Overview

overview

10

Static

static

3

eaea251578...18.exe

windows7-x64

10

eaea251578...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 08:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eaea25157814f7639054fd4ea04925fb_JaffaCakes118.exe

  • Size

    282KB

  • MD5

    eaea25157814f7639054fd4ea04925fb

  • SHA1

    4f37d87716fdc4bc92f9392dd65f4a00e2c4f1a9

  • SHA256

    87cb3ff5904c8bf61a4fa4141b848e82ee2ae7d8eff79bd9ca881ff4eb0305fc

  • SHA512

    e16dcb5b8d7294053132b74225c26fa82b1bb32254041b185872652fdb6dd61e101303f5e7ea22072ff6fef863f936e3ce13f225966d5c6ac92361af77a865e5

  • SSDEEP

    6144:1YuUaHTcIuw4mPMZ50HFGgGfILJ/Zv/TGmUs+xkFrb+ANbsj:1JOB10w8L5F/TG/k59U

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\eaea25157814f7639054fd4ea04925fb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eaea25157814f7639054fd4ea04925fb_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4724
    • C:\Users\Admin\AppData\Local\Temp\eaea25157814f7639054fd4ea04925fb_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\eaea25157814f7639054fd4ea04925fb_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\32427\3D648.exe%C:\Users\Admin\AppData\Roaming\32427
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1300
    • C:\Users\Admin\AppData\Local\Temp\eaea25157814f7639054fd4ea04925fb_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\eaea25157814f7639054fd4ea04925fb_JaffaCakes118.exe startC:\Program Files (x86)\27A6D\lvvm.exe%C:\Program Files (x86)\27A6D
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1632
    • C:\Program Files (x86)\LP\4893\120C.tmp
      "C:\Program Files (x86)\LP\4893\120C.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5044
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3056
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:928
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3536
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3640
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4156
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:432
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:1432
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3076
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2928
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3496
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2724
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1268
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2552
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2140
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3512
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4876
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2744
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4692
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1316
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4288
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2552
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1684
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3448
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3664
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3640
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2612
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3992
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:988
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4244
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:928
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5032
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4220
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1768
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2612
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4712
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1316
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3664
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3684
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:4072
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5024
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3940
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

5
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\LP\4893\120C.tmp
    Filesize

    99KB

    MD5

    82d50af33ff156670a076dc834a99b4d

    SHA1

    d5e3662e28d51a8366fb214d77585b95984541d1

    SHA256

    7f57b37aa39698068271e64bbb42ff74b1a2b6157d233d8bdef1f683a7230a7d

    SHA512

    527986d4cca9998059e278de71989f3f46851eace0370cb2bfd69dc7292d5a1597a373ff2b350137eeea8dd7dd13a0e8de8b6306795e4b5a6428fab6c1b27563

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
    Filesize

    471B

    MD5

    f21d1b257be226638cd7b9718b29c6af

    SHA1

    2d7f95d0dcf2462d366cfea77ceeb6fe4ad194f3

    SHA256

    5d5f424e1ae1c89835ebced7a048d08a27865c9b77715d0b327fa9cd221a4677

    SHA512

    e014452564c28acbc51715555b8f1bac5108cfbf71d1d2b38979b000fbbb12e839b31ea3ea4ecb3bc88153765a6db184d103f85a58e694cddd305eff5f2ac398

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
    Filesize

    420B

    MD5

    eda24490d341e4299da11168c0704129

    SHA1

    6a9263d388c3b33e6a203154ea3d763f5305737c

    SHA256

    898205f0c8cf679be862553d56c5890fe14ab0281dbdac6bd4233d5f0def1c71

    SHA512

    70c642c8402fad0c3de5677ff642f65a0ee1f773c79db194180baface8bd41f3f5f44303636f91fa609a30dccf62a55bb3ff6027820c905bc4ecb4ce8edcc426

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
    Filesize

    2KB

    MD5

    65044f38167f293b5d798f1aa20988b9

    SHA1

    88903e443e3ecbd45204fb156e03f48d86ca5bbc

    SHA256

    2124c3791cfecbd504fc2efe30dc4656fcc78f24c423a04e7fa0f8eadee270c5

    SHA512

    3241b9d7dd8fcec7ce622e582cd7ef95a6f0b615f0235ed98914d7115537acf26e192866b79c262f8c99c0fb2a08192fa76cd73eaa5a62016997696fc80a4d5a

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133712070932456588.txt
    Filesize

    76KB

    MD5

    88251309f2585ab4f35459368a28b8d5

    SHA1

    6954e1b338a1b83810291bf3f123a92886510d22

    SHA256

    b88126387391f33fa6352d180d645aa328a4a5d7d5f0ab32765f9396b5e20e9d

    SHA512

    0390d47be157b30594680536e0cdef70c59c976e460d790938f1a7cab00492a974d483abf9a678d4e93d6326e3049a39a20a36eae2fe4da3afb59847613b69f6

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1EALJNKU\microsoft.windows[1].xml
    Filesize

    97B

    MD5

    e9474f76e56e4f8298ed32d85776ddc0

    SHA1

    85b5c1919bb4fe74dc30b4dd0911d1994dd0974f

    SHA256

    b62242af1adf03ea40e4dff979f8b28430afebd75f7bf0e04a54745a47972c61

    SHA512

    7b1b354c53b204e1ac9b9fba462dd2474cedf64607be42d5865ca2dca611b9b2224ed84ff696978d1ac35adccb2f2199111dffcf54cd4189dc5b989678b55ab6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\32427\7A6D.242
    Filesize

    1KB

    MD5

    a16bea9835e9aedef2ed993c261e5cee

    SHA1

    eb838fc2a15787c14f1df2d1ff2a4cc2fada17a7

    SHA256

    8a01787434d09190daf980478caf2958253626864e1853a19d0bab318bcbdb86

    SHA512

    8e8643c0c53605fec06eb254d5b2011c7a8dc4da469874b437bd1a25bbf298dad436c28264b65c1a95197b008db41a1c997a2959536af70a6727315ffd191393

    Download Submit

  • C:\Users\Admin\AppData\Roaming\32427\7A6D.242
    Filesize

    600B

    MD5

    d93c7cc28043778ec3d66b4f3b061f6e

    SHA1

    96aa1cfde4b0a82f5bce2d2444b52bb441cf8817

    SHA256

    d9f8b9907429656218daf3d734e3c9c0abc719e916f504878ec04e71aa086c2d

    SHA512

    769aebf198ace04675439b3f8b8403a565cac1db29aeca52c97d6cf517cf414709b7c3a14c51cf9242273922bb67dad0009a95590c9892e641fecb158577489d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\32427\7A6D.242
    Filesize

    1KB

    MD5

    5a3d53431c44c186e75f874200267c2c

    SHA1

    7ec19acd842444190ee1e5d700dcda935b84f3d6

    SHA256

    b9cc6d1f5fc3476f3e29c6e1969c21ead5851a2bc8164b3ff8500448d61f5b7b

    SHA512

    02264971fa51cdb504d3f10e59ddd0f1c74e69c573ba57601e94531c10c09e239e4049797feae16bde5c597760ad35219ad778e6f1ed24b8883df7d5dc3616b0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\32427\7A6D.242
    Filesize

    996B

    MD5

    3205ec7a27832f9c05e974aba3f89bbc

    SHA1

    aadfde3b0253a0b7441f35f03d76e155a075a072

    SHA256

    e49e25323ce57388e69ddc1d93c025dc8d24a65a0c9b1e1d60c0bbfa67aaae15

    SHA512

    208e6a26e2536a8d03214bb31b757358a5d4c7c794ac79d1fc91d4964be3631b0f75e42ddb0e87ffde39d6390ed9c36307d0591505d5fb94951912209873f0e9

    Download Submit

  • memory/432-191-0x0000028071000000-0x0000028071100000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/432-227-0x0000028072530000-0x0000028072550000-memory.dmp

    Filesize

    128KB

    Download

  • memory/432-207-0x0000028072120000-0x0000028072140000-memory.dmp

    Filesize

    128KB

    Download

  • memory/432-196-0x0000028072160000-0x0000028072180000-memory.dmp

    Filesize

    128KB

    Download

  • memory/928-1371-0x000002A3F5CC0000-0x000002A3F5CE0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/928-1383-0x000002A3F5C80000-0x000002A3F5CA0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/928-1403-0x000002A3F62A0000-0x000002A3F62C0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/928-1367-0x000002A3F4D60000-0x000002A3F4E60000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/928-1366-0x000002A3F4D60000-0x000002A3F4E60000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/988-1365-0x0000000004350000-0x0000000004351000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1268-504-0x00000213966D0000-0x00000213966F0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1268-526-0x0000021396CA0000-0x0000021396CC0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1268-514-0x0000021396690000-0x00000213966B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1300-17-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1300-15-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1300-13-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1316-933-0x0000000004290000-0x0000000004291000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1432-349-0x0000000004840000-0x0000000004841000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1632-81-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/1684-1085-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1768-1532-0x000002438B390000-0x000002438B3B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1768-1521-0x000002438B3D0000-0x000002438B3F0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2552-642-0x0000000004420000-0x0000000004421000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2552-940-0x000001D1B8080000-0x000001D1B80A0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2552-952-0x000001D1B8040000-0x000001D1B8060000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2552-963-0x000001D1B8450000-0x000001D1B8470000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2552-936-0x000001C9B5800000-0x000001C9B5900000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2552-935-0x000001C9B5800000-0x000001C9B5900000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2928-364-0x0000019358390000-0x00000193583B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2928-388-0x00000193587A0000-0x00000193587C0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2928-357-0x00000193583D0000-0x00000193583F0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3496-496-0x0000000004A20000-0x0000000004A21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3512-680-0x000001EB13050000-0x000001EB13070000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3512-659-0x000001EB12C40000-0x000001EB12C60000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3512-650-0x000001EB12C80000-0x000001EB12CA0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3640-1227-0x0000000002130000-0x0000000002131000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3640-190-0x0000000004D20000-0x0000000004D21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3664-1092-0x000001EB54E90000-0x000001EB54EB0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3664-1105-0x000001EB54E50000-0x000001EB54E70000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3664-1116-0x000001EB55260000-0x000001EB55280000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3992-1230-0x0000020904300000-0x0000020904400000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3992-1231-0x0000020904300000-0x0000020904400000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3992-1234-0x00000209052D0000-0x00000209052F0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3992-1229-0x0000020904300000-0x0000020904400000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3992-1253-0x00000209058A0000-0x00000209058C0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3992-1243-0x0000020905290000-0x00000209052B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4692-814-0x0000019131320000-0x0000019131340000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4692-785-0x000001912FE00000-0x000001912FF00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4692-802-0x0000019130F20000-0x0000019130F40000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4692-790-0x0000019130F60000-0x0000019130F80000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4692-786-0x000001912FE00000-0x000001912FF00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4692-787-0x000001912FE00000-0x000001912FF00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4724-1-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/4724-609-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4724-79-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4724-1506-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4724-14-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/4724-11-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4724-2-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

    Download

  • memory/4876-783-0x0000000004720000-0x0000000004721000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5032-1513-0x0000000004640000-0x0000000004641000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5044-406-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download