                                                        SHA256

                                                                        74f77c67effcbb43fd1eb9ad3342e14bb1c0755aaee71f887048b2b6bf35ddb0

                                                                        SHA512

                                                                        06aca4c116b25e254fa48304bc02aeca105768bf99af0682792d9979975424caa8e34329ef83c49f76cad846b8488062f9ec39ff762a8a883166960fd0444a1e

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\bFkYqBuno\raserver.exe
                                                                        Filesize

                                                                        132KB

                                                                        MD5

                                                                        d1841c6ee4ea45794ced131d4b68b60e

                                                                        SHA1

                                                                        4be6d2116060d7c723ac2d0b5504efe23198ea01

                                                                        SHA256

                                                                        38732626242988cc5b8f97fe8d3b030d483046ef66ea90d7ea3607f1adc0600d

                                                                        SHA512

                                                                        d8bad215872c5956c6e8acac1cd3ad19b85f72b224b068fb71cfd1493705bc7d3390853ba923a1aa461140294f8793247df018484a378e4f026c2a12cb3fa5c9

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Plbydas.lnk
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        275c9fefa03ac805420d546909b42403

                                                                        SHA1

                                                                        aed4623666acb17c8c1589600267538be30fc736

                                                                        SHA256

                                                                        e80ab813f872b8dcfd1861d600965e0e3d50095d52dd982f947b97e7be6b7d2d

                                                                        SHA512

                                                                        c4502bf3b13511d2b3f63a0aaa2f2cc5257a2d75e44667702112a3070ba466c03bf48e7678cdc3dbd75ee8afaaf203deb523bea1c665a5661d7257601ecd3dae

                                                                        Download Submit

                                                                      • memory/652-328-0x0000000004E70000-0x0000000004E71000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/1424-479-0x0000027DE0700000-0x0000027DE0800000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/2292-204-0x00000263DE6A0000-0x00000263DE6C0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2292-173-0x00000263DE0D0000-0x00000263DE0F0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2292-185-0x00000263DE090000-0x00000263DE0B0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2836-166-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/2840-331-0x0000021982500000-0x0000021982600000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/2840-356-0x00000219838A0000-0x00000219838C0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2840-344-0x0000021983290000-0x00000219832B0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2840-329-0x0000021982500000-0x0000021982600000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/2840-330-0x0000021982500000-0x0000021982600000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/2840-334-0x00000219832D0000-0x00000219832F0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3492-9-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-24-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-4-0x0000000002A60000-0x0000000002A61000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/3492-6-0x00007FFE082BA000-0x00007FFE082BB000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/3492-13-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-14-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-29-0x00007FFE095D0000-0x00007FFE095E0000-memory.dmp

                                                                        Filesize

                                                                        64KB

                                                                        Download

                                                                      • memory/3492-28-0x0000000002100000-0x0000000002107000-memory.dmp

                                                                        Filesize

                                                                        28KB

                                                                        Download

                                                                      • memory/3492-16-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-15-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-12-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-155-0x00000000005B0000-0x00000000005B1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/3492-152-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-36-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-7-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-8-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-11-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3492-10-0x0000000140000000-0x0000000140130000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3556-50-0x00007FFDEBEC0000-0x00007FFDEBFF7000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3556-46-0x00007FFDEBEC0000-0x00007FFDEBFF7000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3556-49-0x0000000002820000-0x0000000002827000-memory.dmp

                                                                        Filesize

                                                                        28KB

                                                                        Download

                                                                      • memory/3752-80-0x00007FFDEBF60000-0x00007FFDEC091000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/3752-74-0x0000023433290000-0x0000023433297000-memory.dmp

                                                                        Filesize

                                                                        28KB

                                                                        Download

                                                                      • memory/4220-96-0x00007FFDEBF60000-0x00007FFDEC091000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/4496-60-0x000001A37EAC0000-0x000001A37EAC7000-memory.dmp

                                                                        Filesize

                                                                        28KB

                                                                        Download

                                                                      • memory/4496-57-0x00007FFDEBF60000-0x00007FFDEC091000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/4496-63-0x00007FFDEBF60000-0x00007FFDEC091000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/4676-477-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/5024-0-0x000001FEE3A90000-0x000001FEE3A97000-memory.dmp

                                                                        Filesize

                                                                        28KB

                                                                        Download

                                                                      • memory/5024-38-0x00007FFDFAE20000-0x00007FFDFAF50000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download

                                                                      • memory/5024-1-0x00007FFDFAE20000-0x00007FFDFAF50000-memory.dmp

                                                                        Filesize

                                                                        1.2MB

                                                                        Download