Overview

overview

10

Static

static

3

d90772cad3...18.exe

windows7-x64

10

d90772cad3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 20:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d90772cad31a0ce88d0bf2c623b295de_JaffaCakes118.exe

  • Size

    272KB

  • MD5

    d90772cad31a0ce88d0bf2c623b295de

  • SHA1

    3309ed44deae3592bb9bf0acf3306faecd658ae6

  • SHA256

    1e250895a6f6259841de0aa6a237ff6f442b2486b669d19d87958e70e7dab725

  • SHA512

    bdc92bbfbd794242770b5a84aa633e1e1798b43ba9947dcb4b0b4a761e4f09a728d5b0ad76c6544b84579d9b57dd22d2835ac35da39ffe84d0caf9320a33b53f

  • SSDEEP

    6144:FnZ8fURX43brkU65X++d0gRBqELqj2TOEnsu6khzv:zrRXgbhKOM0gLq8q9Ensu6g

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 16 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 32 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\d90772cad31a0ce88d0bf2c623b295de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d90772cad31a0ce88d0bf2c623b295de_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2164
    • C:\Users\Admin\AppData\Local\Temp\d90772cad31a0ce88d0bf2c623b295de_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d90772cad31a0ce88d0bf2c623b295de_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\3A74F\866B4.exe%C:\Users\Admin\AppData\Roaming\3A74F
      2⤵
      • System Location Discovery: System Language Discovery
      PID:740
    • C:\Users\Admin\AppData\Local\Temp\d90772cad31a0ce88d0bf2c623b295de_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d90772cad31a0ce88d0bf2c623b295de_JaffaCakes118.exe startC:\Program Files (x86)\4FA28\lvvm.exe%C:\Program Files (x86)\4FA28
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4316
    • C:\Program Files (x86)\LP\B4D3\2239.tmp
      "C:\Program Files (x86)\LP\B4D3\2239.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4184
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2616
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4964
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4368
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4464
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2952
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3992
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3332
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2124
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3516
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2420
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4288
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1648
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3796
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2512
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4428
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2420
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5012
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1504
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3928
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1828
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2744
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1156
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4328
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3576
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2508
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4808
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4972
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3428
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3332
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1696
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2400
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4192
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4008
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2120
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5072
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2424
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3884
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1960
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Modifies registry class
    PID:3116
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:4156
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:1064
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3272
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2596
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1988
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3652
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:1520

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Defense Evasion

                Modify Registry

                5
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                3
                T1552

                Credentials In Files

                3
                T1552.001

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Data from Local System

                2
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files (x86)\LP\B4D3\2239.tmp
                  Filesize

                  98KB

                  MD5

                  7f24ec71616910e4c78f80df4e97b421

                  SHA1

                  587ff8f80d98b71992565a99f384145032a5469f

                  SHA256

                  cb7cccc09d59a884171dd7cfa74f7915505c6b5277e4157bc40e19fe3a54fe25

                  SHA512

                  521669f5bdf1626c6172c6b2c2ebe6ddee1f6c5f564dec8291fb0f97de28c8892ded414673052a65b3f6886f492b212ed52e6712fa95af8341e6119e2b92e605

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                  Filesize

                  471B

                  MD5

                  d625606b952644a70d5698dd34bd14b8

                  SHA1

                  a230ca74d94a8191ff13fdd8501f4bceb61131a9

                  SHA256

                  d5ba357a39c42632cf50fd5d9bcb15670e84f28a6dfa70ca7d38862e1ca4cb23

                  SHA512

                  ef4382bc36f0f358b489a27488fba8743c77f74f53e9182a204d942b08ebdc0e703ce0ad065a9f80ea20df0f35b870ad7ad06a8ef31274cc0c727c44473efa71

                  Download Submit

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                  Filesize

                  420B

                  MD5

                  6632b3345b6a301e41174fb6c4d3d0aa

                  SHA1

                  515d2fc04820a5a11eb3c552d55b00c2dbec0436

                  SHA256

                  9dfbe57007e622886f6996ea8729c79662bd8d6fbdd7289157701d39f7b4e986

                  SHA512

                  b3fc826f22a0d24bb3a1361612eff739059a20ca2645bc1ebaaeeb78bb0c5bd7e602450c8551c2e81b2edf77bc979b9f83cc8a8c0092235602e9f5566c356a18

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                  Filesize

                  2KB

                  MD5

                  339f2bed028ed0352c42661321fa6a36

                  SHA1

                  8b83f0edef64cd0642af763856300be4eb6b0796

                  SHA256

                  c4efd767dd416e998b11866d4b8559638e2d33d4cdadb8cd60c56ee4e4cb5332

                  SHA512

                  0ce8039abde5215d1ef03c01655c978d43794e9905e527ac8e94b7832787e4f342de64dabae70b823fc51cc0de455cc629e61b3552c05e227f8b8d53c203a0e0

                  Download Submit

                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\IHOCIHIW\microsoft.windows[1].xml
                  Filesize

                  96B

                  MD5

                  10447c28373b986c3dce4e7f2156814c

                  SHA1

                  03a482fa42dea8871c350394101b11f341ef6762

                  SHA256

                  376615a0b4dac87295162c3d924e67e4bf0dd77e02af1264c1520f22ec5378d8

                  SHA512

                  4fab536505b12b462254a2cfad102fabf29161a25f824de2b0201265c406f6a14b13049767bb2a6afff5ffe5e7703be0b7906a1740fea3d0dc2d6d8c13459abd

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\3A74F\FA28.A74
                  Filesize

                  996B

                  MD5

                  789fc3ffd69458d1f54f7f73d5817f6a

                  SHA1

                  3fcb28bf401110f4892f71b98904a5a1fbfcf5be

                  SHA256

                  a2a57245f8c2c5ef42ef7686192a5c482ac4896e576e1e89bf91e577a48f55d1

                  SHA512

                  b00867ef35d95cad7d3c328a7eb166ee65e7a76da843adff76129c66e59ce917f1fe7c3540bc088ae9401a8cb25e0637a8094d49bd25e850c6660e6420d590b7

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\3A74F\FA28.A74
                  Filesize

                  600B

                  MD5

                  3f57751853950b222a97c8a4d6362023

                  SHA1

                  9d4a5efb7c8c6569d640065f6c38871a78539906

                  SHA256

                  e52a527d750c08603cf4235efc58c6f7579a1d1d33819d804cb0e3737c51376c

                  SHA512

                  80eeda960aaa5cc5651f0eb72eac34896dbb810c4abf7beb0f309679c8e3d851a52a7448a295bc76a5abd8444c4ba2545a3c6c3a32462844556418664e52bb7a

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\3A74F\FA28.A74
                  Filesize

                  1KB

                  MD5

                  3adbab1ec2cd966d57e2d1636c059e2f

                  SHA1

                  16732b129bce9157b353d37882bfcdf14a4be400

                  SHA256

                  b071de7fee786d998ae9f752f6aa280667421308a8f6f5d3498416bcb6516ab4

                  SHA512

                  d40e7f9e70a3379ee6d1c4a74fd5352c803264beb983790f8f2c44600c303ac94f03b975733fc696695bf5a040c68daa0621f7550aabeb76edd077317c869cf9

                  Download Submit

                • memory/740-17-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/740-16-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/1156-626-0x0000000004610000-0x0000000004611000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1648-328-0x00000000049F0000-0x00000000049F1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1696-924-0x00000000022D0000-0x00000000022D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1960-1219-0x000002760D100000-0x000002760D200000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/1960-1220-0x000002760D100000-0x000002760D200000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/1960-1223-0x000002760E1C0000-0x000002760E1E0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1960-1236-0x000002760E180000-0x000002760E1A0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1960-1255-0x000002760E590000-0x000002760E5B0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/1960-1218-0x000002760D100000-0x000002760D200000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/2164-623-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/2164-14-0x0000000000400000-0x0000000000467000-memory.dmp

                  Filesize

                  412KB

                  Download

                • memory/2164-482-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/2164-0-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/2164-2-0x0000000000400000-0x0000000000467000-memory.dmp

                  Filesize

                  412KB

                  Download

                • memory/2164-3-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/2164-13-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/2164-624-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/2164-184-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/2164-311-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/2424-1216-0x00000000043F0000-0x00000000043F1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2512-366-0x0000023240C60000-0x0000023240C80000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/2512-335-0x0000023240800000-0x0000023240820000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/2512-330-0x000002323F700000-0x000002323F800000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/2512-356-0x00000232407C0000-0x00000232407E0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3332-788-0x000001DC8CFE0000-0x000001DC8D000000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3332-819-0x000001DC8D6B0000-0x000001DC8D6D0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3332-802-0x000001DC8CFA0000-0x000001DC8CFC0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3576-630-0x0000029649820000-0x0000029649920000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/3576-629-0x0000029649820000-0x0000029649920000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/3576-628-0x0000029649820000-0x0000029649920000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/3576-633-0x000002964A980000-0x000002964A9A0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3576-643-0x000002964A940000-0x000002964A960000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3576-665-0x000002964AD50000-0x000002964AD70000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4008-1065-0x0000000004E80000-0x0000000004E81000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4184-320-0x0000000000400000-0x000000000041C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/4192-931-0x000002B43C8D0000-0x000002B43C8F0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4192-928-0x000002AC3A770000-0x000002AC3A870000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/4192-927-0x000002AC3A770000-0x000002AC3A870000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/4192-926-0x000002AC3A770000-0x000002AC3A870000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/4192-940-0x000002B43C890000-0x000002B43C8B0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4192-948-0x000002B43CCA0000-0x000002B43CCC0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/4316-121-0x0000000000400000-0x0000000000469000-memory.dmp

                  Filesize

                  420KB

                  Download

                • memory/4428-484-0x0000000004F10000-0x0000000004F11000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4972-781-0x00000000041A0000-0x00000000041A1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5012-506-0x000001CA43A70000-0x000001CA43A90000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5012-491-0x000001CA43AB0000-0x000001CA43AD0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5012-487-0x000001CA42C00000-0x000001CA42D00000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/5012-486-0x000001CA42C00000-0x000001CA42D00000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/5012-488-0x000001CA42C00000-0x000001CA42D00000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/5012-523-0x000001CA44080000-0x000001CA440A0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5072-1068-0x00000294CAC00000-0x00000294CAD00000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/5072-1084-0x0000029CCCC80000-0x0000029CCCCA0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5072-1104-0x0000029CCD090000-0x0000029CCD0B0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5072-1072-0x0000029CCCCC0000-0x0000029CCCCE0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5072-1067-0x00000294CAC00000-0x00000294CAD00000-memory.dmp

                  Filesize

                  1024KB

                  Download