stormkitty | 25d0c4ef21f49c4794220886919feebccbe942bffc1c36b8430b9b005693ce42

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe
Size

842KB
MD5

de7711ff0df1b36bd31f32f15843905b
SHA1

abd7c78b184f42525f0d7b53ba829e8f81bd2134
SHA256

25d0c4ef21f49c4794220886919feebccbe942bffc1c36b8430b9b005693ce42
SHA512

fa154ea9e1bad8e71434dc4ccef5182fd5eb93880e7fb10ca95da8399edcfcccc52d47cb78c17a0514bf15ca667865030519cf7c3be85b0494e6f9b83bc95428
SSDEEP

12288:JuC9eHN8vWHXsYIugb+94LlvTyFLPkZqVQV3309b+Z2x2G4Q4UFfHak3sD8H7:QCQH2TYqtBTfZqVQBY2Gv4UFfHH328b

Score

10^/10

stormkitty collection credential_access discovery persistence privilege_escalation stealer

Malware Config

Signatures

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/2320-5-0x0000000005850000-0x000000000593C000-memory.dmp	family_stormkitty

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome updaters.exe	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome updaters.exe	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\chrome updaters.exe	MSBuild.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3188	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 4712	2320	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe	88

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files\windowsapps\microsoft.office.onenote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\bulletin_board.css	MSBuild.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\jre\bin\javacpl.exe	MSBuild.exe
File opened for modification	\??\c:\program files\java\jre-1.8\bin\ssvagent.exe	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\1033\quickstyles\basicstylish.dotx	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\media\cashreg.wav	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\templates\1033\originreport.dotx	MSBuild.exe
File opened for modification	\??\c:\program files\videolan\vlc\lua\http\requests\playlist_jstree.xml	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\deletedalluserpackages\microsoft.windowsmaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\secondarytiles\directions\work\rtl\contrast-black\largetile.scale-125.png	MSBuild.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\jre\lib\jvm.hprof.txt	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\1033\clientosub2019_eula.txt	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\excellogo.scale-180.png	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\excellogosmall.scale-100.png	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\pagesize\pglbl058.xml	MSBuild.exe
File opened for modification	\??\c:\program files\videolan\vlc\lua\http\dialogs\stream_config_window.html	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\deletedalluserpackages\microsoft.windowsstore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\apptiles\librarysquare150x150logo.scale-125.png	MSBuild.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\include\win32\bridge\accessbridgecalls.h	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\winword.visualelementsmanifest.xml	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\1033\powerpointnaivebayescommandranker.txt	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\winwordlogo.contrast-black_scale-80.png	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\winwordlogo.contrast-white_scale-180.png	MSBuild.exe
File opened for modification	\??\c:\program files\google\chrome\application\123.0.6312.123\visualelements\logodev.png	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.microsoft3dviewer_6.1908.2042.0_x64__8wekyb3d8bbwe\common.view.uwp\strings\fi-fi\view3d\3dviewerproductdescription-universal.xml	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.microsoft3dviewer_6.1908.2042.0_x64__8wekyb3d8bbwe\common.view.uwp\strings\fil-ph\view3d\3dviewerproductdescription-universal.xml	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.skypeapp_14.53.77.0_x64__kzf8qxf38zg5c\appxblockmap.xml	MSBuild.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\visicon.exe	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\sdxs\fa000000027\assets\icons\[email protected]	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\deletedalluserpackages\microsoft.desktopappinstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-black\apppackageapplist.scale-125_contrast-black.png	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.skypeapp_14.53.77.0_neutral_~_kzf8qxf38zg5c\appxmetadata\appxbundlemanifest.xml	MSBuild.exe
File opened for modification	\??\c:\program files\7-zip\lang\it.txt	MSBuild.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\bin\javadoc.exe	MSBuild.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\bin\kinit.exe	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\1033\lyncvdi_eula.txt	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\excellogosmall.contrast-black_scale-100.png	MSBuild.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\jre\readme.txt	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\winwordlogosmall.scale-80.png	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.mspaint_6.1907.29027.0_x64__8wekyb3d8bbwe\assets\logos\storelogo\paintapplist.scale-100.png	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\integration\c2rmanifest.proof.culture.msi.16.fr-fr.xml	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\powerpntlogo.contrast-black_scale-100.png	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\blueprnt\preview.gif	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\windows\installer\{90160000-000f-0000-1000-0000000ff1ce}\pptico.exe	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\deletedalluserpackages\microsoft.windowsalarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\alarmsapplist.contrast-black_scale-125.png	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.mixedreality.portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\appxblockmap.xml	MSBuild.exe
File opened for modification	\??\c:\program files\java\jre-1.8\bin\pack200.exe	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\excellogo.contrast-black_scale-180.png	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\onenotelogosmall.scale-80.png	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\sdxs\fa000000027\assets\icons\[email protected]	MSBuild.exe
File opened for modification	\??\c:\program files\7-zip\uninstall.exe	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\templates\1033\blog.dotx	MSBuild.exe
File opened for modification	\??\c:\program files\videolan\vlc\lua\http\dialogs\batch_window.html	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.gethelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\largetile.scale-100_contrast-black.png	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.microsoft3dviewer_6.1908.2042.0_x64__8wekyb3d8bbwe\common.view.uwp\strings\sr-latn-rs\view3d\3dviewerproductdescription-universal.xml	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\document themes 16\theme colors\violet.xml	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\office16\logoimages\winwordlogo.contrast-black_scale-180.png	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\profile\thmbnail.png	MSBuild.exe
File opened for modification	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\satin\thmbnail.png	MSBuild.exe
File opened for modification	\??\c:\program files\java\jdk-1.8\jre\lib\deploy\[email protected]	MSBuild.exe
File opened for modification	\??\c:\program files\java\jre-1.8\lib\deploy\[email protected]	MSBuild.exe
File opened for modification	\??\c:\program files\videolan\vlc\uninstall.exe	MSBuild.exe
File opened for modification	\??\c:\program files\videolan\vlc\lua\http\images\vlc-48.png	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.bingweather_4.25.20211.0_x64__8wekyb3d8bbwe\microsoft.msn.controls\endoflife\assets\farewell.jpg	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.bingweather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\apptiles\contrast-black\weather_badgelogo.scale-100.png	MSBuild.exe
File opened for modification	\??\c:\program files\windowsapps\microsoft.microsoft3dviewer_6.1908.2042.0_x64__8wekyb3d8bbwe\common.view.uwp\strings\ta-in\view3d\3dviewerproductdescription-universal.xml	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3780	cmd.exe
4224	netsh.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4712	MSBuild.exe
4712	MSBuild.exe
4712	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	MSBuild.exe
Token: SeDebugPrivilege	3188	tasklist.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4712	2320	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe	88
PID 2320 wrote to memory of 4712	2320	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe	88
PID 2320 wrote to memory of 4712	2320	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe	88
PID 2320 wrote to memory of 4712	2320	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe	88
PID 2320 wrote to memory of 4712	2320	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe	88
PID 2320 wrote to memory of 4712	2320	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe	88
PID 2320 wrote to memory of 4712	2320	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe	88
PID 2320 wrote to memory of 4712	2320	de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe	88
PID 4712 wrote to memory of 3780	4712	MSBuild.exe	89
PID 4712 wrote to memory of 3780	4712	MSBuild.exe	89
PID 4712 wrote to memory of 3780	4712	MSBuild.exe	89
PID 3780 wrote to memory of 2872	3780	cmd.exe	91
PID 3780 wrote to memory of 2872	3780	cmd.exe	91
PID 3780 wrote to memory of 2872	3780	cmd.exe	91
PID 3780 wrote to memory of 4224	3780	cmd.exe	93
PID 3780 wrote to memory of 4224	3780	cmd.exe	93
PID 3780 wrote to memory of 4224	3780	cmd.exe	93
PID 3780 wrote to memory of 4748	3780	cmd.exe	94
PID 3780 wrote to memory of 4748	3780	cmd.exe	94
PID 3780 wrote to memory of 4748	3780	cmd.exe	94
PID 4712 wrote to memory of 1116	4712	MSBuild.exe	95
PID 4712 wrote to memory of 1116	4712	MSBuild.exe	95
PID 4712 wrote to memory of 1116	4712	MSBuild.exe	95
PID 1116 wrote to memory of 3188	1116	cmd.exe	97
PID 1116 wrote to memory of 3188	1116	cmd.exe	97
PID 1116 wrote to memory of 3188	1116	cmd.exe	97

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de7711ff0df1b36bd31f32f15843905b_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Drops startup file
  - Accesses Microsoft Outlook profiles
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4712
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2872
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4224
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C tasklist /FO TABLE > "C:\Users\Admin\AppData\Local\Temp\396d02e5e395f0e65d014577dd84a371\607a05a845764c72acf3b85209205c7f\processes.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FO TABLE
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
f2db28fe29c24c06bbfb5892d85636dd

SHA1
9e3441dcd2dd187f9c62d60148e4d5d7b00262ee

SHA256
5e556fa7a5c99be5ba57178d041d39a61932cef928805f6cad0481005dc2970f

SHA512
7d9d8ae649559d50f19bed02efbd669b571faa07b1dcd6b6551563f2dd22bb8a1f6d66f7926f3f3c2134c50051c4e92345f9c3a3f2d33310df6ebaecf457cede

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
edef65b330a458a84411762fb6dc8f42

SHA1
0afecf65f5452f960248dec454281f53d7338901

SHA256
da4763c1fc49420cb2a33f23db102d88ead05d2a02589d64df55fc207613cf30

SHA512
dfb858c3e908bdf876cda2d297e2c065cea8d0e9f4c72da981f361624765a16c6d84618a94eeff39a2fad00acbb549cfe15745d17dbb4c57fee4e8918aad424c

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
3f1d2324b4d8891c803573d4aab8b7b7

SHA1
79f9562ba2a7ce7b78f201df1ce013cad8abeacd

SHA256
adbb784627a1a4f9c712b18d02110e2dfbea2d238fcf67e0b9017bbeea18c4f9

SHA512
5e9aa29fda20b5a65eac0fe31ada05abb9e47f54fb90eb2dc66a0db5b2148a5bb1638fea14ba41805754c361db37b2b0c01c8d1eeb19fb280ee95e7d2213e3c3

Download Submit
C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

Filesize
4.1MB

MD5
5f8fe92079d880aa92f3da290fd723cd

SHA1
8d01b0403bf4e4dc74987358067cccb59c059ba8

SHA256
8ec23211bd91223d269f75a293f8681223f74d0d6e60990781e2046b6995607e

SHA512
b9325e1e9b52200d33056ff1fc4f34f5d418bf678a2518838290be6d31c546cbc8811480333491b436dceea85efd7ccf14e22bf72f505bb981c5004d8c48cae4

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
8dadca70b0a578cfd42838100c8abea3

SHA1
9a521838687cc02a94d8cf4cc0a2c9c851270dd7

SHA256
312d315e2cd7d353d46d270e912e9aefc2ecb29adc862e3e7bcea8790b975598

SHA512
57d46fcf426db33802ba53497b51a65215a8bdb103696b712cffe505631fde7aab55fc0305dfa70290746d4a45195a4ab81064776e1db1d303bdc79d3a5c42f6

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe

Filesize
1014KB

MD5
684718dc90c600666ede5797c56146c9

SHA1
1139082e0e03daaef681337b218ad2b71530fc91

SHA256
c3b5ddc01201e352976af0a9c0a774e65e69a9eb3c5379d6518263cd83f545d6

SHA512
a9fd38b9a9b8446cef292ad5cc730eddd2ae1d1d630bc39faf658e997f3bbe03bd32fd5a096a3a9141ab3c46931e86d6c7652475370ff50f0d724d86f727f553

Download Submit
C:\Users\Admin\AppData\Local\Temp\396d02e5e395f0e65d014577dd84a371\607a05a845764c72acf3b85209205c7f\processes.txt

Filesize
7KB

MD5
863d29eed17bce5eb5ea8c674770066f

SHA1
dc0d471d9296a83b820854a1619bab5caa3dbc9a

SHA256
add2d8ddc5c716206692f722eeb4e872bed0082a1d3e1645d15d410a3b4ed138

SHA512
3c5cbcbf1de18b460b72fa4de75e2bb490b4e15eab2fb6ef23f71e7bf7f93eef56cbbd77930829169bf37246d6a9b497ce6b097ffe033a2fde1c911ae044e2b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5r4i2p4s.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.babaxed

Filesize
48KB

MD5
3dd2582ee188344052723e1cfcbbbe42

SHA1
178006675f46c4abf29435da2582c6dc5490c5af

SHA256
bc6797126d89ffc1addb70f2e740407706ff6cd9a520d29f4dd66f1dbf1a457b

SHA512
242b38d5d9b57e4ff425a92ca43eb093a8ea1f9a2bd15ef20d2c61192bcd6686b986cb10c9ac43a8d1e6f23163ca8ee866e83ec9db4672d21201e9819705c45c

Download Submit
C:\Users\Admin\Desktop\RECOVERY INSTRUCTIONS 4 .txt

Filesize
250B

MD5
c3dc5952b6f46d997f8c6c29a01fe227

SHA1
d4ae6d0be31788744c456ab07253ca316c28e92c

SHA256
77fb1bb1ab4a441cc3fedbb015e64b84a136a380119b0687ed8de0bdb9548173

SHA512
1b43248fe03488a70e4aed8cd0334eba26874ff0b9dcdb50fc6fba32b830eb6bf53f8ba5548350af806980748b6da12a85f59a1e0cac399173e10870c2b5927e

Download Submit
\??\c:\users\admin\appdata\roaming\microsoft\ctfmom.exe

Filesize
238KB

MD5
88ad8851be6a5f63447da085cfa7366d

SHA1
15a27d4af1aebbb1a0296fa75f968a788460ea30

SHA256
131ebb3a563e1d875781ad6db475770aab1bf53467d23eb6c0bbca346e52a3c5

SHA512
e61e35e4b1485be406e423aad63ba00f39088ec9bf3f60ee249ab1bc5cb9fedb003398d03433ca73144096c9f61b62b723313e57fee4cecd2888ba62b752ff05

Download Submit
\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\chrome updaters.exe

Filesize
842KB

MD5
fd66a4c8ccd02ce1ae5540b52ff16da9

SHA1
5aed2a82aeb1d2d8067ed9d9002e334052af603b

SHA256
c8800fea1cde3085df76be37a6ac312b64fc25dcd9ea5b4d2c4b1a176baa1fa8

SHA512
544d084c75a37d5623a5736d3e0a17027836441f9e5ea77fe21397f65df44755e0ea54097b850014562948029fa1a885aeac7fdff79ff8e6901ff298843fe6f2

Download Submit
memory/2320-5-0x0000000005850000-0x000000000593C000-memory.dmp

Filesize
944KB

Download
memory/2320-0-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/2320-55-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/2320-4-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2320-219-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/2320-3-0x0000000002F20000-0x0000000002F34000-memory.dmp

Filesize
80KB

Download
memory/2320-2-0x0000000005640000-0x00000000056DC000-memory.dmp

Filesize
624KB

Download
memory/2320-1-0x0000000000BC0000-0x0000000000C98000-memory.dmp

Filesize
864KB

Download
memory/2320-57-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4712-26-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-45-0x0000000005D10000-0x0000000005DA2000-memory.dmp

Filesize
584KB

Download
memory/4712-46-0x0000000006360000-0x0000000006904000-memory.dmp

Filesize
5.6MB

Download
memory/4712-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-34-0x00000000056E0000-0x00000000056EA000-memory.dmp

Filesize
40KB

Download
memory/4712-35-0x0000000005710000-0x0000000005722000-memory.dmp

Filesize
72KB

Download
memory/4712-36-0x0000000005800000-0x0000000005866000-memory.dmp

Filesize
408KB

Download
memory/4712-547-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4712-548-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4712-33-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4712-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-32-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4712-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download