4dcbe8b15e0ee97161e3dbd754d51306c6080a09aa613588ba58a05d6ec87fb0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe
Size

540KB
MD5

d0bf082b6fa86397d21de881f51782c8
SHA1

04bee51904dd5296447c78aea94f8ef902889787
SHA256

4dcbe8b15e0ee97161e3dbd754d51306c6080a09aa613588ba58a05d6ec87fb0
SHA512

544e743f5c484d6b7d003318caa79ddd5cbf61aedadde802be4eaa0cb99a8c10fadd5af76f07fd3ba5527b3586ecebef2cb891d9762f1986008032bbfb8630b1
SSDEEP

12288:tO0JRpI6W52V+DjWAgPD9RiuzLnmO8ilaYjcgAiJAiYuCXm:AOWzDjWA+TiuzLnmO8ilaYjcriJAiYnW

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7KOJN26H-1U22-2QPE-E616-8SH3P2Q4A3U7}	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7KOJN26H-1U22-2QPE-E616-8SH3P2Q4A3U7}\StubPath = "C:\\Windows\\System32\\Defender.exe.exe Restart"	iexplore.exe

Executes dropped EXE 1 IoCs

pid	Process
2012	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\System32\\Defender.exe.exe"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\System32\\Defender.exe.exe"	iexplore.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Defender.exe.exe	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Defender.exe.exe	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1188 set thread context of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2012	svchost.exe
2012	svchost.exe
2012	svchost.exe
2012	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	svchost.exe
Token: SeDebugPrivilege	2012	svchost.exe
Token: SeDebugPrivilege	2012	svchost.exe
Token: SeDebugPrivilege	2012	svchost.exe
Token: SeDebugPrivilege	4012	iexplore.exe
Token: SeDebugPrivilege	4012	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 348	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	86
PID 1188 wrote to memory of 348	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	86
PID 1188 wrote to memory of 348	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	86
PID 348 wrote to memory of 3980	348	csc.exe	88
PID 348 wrote to memory of 3980	348	csc.exe	88
PID 348 wrote to memory of 3980	348	csc.exe	88
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 1188 wrote to memory of 2012	1188	d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe	89
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90
PID 2012 wrote to memory of 4012	2012	svchost.exe	90

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:388

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:804
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2940
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3792
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3928
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3996
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4088
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3636
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3728
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2592
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:4272
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3660
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1332
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1120
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1468
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:64

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2684

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2932

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d0bf082b6fa86397d21de881f51782c8_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2xzdazxa.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:348
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E64.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9E63.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3980
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    C:\Users\Admin\AppData\Roaming\svchost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3868

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:5064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2xzdazxa.dll

Filesize
5KB

MD5
f85b9f98bc47e8013a66b04d9ac44abe

SHA1
4e6f5a7480c11a832aa4694338258787ead873a6

SHA256
6c66951ec81668a8854f1f1ade275ee85149dc5e922f8276b861a84e93aec9ee

SHA512
dc3d3e815320feec3af7c3657de9e220e27e28ac8f7d188d60664feb1949abfa34e40be99da8dce9b25003b63905746a71655b0cb00767d05f68e8327c1ed4ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9E64.tmp

Filesize
1KB

MD5
0a96d8c40b42c9a242fd329154f1daed

SHA1
14c10b7138186df8564997a64df0db5800549d75

SHA256
1c95ab15af3fa64f3b8b744c2ce73c242cd8b0b3614931c1544a7b76984f28df

SHA512
d148db8602641c0f1bdaf72695c4c289b5e197577d7ee02f4889ba087f067dfd5c093441999ae0c2bb6911a7314558143770d4a13d9262e75880f4765dc8463a

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
12KB

MD5
ff9b996b9ade7d195f1987ac14942bb5

SHA1
e4ad29fe240cdf1757a6bbecafe5b603b4f197b8

SHA256
b730bb91e6ed17be27f9badd4b41398020b5ef50b26bd702a92e92cf53e5edf4

SHA512
48d4201f8b43ed4fb1d678253cde247693f5e73b0df7e7b32ad6652c2cb01b9ec12744c9a9bce0114558d9a0a0dc28efd948172a6ea8c301262661d2492eb202

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2xzdazxa.0.cs

Filesize
4KB

MD5
2216d197bc442e875016eba15c07a937

SHA1
37528e21ea3271b85d276c6bd003e6c60c81545d

SHA256
2e9e3da7bfa1334706550bb4d6269bf3e64cbbc09fa349af52eb22f32aebb4af

SHA512
7d7bdc3bf83ac0a29e917ead899dcaa1b47ee2660f405fe4883ca2a2546f7924265e1d75a2ea02c0e34fac4d2bb82bbaaa88d06c240afad4e9fd49337cd04d3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2xzdazxa.cmdline

Filesize
206B

MD5
fa23a91ace63f952fae100cd37e9a499

SHA1
006902ccb0c26723dda98cd9e1a6d2ab3af6be11

SHA256
075a95e37e7e9fc264d9cffecac347f6a6ed4902c37e52c8a0b0f4d5edcdcb21

SHA512
252a910330b872f54983727791a0ab553fe4cabf0906bb89fdb6f3b38dbb8a1867e0cf62120338d84c04253635746e423e93cba18e2382bd2062210d7cbed8f3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC9E63.tmp

Filesize
652B

MD5
79946ff98ea8943da18ef0d107f451dd

SHA1
25d3a0f8c04b205e6c64c63258b6be8b4ff1bb66

SHA256
b36158caa0727eb956130224b32e2e73adec3ebd5a4063526dfd6a168c0c4b93

SHA512
a99d05bc9c6300a471a598dd734632e240a948699e1e956b5ef36d09d329d65646c7269ae33e32a5f5f6ff5c96445eab4ed285d467603e306efd52e315fd5700

Download Submit
memory/348-9-0x0000000075120000-0x00000000756D1000-memory.dmp

Filesize
5.7MB

Download
memory/348-16-0x0000000075120000-0x00000000756D1000-memory.dmp

Filesize
5.7MB

Download
memory/1188-27-0x0000000075120000-0x00000000756D1000-memory.dmp

Filesize
5.7MB

Download
memory/1188-1-0x0000000075120000-0x00000000756D1000-memory.dmp

Filesize
5.7MB

Download
memory/1188-2-0x0000000075120000-0x00000000756D1000-memory.dmp

Filesize
5.7MB

Download
memory/1188-0-0x0000000075122000-0x0000000075123000-memory.dmp

Filesize
4KB

Download
memory/2012-28-0x0000000010410000-0x0000000010441000-memory.dmp

Filesize
196KB

Download
memory/2012-51-0x00000000024A0000-0x00000000024AA000-memory.dmp

Filesize
40KB

Download
memory/2012-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-20-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-29-0x0000000010410000-0x0000000010441000-memory.dmp

Filesize
196KB

Download
memory/2012-35-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/2012-43-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/2012-50-0x00000000024A0000-0x00000000024AA000-memory.dmp

Filesize
40KB

Download
memory/2012-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-57-0x00000000024B0000-0x00000000024BA000-memory.dmp

Filesize
40KB

Download
memory/2012-58-0x00000000024B0000-0x00000000024BA000-memory.dmp

Filesize
40KB

Download
memory/2012-64-0x00000000024C0000-0x00000000024CA000-memory.dmp

Filesize
40KB

Download
memory/2012-65-0x00000000024C0000-0x00000000024CA000-memory.dmp

Filesize
40KB

Download
memory/2012-72-0x00000000024D0000-0x00000000024DA000-memory.dmp

Filesize
40KB

Download
memory/2012-79-0x00000000024E0000-0x00000000024EA000-memory.dmp

Filesize
40KB

Download
memory/2012-85-0x0000000010450000-0x000000001045A000-memory.dmp

Filesize
40KB

Download
memory/2012-86-0x0000000010450000-0x000000001045A000-memory.dmp

Filesize
40KB

Download
memory/2012-597-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-629-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download