Overview

overview

10

Static

static

3

c9e58b2a97...18.exe

windows7-x64

10

c9e58b2a97...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    63s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/08/2024, 00:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c9e58b2a97ae070b5088767bd3a26bee_JaffaCakes118.exe

  • Size

    920KB

  • MD5

    c9e58b2a97ae070b5088767bd3a26bee

  • SHA1

    344c10fe8276bb8264d23b78ffa6a875e5a6be60

  • SHA256

    13ebf75ae98a014c1f455628bcae58820f1e7ecc023991836fa18f0e67463b38

  • SHA512

    ff98adf51bb65bb551f129ccaf1ba391ded4d52d5921dd9369ee63c502cdc1f0cffbcc5ad3f7e058221dd43484cab78bd54cf0bcb3286a0736706452e116c493

  • SSDEEP

    24576:kJXWAayET+QuawV+XTUknfiuG7weke8juowZKMnunK:5TzuaxjnsywKMnY

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 4 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 43 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3472
    • C:\Users\Admin\AppData\Local\Temp\c9e58b2a97ae070b5088767bd3a26bee_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\c9e58b2a97ae070b5088767bd3a26bee_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Users\Admin\MDdyAsuPL1.exe
        C:\Users\Admin\MDdyAsuPL1.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Users\Admin\wiuut.exe
          "C:\Users\Admin\wiuut.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:3832
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del MDdyAsuPL1.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:428
      • C:\Users\Admin\2eaj.exe
        C:\Users\Admin\2eaj.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Users\Admin\2eaj.exe
          "C:\Users\Admin\2eaj.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1560
        • C:\Users\Admin\2eaj.exe
          "C:\Users\Admin\2eaj.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3916
        • C:\Users\Admin\2eaj.exe
          "C:\Users\Admin\2eaj.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1812
        • C:\Users\Admin\2eaj.exe
          "C:\Users\Admin\2eaj.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4132
        • C:\Users\Admin\2eaj.exe
          "C:\Users\Admin\2eaj.exe"
          4⤵
          • Executes dropped EXE
          PID:4724
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 80
            5⤵
            • Program crash
            PID:4236
      • C:\Users\Admin\3eaj.exe
        C:\Users\Admin\3eaj.exe
        3⤵
        • Modifies security service
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3432
        • C:\Users\Admin\3eaj.exe
          C:\Users\Admin\3eaj.exe startC:\Users\Admin\AppData\Roaming\4F1DF\3D648.exe%C:\Users\Admin\AppData\Roaming\4F1DF
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3440
        • C:\Users\Admin\3eaj.exe
          C:\Users\Admin\3eaj.exe startC:\Program Files (x86)\DFE47\lvvm.exe%C:\Program Files (x86)\DFE47
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3344
        • C:\Program Files (x86)\LP\4894\2064.tmp
          "C:\Program Files (x86)\LP\4894\2064.tmp"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3744
      • C:\Users\Admin\4eaj.exe
        C:\Users\Admin\4eaj.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3880
        • C:\Users\Admin\AppData\Local\5f0d574a\X
          *0*bc*278bf32f*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1652
      • C:\Users\Admin\5eaj.exe
        C:\Users\Admin\5eaj.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2008
        • C:\Users\Admin\AppData\Roaming\xtmmkhheaqet2gvhlbijras1ietdqv2y2\svcnost.exe
          "C:\Users\Admin\AppData\Roaming\xtmmkhheaqet2gvhlbijras1ietdqv2y2\svcnost.exe"
          4⤵
          • Modifies firewall policy service
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          PID:952
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del c9e58b2a97ae070b5088767bd3a26bee_JaffaCakes118.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1224
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3932
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4724 -ip 4724
    1⤵
      PID:928
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1164
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4348
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2192
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3864
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2076
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1508
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      PID:4348
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1748
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4160
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:3760
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4020
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3624
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4092
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3448
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2008
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3484
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:216
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4620
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3140
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:924
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:880
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Modifies registry class
      PID:3160
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3904
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:2100
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4612
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:5040
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:2724
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3528
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:2208
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:3496
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4924
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:2656
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:1508
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:752
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:1296
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4940
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:5040
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3440
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:2328
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4288
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1612
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4268
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3468
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4320
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4084
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1564
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:1996
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:4212
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:2196
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:220
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3488
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3356
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:4940
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:1996
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3488
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:2432
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:1772
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4528
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:4456
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:4248
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:2748
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:4744
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:2036
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:752
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3180
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:2532
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3940
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:1884
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:2432
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:4288
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:512
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:928
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:2160
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:4448
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:2208

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Reconnaissance

                                                                                                              Resource Development

                                                                                                              Initial Access

                                                                                                              Execution

                                                                                                              Persistence

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              2
                                                                                                              T1547

                                                                                                              Active Setup

                                                                                                              1
                                                                                                              T1547.014

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Create or Modify System Process

                                                                                                              2
                                                                                                              T1543

                                                                                                              Windows Service

                                                                                                              2
                                                                                                              T1543.003

                                                                                                              Privilege Escalation

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              2
                                                                                                              T1547

                                                                                                              Active Setup

                                                                                                              1
                                                                                                              T1547.014

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Create or Modify System Process

                                                                                                              2
                                                                                                              T1543

                                                                                                              Windows Service

                                                                                                              2
                                                                                                              T1543.003

                                                                                                              Defense Evasion

                                                                                                              Hide Artifacts

                                                                                                              1
                                                                                                              T1564

                                                                                                              Hidden Files and Directories

                                                                                                              1
                                                                                                              T1564.001

                                                                                                              Impair Defenses

                                                                                                              1
                                                                                                              T1562

                                                                                                              Disable or Modify System Firewall

                                                                                                              1
                                                                                                              T1562.004

                                                                                                              Modify Registry

                                                                                                              7
                                                                                                              T1112

                                                                                                              Credential Access

                                                                                                              Credentials from Password Stores

                                                                                                              1
                                                                                                              T1555

                                                                                                              Credentials from Web Browsers

                                                                                                              1
                                                                                                              T1555.003

                                                                                                              Unsecured Credentials

                                                                                                              3
                                                                                                              T1552

                                                                                                              Credentials In Files

                                                                                                              3
                                                                                                              T1552.001

                                                                                                              Discovery

                                                                                                              Peripheral Device Discovery

                                                                                                              3
                                                                                                              T1120

                                                                                                              Process Discovery

                                                                                                              1
                                                                                                              T1057

                                                                                                              Query Registry

                                                                                                              6
                                                                                                              T1012

                                                                                                              System Information Discovery

                                                                                                              5
                                                                                                              T1082

                                                                                                              System Location Discovery

                                                                                                              1
                                                                                                              T1614

                                                                                                              System Language Discovery

                                                                                                              1
                                                                                                              T1614.001

                                                                                                              Lateral Movement

                                                                                                              Collection

                                                                                                              Data from Local System

                                                                                                              2
                                                                                                              T1005

                                                                                                              Command and Control

                                                                                                              Exfiltration

                                                                                                              Impact

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Program Files (x86)\LP\4894\2064.tmp
                                                                                                                Filesize

                                                                                                                100KB

                                                                                                                MD5

                                                                                                                8659e2fdb286421874e997e5b1d56ae4

                                                                                                                SHA1

                                                                                                                e3b46183011a317dd80baf92ff9ef1b2da53cc05

                                                                                                                SHA256

                                                                                                                80ceedded02c13a9c4ade2d2242b2bb295bc122b5c7c0f6b3332b0f4fceae2b8

                                                                                                                SHA512

                                                                                                                ae12fd737c0a6f765ebe7a6e312230220e5fb79d42c1478a6f00edf5e67b6dec201aee90d3082b7817726c6501c7c94ce4a8eab72b2a00547bfdc382bbf2a8dc

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\2eaj.exe
                                                                                                                Filesize

                                                                                                                132KB

                                                                                                                MD5

                                                                                                                afaca64214594290a9e01c2ab012f00c

                                                                                                                SHA1

                                                                                                                eb1183a49d6da506072d34673f60a623687d2f82

                                                                                                                SHA256

                                                                                                                ca9e0ce2d0cf500ddbad4e9ad42e6e4136e3fa351839ccc654f393e624528f7a

                                                                                                                SHA512

                                                                                                                9f91e78c3a1de2e877e16b3cc862bc512051ccd011868c333dc66487bf1979c5f52406fa3498996e397705050b9c41a65a318d1f72e1e611dd9e2674a794a8b7

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\3eaj.exe
                                                                                                                Filesize

                                                                                                                283KB

                                                                                                                MD5

                                                                                                                ab0bbc81ff15b6d295989e4076711c04

                                                                                                                SHA1

                                                                                                                99372e440fceb26128534ae44ba6649f4d6f5354

                                                                                                                SHA256

                                                                                                                b936e7056270188775662177402c86da4028950320a772f3d56763e2f935b4e5

                                                                                                                SHA512

                                                                                                                f1fa46e0fc9480766b68f7b3aba23bf41bb66e22d529d1006f5dbbfe467ec0bf490b50067184b38fa76639a76c15e88ca654544ea045bcbfce8c12d3d8347077

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\4eaj.exe
                                                                                                                Filesize

                                                                                                                273KB

                                                                                                                MD5

                                                                                                                90cfd3294a276c3bc20a9fddf574a8d1

                                                                                                                SHA1

                                                                                                                fc294843a290d0bc223e67f3370009e0bd63e3b8

                                                                                                                SHA256

                                                                                                                5b076d47b571824cd668c26e7fc0a53b54a58547b7cb6a70eccdf44b4ccbda14

                                                                                                                SHA512

                                                                                                                a1ffc3e46490c74e7cd45b919b4668e0f38cbf28b3c3b81a25c68233cd68b72a5d9444306b9e8ef03fa1739d441c7f6504a36aabc2c53a7025b3c6260adc1aeb

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\5eaj.exe
                                                                                                                Filesize

                                                                                                                121KB

                                                                                                                MD5

                                                                                                                6735cacc68031001bcf6459daa770b42

                                                                                                                SHA1

                                                                                                                78fc873eee60454534d7f39279d53d9bd9780c77

                                                                                                                SHA256

                                                                                                                b1a7250c0fc8caa1a26ca2ebf18507ba4dcc564149ccfa81ed07e4fe2fbed026

                                                                                                                SHA512

                                                                                                                ef092414d0b7f51ec8ec697148dba5656ba13987f2b7f746bda77267320dbbfdc0504e51699becbe30162ee0dd102cea80ab689f74221a2c6a50e1912ab82f08

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                Filesize

                                                                                                                471B

                                                                                                                MD5

                                                                                                                0ce07561c7c082db690c9fea54695ee1

                                                                                                                SHA1

                                                                                                                90b1cefb39e0c8be5fd9dcbf6d1b7270e67aeb37

                                                                                                                SHA256

                                                                                                                8d9fbfa75befc5d5cb1b3bc0aa2ff1422a92a3774238372c4fac8387ebcfb03d

                                                                                                                SHA512

                                                                                                                ae4b4d76f933ae5d71c230c11eff1df78a6d8d26a4ca552294bf45581002c429cf85ecd59ad93145c5d71cfdd98a88cdb38b45362fa23c9982ed0b38d27ffe87

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                Filesize

                                                                                                                420B

                                                                                                                MD5

                                                                                                                a2a26b1de81d22cd8fa51861aa49fe5e

                                                                                                                SHA1

                                                                                                                fd283549c592216f89bc26ecdad8be5c4bca3849

                                                                                                                SHA256

                                                                                                                bc2035c45dc859a48fbae4eff5b86bb41ccfd7ce6fdd0fb72c8ae67b2ae099ec

                                                                                                                SHA512

                                                                                                                ce06b39452d6b3bd6bb59cab4088310805b7091fa59f2fa92c9ec6795569593e8a5ddab678a52e56ebb1b120ffc424f31c674a89980912109f5cbdaa2c15dc66

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\5f0d574a\X
                                                                                                                Filesize

                                                                                                                38KB

                                                                                                                MD5

                                                                                                                72de2dadaf875e2fd7614e100419033c

                                                                                                                SHA1

                                                                                                                5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

                                                                                                                SHA256

                                                                                                                c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

                                                                                                                SHA512

                                                                                                                e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                bf114aadc8c011de342ffbbfd56f54bc

                                                                                                                SHA1

                                                                                                                3ed0ef9ae041628e986bb9a09fb580a0d7db6e70

                                                                                                                SHA256

                                                                                                                bf009f57719bbb907621f532aa9ca68173091b33004b7dee97cdf4b709d10a83

                                                                                                                SHA512

                                                                                                                7e5d6e132027933cffa4fffcf4d450af45033800e4e9512e56a33d34a4c89d1ef247ef41c25c7fe272e856b3dcf5da559c3fab149d22921f9868e3d3559d8c04

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133694504727523159.txt
                                                                                                                Filesize

                                                                                                                75KB

                                                                                                                MD5

                                                                                                                4d3ab4043917d5a20d76b8b24af1410a

                                                                                                                SHA1

                                                                                                                9dc49c68c99eeac24e21424242d6f9c574c705a6

                                                                                                                SHA256

                                                                                                                b95c87f3f0c108d523bb6eef85c237cfe5d7ff3ae8660fe2540efec53d4c9d09

                                                                                                                SHA512

                                                                                                                889eb5dbf8a86ccd8cb01defb2ff7bdeb104b874c195148eb5df8da78f8d7c57f99bd1e1f8aa1a320ce5ab75597b426e35219ba40498d56cb316b8442e08448e

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QKJHZK6M\microsoft.windows[1].xml
                                                                                                                Filesize

                                                                                                                96B

                                                                                                                MD5

                                                                                                                c80e07f2e2bce84e8f3380b42ba6bd94

                                                                                                                SHA1

                                                                                                                33e20b05fc67a22ac3f3c214a32057254f97f2e7

                                                                                                                SHA256

                                                                                                                14808d37f1d44780098ddc2af07f7862b3c0c5ab1bfed6b267621e0a332a8bbd

                                                                                                                SHA512

                                                                                                                f5adf8b7bbc1b450249034376f7df69eaf2a7be8e516d511bb82828c19efddbee9247d20e4b4c629b7fe58c9391c31fbf48bdb1b857ca13e5f52b80cb7883f24

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Roaming\4F1DF\FE47.F1D
                                                                                                                Filesize

                                                                                                                600B

                                                                                                                MD5

                                                                                                                179a987e887563b099b8bfad6019bf64

                                                                                                                SHA1

                                                                                                                a069f5657f07ab54dbb2d24e5ca3ea026eb9fedd

                                                                                                                SHA256

                                                                                                                34cbdc53fef5e60242a9f8f47eafd40db788ff5099b48fb6bf65286a179fb5f1

                                                                                                                SHA512

                                                                                                                982a19b6a5d40ef170e25dfc52a7f135f2596c80afb78c50d003d7b62f8ebed7d8cc10e19ecde251b56dc19a619b67fb9c6e12dda552ecdcd72fc1cbb8a8a9a6

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Roaming\4F1DF\FE47.F1D
                                                                                                                Filesize

                                                                                                                996B

                                                                                                                MD5

                                                                                                                7d1cde64e84c25bc4a0443c4974eb953

                                                                                                                SHA1

                                                                                                                3cc2f6e0afff8fe10e67cbdb7508b2b29e442bd8

                                                                                                                SHA256

                                                                                                                dea7f2a45a37f0b2ce3b6fe5ad83c784f45bca351cc3ed45c8ca8d7165d75589

                                                                                                                SHA512

                                                                                                                524755d44370783b0029b7f34232c805928b12c52ae4cefdec4cae8a47c33ec7d2e5e94f1a6d7b319cf3f1072f13c3674b8e65d754bac60695f6015be3bc4d3e

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Roaming\4F1DF\FE47.F1D
                                                                                                                Filesize

                                                                                                                1KB

                                                                                                                MD5

                                                                                                                f1f2b5363642389eb08089363b418a4d

                                                                                                                SHA1

                                                                                                                8cda4f80cf20fb71fcdc0da1ac8272d6dbd9d6af

                                                                                                                SHA256

                                                                                                                12121c5231ae6f4ebccca0ac70cf50d90df5f8d32dc8b73ba1842340cb5b82c9

                                                                                                                SHA512

                                                                                                                0953da6c774e47bf6d75dbed4afb8078c4e00f5bb93cff58a7846a7448f9fce0d794446c32b7a500d538f6dac278c4be5a6d084ed6090300e5c2dfde1c467757

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Roaming\desktop.ini
                                                                                                                Filesize

                                                                                                                9KB

                                                                                                                MD5

                                                                                                                4a27242b307c6a836993353035fafc16

                                                                                                                SHA1

                                                                                                                5fea7a41b8f9071848108015d8a952e6f944eea0

                                                                                                                SHA256

                                                                                                                02fd93f64bda51e1e2991184cac13f077d509712e462c9e44be9cf8e22c06de1

                                                                                                                SHA512

                                                                                                                35e9c87642b82df2bf0a9312bb0e9abfb98282db1e34032a4d0150d82c5e2f2e13150ddc896f1e954f02288a1e696a4306ee595b94b1e404c6ec17bac64c44be

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Roaming\ntuser.dat
                                                                                                                Filesize

                                                                                                                54KB

                                                                                                                MD5

                                                                                                                7e8e966927e04a35aec644602b8a9e05

                                                                                                                SHA1

                                                                                                                d201b0b41e8701818d60ddbf9f334332a512c4da

                                                                                                                SHA256

                                                                                                                46f18d9fbf63f378d86962cbf24f5ce57ce257555acd4effdcc41c1e2f1adf5c

                                                                                                                SHA512

                                                                                                                246777c79129a5076b71ca5d3f7e59b06d344f6b5e771892ae8ee68c0b5af9207cd1868b1336b49e6a84665309ad379a33ec6c8e72d7ce41de72153637921a51

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\MDdyAsuPL1.exe
                                                                                                                Filesize

                                                                                                                256KB

                                                                                                                MD5

                                                                                                                601683a024c1e27dd62d33de59536641

                                                                                                                SHA1

                                                                                                                4584d66af41c4f77a6e1b7df3dcd3e78217ad270

                                                                                                                SHA256

                                                                                                                11ba7731f1b9b48116167234553254116e86f06091b0bbd7eaf0cbea4c2df049

                                                                                                                SHA512

                                                                                                                b6ee2b371198d5a70124444596fb28831ec6b2f06910e0f772852f7d80ad2974373aead6f9597c61a89bd99496ca33a838030e458265f6ddea4920ffb0472008

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\wiuut.exe
                                                                                                                Filesize

                                                                                                                256KB

                                                                                                                MD5

                                                                                                                151d61c443ad33da77c27fad366c9c0d

                                                                                                                SHA1

                                                                                                                80518d8582ea0df2e20185b3395aedf3ffcb5152

                                                                                                                SHA256

                                                                                                                2858a5c051b5cda4fb12f1f02f17f8c9bb28667e492cf0af2cddd2a1d8419219

                                                                                                                SHA512

                                                                                                                040106cade9a8cc4de595a2a46dfde51df58ce1a719cef74c85211e1f0b7b3234566a3c6cb6a876b85f8cdda4515141efe8bbfb951e4b3936ee94c19607cbd46

                                                                                                                Download Submit

                                                                                                              • memory/952-226-0x0000000000400000-0x0000000000B19000-memory.dmp

                                                                                                                Filesize

                                                                                                                7.1MB

                                                                                                                Download

                                                                                                              • memory/952-107-0x0000000000EB0000-0x0000000000ECD000-memory.dmp

                                                                                                                Filesize

                                                                                                                116KB

                                                                                                                Download

                                                                                                              • memory/1508-409-0x000002A6F0570000-0x000002A6F0670000-memory.dmp

                                                                                                                Filesize

                                                                                                                1024KB

                                                                                                                Download

                                                                                                              • memory/1508-438-0x000002AEF2690000-0x000002AEF26B0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/1508-414-0x000002AEF26D0000-0x000002AEF26F0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/1508-445-0x000002AEF2AA0000-0x000002AEF2AC0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/1560-38-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                                Filesize

                                                                                                                28KB

                                                                                                                Download

                                                                                                              • memory/1560-35-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                                Filesize

                                                                                                                28KB

                                                                                                                Download

                                                                                                              • memory/1560-40-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                                Filesize

                                                                                                                28KB

                                                                                                                Download

                                                                                                              • memory/1560-66-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                                Filesize

                                                                                                                28KB

                                                                                                                Download

                                                                                                              • memory/1812-51-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                                                Filesize

                                                                                                                156KB

                                                                                                                Download

                                                                                                              • memory/1812-49-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                                                Filesize

                                                                                                                156KB

                                                                                                                Download

                                                                                                              • memory/1812-53-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                                                Filesize

                                                                                                                156KB

                                                                                                                Download

                                                                                                              • memory/1812-52-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                                                Filesize

                                                                                                                156KB

                                                                                                                Download

                                                                                                              • memory/2008-86-0x0000000000400000-0x0000000000B19000-memory.dmp

                                                                                                                Filesize

                                                                                                                7.1MB

                                                                                                                Download

                                                                                                              • memory/2008-121-0x0000000000400000-0x0000000000B19000-memory.dmp

                                                                                                                Filesize

                                                                                                                7.1MB

                                                                                                                Download

                                                                                                              • memory/3344-225-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                Filesize

                                                                                                                428KB

                                                                                                                Download

                                                                                                              • memory/3432-223-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                Filesize

                                                                                                                428KB

                                                                                                                Download

                                                                                                              • memory/3432-100-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                Filesize

                                                                                                                428KB

                                                                                                                Download

                                                                                                              • memory/3440-103-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                Filesize

                                                                                                                428KB

                                                                                                                Download

                                                                                                              • memory/3472-228-0x0000000000F20000-0x0000000000F21000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/3624-771-0x0000027719D40000-0x0000027719D60000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3624-747-0x0000027719970000-0x0000027719990000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3624-759-0x0000027719930000-0x0000027719950000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/3760-740-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/3864-407-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download

                                                                                                              • memory/3880-81-0x0000000030670000-0x00000000306BF000-memory.dmp

                                                                                                                Filesize

                                                                                                                316KB

                                                                                                                Download

                                                                                                              • memory/3916-43-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                Filesize

                                                                                                                56KB

                                                                                                                Download

                                                                                                              • memory/3916-41-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                Filesize

                                                                                                                56KB

                                                                                                                Download

                                                                                                              • memory/3916-44-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                Filesize

                                                                                                                56KB

                                                                                                                Download

                                                                                                              • memory/3916-46-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                Filesize

                                                                                                                56KB

                                                                                                                Download

                                                                                                              • memory/4132-54-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                                Filesize

                                                                                                                28KB

                                                                                                                Download

                                                                                                              • memory/4132-58-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                                Filesize

                                                                                                                28KB

                                                                                                                Download

                                                                                                              • memory/4132-56-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                                Filesize

                                                                                                                28KB

                                                                                                                Download

                                                                                                              • memory/4132-99-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                                                Filesize

                                                                                                                28KB

                                                                                                                Download

                                                                                                              • memory/4160-588-0x000002718CD00000-0x000002718CD20000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4160-610-0x000002718D0C0000-0x000002718D0E0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4160-599-0x000002718C9B0000-0x000002718C9D0000-memory.dmp

                                                                                                                Filesize

                                                                                                                128KB

                                                                                                                Download

                                                                                                              • memory/4348-580-0x0000000004130000-0x0000000004131000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                                Download