d806df6405ee274aca0b653a3e55e605fc39cff0dabc4bc3f2241217065b2cef

Analysis

max time kernel
25s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
Size

278KB
MD5

d9661054ea9d4d7f7169a5e32ba68822
SHA1

92c469afbc37b46afb9da836cf56fb22e641f8c5
SHA256

d806df6405ee274aca0b653a3e55e605fc39cff0dabc4bc3f2241217065b2cef
SHA512

b3c0da7738b0a9fb4be3a6537c9c13486dc251a8c65d1e79ac316a7b5d674843ff9501afd9f3ca2fd1edb4f2f17fab18e4e5a3eb93b313d2d70b7c2b47fafade
SSDEEP

6144:cWADCDvlryv64mSmW6yI6eOoq5UO1jQqRcm29I2oeVunDWAs:cVQrS9mZ3X6VoOUOXZ29srDW

Score

10^/10

discovery evasion persistence upx

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3"	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Disables taskbar notifications via registry modification
evasion

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4620-2-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral2/memory/4620-13-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral2/memory/3320-17-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral2/memory/3320-16-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral2/memory/4620-15-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/4620-75-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral2/memory/3288-77-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral2/memory/4620-499-0x0000000000400000-0x000000000046A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\D5B.exe = "C:\\Program Files (x86)\\LP\\D118\\D5B.exe"	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LP\D118\D5B.exe	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\LP\D118\D5B.exe	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{E8C75C86-9E21-449C-A9E7-F2668A536D7D}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000	explorer.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5088	msiexec.exe
Token: SeShutdownPrivilege	4444	explorer.exe
Token: SeCreatePagefilePrivilege	4444	explorer.exe
Token: SeShutdownPrivilege	4444	explorer.exe
Token: SeCreatePagefilePrivilege	4444	explorer.exe
Token: SeShutdownPrivilege	4444	explorer.exe
Token: SeCreatePagefilePrivilege	4444	explorer.exe
Token: SeShutdownPrivilege	4444	explorer.exe
Token: SeCreatePagefilePrivilege	4444	explorer.exe
Token: SeShutdownPrivilege	4444	explorer.exe
Token: SeCreatePagefilePrivilege	4444	explorer.exe
Token: SeShutdownPrivilege	4444	explorer.exe
Token: SeCreatePagefilePrivilege	4444	explorer.exe
Token: SeShutdownPrivilege	4444	explorer.exe
Token: SeCreatePagefilePrivilege	4444	explorer.exe
Token: SeShutdownPrivilege	4444	explorer.exe
Token: SeCreatePagefilePrivilege	4444	explorer.exe
Token: SeShutdownPrivilege	4444	explorer.exe
Token: SeCreatePagefilePrivilege	4444	explorer.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe
4444	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 3320	4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe	161
PID 4620 wrote to memory of 3320	4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe	161
PID 4620 wrote to memory of 3320	4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe	161
PID 4620 wrote to memory of 3288	4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe	98
PID 4620 wrote to memory of 3288	4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe	98
PID 4620 wrote to memory of 3288	4620	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe	98

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe"
1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4620
- C:\Users\Admin\AppData\Local\Temp\d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\892A1\E5AD1.exe%C:\Users\Admin\AppData\Roaming\892A1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d9661054ea9d4d7f7169a5e32ba68822_JaffaCakes118.exe startC:\Program Files (x86)\A1061\lvvm.exe%C:\Program Files (x86)\A1061
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3288
- C:\Program Files (x86)\LP\D118\7AC.tmp
  "C:\Program Files (x86)\LP\D118\7AC.tmp"
  2⤵
  PID:3424

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4444

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5108

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4880

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3600

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1256

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3340

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4300

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3904

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3188

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3924

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3128

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4580

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4608

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4996

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4300

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4812

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4452

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3328

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3696

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4608

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4684

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3784

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1812

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2512

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1424

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4420

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3320

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3580

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3620

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3872

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1592

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3276

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:832

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1516

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:400

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3788

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5000

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2548

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3868

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3016

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1700

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4184

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2328

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2760

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2396

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5096

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:748

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1860

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3504

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4584

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3588

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1380

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2180

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1156

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2940

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5004

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3264

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3472

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1080

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5112

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1668

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1104

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4956

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4020

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2676

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2648

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2800

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1668

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:372

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1424

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4300

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2992

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4340

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4400

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LP\D118\7AC.tmp

Filesize
99KB

MD5
08a5937a576b475126ca81d436937a26

SHA1
0511a1e2596ab2ab23d032c2883c3380fdcc9878

SHA256
e74db8ec9e61cb575458a11f2c8e750347a3f50f2e3a0153a7e191ef64923519

SHA512
e1da5dbf78aef5ff60d6d6b3961cce297bb0bf96aa51d1f115be1c31110684ecac8585f69c4f1124d712b65b718da0374dc859884fb595d3a9835617bbde8a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
471B

MD5
d625606b952644a70d5698dd34bd14b8

SHA1
a230ca74d94a8191ff13fdd8501f4bceb61131a9

SHA256
d5ba357a39c42632cf50fd5d9bcb15670e84f28a6dfa70ca7d38862e1ca4cb23

SHA512
ef4382bc36f0f358b489a27488fba8743c77f74f53e9182a204d942b08ebdc0e703ce0ad065a9f80ea20df0f35b870ad7ad06a8ef31274cc0c727c44473efa71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
abe51a6b79f7486e30b9a9399fdd671f

SHA1
4bedcf8348550471a938175999c9add11c11e278

SHA256
eda65513c534fe14fba17ef85f448f168eb42c714aaf5c3a262181618de47026

SHA512
61ec9759353f38ec6d186f4f0434102cb277d2aa128249a5d72a327373ca27d56fe5a00744e5d480357b25c346e6112a1c23d9ddf73800ab8ff930db91e9116f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Filesize
2KB

MD5
00d4686c480116a88bb9b5d5ed836829

SHA1
3b83235edd0691988d8db0d49889499b3f8604f5

SHA256
91e090d1b79604d34c8a19861b4e482c4603c996e08b23f1c14d8aec159c7997

SHA512
71dc6329150e9a12d0250e7a0f31c2793fe3e10d09cb8b2204852c25d7d25f2c0cdbfc6f7d89f254b41b8d7e6e6dc5037fd06baf5122bc4c76899bbccaa91263

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

Filesize
36KB

MD5
0e2a09c8b94747fa78ec836b5711c0c0

SHA1
92495421ad887f27f53784c470884802797025ad

SHA256
0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

SHA512
61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

Filesize
36KB

MD5
ab0262f72142aab53d5402e6d0cb5d24

SHA1
eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

SHA256
20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

SHA512
bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133704931937299342.txt

Filesize
75KB

MD5
1f17293f3a799fde096bc4e2038487f9

SHA1
caad421811617ece4bcda52fd9467b4da0562fb5

SHA256
eac41874075ecaba105b3500f1bcbb7fb95337f15c793b3388e3608356dfb03f

SHA512
7d2b4cde9181ddcfe73dd11cc6143b8fd8ad660f94cef8ef1c3d34a4867bdff807ed8e802c29b2a8c4a07d2d7811cc4473100b23a1dcfcd68c672779c8495f7a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VJ9UXBET\microsoft.windows[1].xml

Filesize
97B

MD5
d28bf9e615b97abc4f63418e57cc40bc

SHA1
65885f634c0b15cabd1caf45861e7767f3110e44

SHA256
92e5c802db2c618a0c0aec072bec43479f082c95f35157b117749fee0ec295f7

SHA512
23e0b838c4a4a91b117fa0292e0350d691aa78eda49299819aa684efd6c6ec03b73a7d231996cf4d7e6cd10311a4755b5a434cae732c6376276290cb52f12eb0

Download Submit
C:\Users\Admin\AppData\Roaming\892A1\1061.92A

Filesize
600B

MD5
122ce17a7d94d58f178619801b87b29b

SHA1
2e46b9879a2c3b81a73f0d17336d27c649755a70

SHA256
ccb133847d7dbb293cb720e54109ab84bf6a486dc80adbf0cbdfe26156ed7414

SHA512
ef50210fc4a3a6470788d6d02d6a573932c04b11de99d20a76c480464c451c909472bd65d56ddc975b97f64779266d5ef3b5722c68ce7fcf412eab84c8f698be

Download Submit
C:\Users\Admin\AppData\Roaming\892A1\1061.92A

Filesize
300B

MD5
da6ca5b44bc472820559eb3fdf505802

SHA1
ad444f7032a117ef1142c2e5f3d193fb1681ae5b

SHA256
12fdb8cbfd35987c6453cf3fb587a8a2d03d39bd426cf672b3b020171f3a3557

SHA512
31e724413b28ef678b1112807e5c2671cf800468b1fcc4709915fe1835cbd12705a78ea932e6a66487438a8cfd1f624b63a5d2d12e51eb8a124da2132fed816f

Download Submit
C:\Users\Admin\AppData\Roaming\892A1\1061.92A

Filesize
996B

MD5
205b6b70c706b5ace836eea14a4f8f14

SHA1
7631d56cdaa3fa8f9a8d1f67eacdd195fda4195b

SHA256
88069eb5858edf0da30820122b06fd9f6f23d7c5ff6db2cb41148c7c33008e3b

SHA512
21c03a90392c5a3d4a7564634add6788951e1a0776a292bbc64cd15ba6dfe01c9ad884b9050d10f22fd57c7b177187c9f5651e4ded77289a7cfbe7a2fa33580c

Download Submit
memory/832-1400-0x00000196A1970000-0x00000196A1990000-memory.dmp

Filesize
128KB

Download
memory/832-1418-0x00000196A1930000-0x00000196A1950000-memory.dmp

Filesize
128KB

Download
memory/1256-187-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/1424-1095-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/1592-1392-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/2512-975-0x0000013E873C0000-0x0000013E873E0000-memory.dmp

Filesize
128KB

Download
memory/2512-949-0x0000013E86000000-0x0000013E86100000-memory.dmp

Filesize
1024KB

Download
memory/2512-948-0x0000013E86000000-0x0000013E86100000-memory.dmp

Filesize
1024KB

Download
memory/2512-965-0x0000013E86DB0000-0x0000013E86DD0000-memory.dmp

Filesize
128KB

Download
memory/2512-953-0x0000013E86DF0000-0x0000013E86E10000-memory.dmp

Filesize
128KB

Download
memory/3288-77-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3320-1110-0x0000025EA24D0000-0x0000025EA24F0000-memory.dmp

Filesize
128KB

Download
memory/3320-1101-0x0000025EA2510000-0x0000025EA2530000-memory.dmp

Filesize
128KB

Download
memory/3320-17-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3320-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3320-1097-0x0000025EA1600000-0x0000025EA1700000-memory.dmp

Filesize
1024KB

Download
memory/3320-1133-0x0000025EA2AE0000-0x0000025EA2B00000-memory.dmp

Filesize
128KB

Download
memory/3320-1096-0x0000025EA1600000-0x0000025EA1700000-memory.dmp

Filesize
1024KB

Download
memory/3328-651-0x000002D8B5600000-0x000002D8B5700000-memory.dmp

Filesize
1024KB

Download
memory/3328-656-0x000002D8B6540000-0x000002D8B6560000-memory.dmp

Filesize
128KB

Download
memory/3328-680-0x000002D8B6B20000-0x000002D8B6B40000-memory.dmp

Filesize
128KB

Download
memory/3328-669-0x000002D8B6500000-0x000002D8B6520000-memory.dmp

Filesize
128KB

Download
memory/3424-497-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3580-1247-0x0000000004390000-0x0000000004391000-memory.dmp

Filesize
4KB

Download
memory/3696-797-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/3784-947-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/3872-1267-0x000001743C2C0000-0x000001743C2E0000-memory.dmp

Filesize
128KB

Download
memory/3872-1250-0x000001743B200000-0x000001743B300000-memory.dmp

Filesize
1024KB

Download
memory/3872-1278-0x000001743C6D0000-0x000001743C6F0000-memory.dmp

Filesize
128KB

Download
memory/3872-1254-0x000001743C300000-0x000001743C320000-memory.dmp

Filesize
128KB

Download
memory/3872-1251-0x000001743B200000-0x000001743B300000-memory.dmp

Filesize
1024KB

Download
memory/3904-350-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/3924-361-0x0000023774460000-0x0000023774480000-memory.dmp

Filesize
128KB

Download
memory/3924-354-0x0000023773600000-0x0000023773700000-memory.dmp

Filesize
1024KB

Download
memory/3924-352-0x0000023773600000-0x0000023773700000-memory.dmp

Filesize
1024KB

Download
memory/3924-357-0x00000237744A0000-0x00000237744C0000-memory.dmp

Filesize
128KB

Download
memory/3924-375-0x0000023774A80000-0x0000023774AA0000-memory.dmp

Filesize
128KB

Download
memory/4300-194-0x000001E2832F0000-0x000001E283310000-memory.dmp

Filesize
128KB

Download
memory/4300-206-0x000001E2832B0000-0x000001E2832D0000-memory.dmp

Filesize
128KB

Download
memory/4300-225-0x000001E2838C0000-0x000001E2838E0000-memory.dmp

Filesize
128KB

Download
memory/4300-191-0x000001E282500000-0x000001E282600000-memory.dmp

Filesize
1024KB

Download
memory/4300-189-0x000001E282500000-0x000001E282600000-memory.dmp

Filesize
1024KB

Download
memory/4300-507-0x00000201319E0000-0x0000020131A00000-memory.dmp

Filesize
128KB

Download
memory/4300-502-0x0000020130B00000-0x0000020130C00000-memory.dmp

Filesize
1024KB

Download
memory/4300-522-0x00000201319A0000-0x00000201319C0000-memory.dmp

Filesize
128KB

Download
memory/4300-539-0x0000020131FB0000-0x0000020131FD0000-memory.dmp

Filesize
128KB

Download
memory/4300-504-0x0000020130B00000-0x0000020130C00000-memory.dmp

Filesize
1024KB

Download
memory/4608-501-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/4620-499-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4620-2-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4620-75-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4620-15-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4620-13-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4620-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4684-826-0x0000029E56100000-0x0000029E56120000-memory.dmp

Filesize
128KB

Download
memory/4684-815-0x0000029E55D00000-0x0000029E55D20000-memory.dmp

Filesize
128KB

Download
memory/4684-805-0x0000029E55D40000-0x0000029E55D60000-memory.dmp

Filesize
128KB

Download
memory/4812-649-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download