Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    81s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/09/2024, 20:00

General

  • Target

    f467ad374c4a6a470cde9f4893fd628c_JaffaCakes118.exe

  • Size

    920KB

  • MD5

    f467ad374c4a6a470cde9f4893fd628c

  • SHA1

    b6fb7decf1da130faa70e8115f5593ba6b9235b9

  • SHA256

    1c6d003793adae594719fc0572cf770437af2f24c1f8fe2307633a7cc59d8102

  • SHA512

    49d5a9e9bb3fe6367a8081509913e6706a26887644af8233809c25cb913d72b3233341cecc665520c08fa3529dc457f1d80327a8eba2a330970e22aebc08ab83

  • SSDEEP

    24576:tJXWAayET+QuawV+XTUknfiuG7weke8juowZKMnunK:WTzuaxjnsywKMnY

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 4 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 49 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f467ad374c4a6a470cde9f4893fd628c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f467ad374c4a6a470cde9f4893fd628c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Users\Admin\MDdyAsuPL1.exe
      C:\Users\Admin\MDdyAsuPL1.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Users\Admin\seoriu.exe
        "C:\Users\Admin\seoriu.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:264
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del MDdyAsuPL1.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3004
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4412
    • C:\Users\Admin\2eaj.exe
      C:\Users\Admin\2eaj.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Users\Admin\2eaj.exe
        "C:\Users\Admin\2eaj.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3704
      • C:\Users\Admin\2eaj.exe
        "C:\Users\Admin\2eaj.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:900
      • C:\Users\Admin\2eaj.exe
        "C:\Users\Admin\2eaj.exe"
        3⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1808
      • C:\Users\Admin\2eaj.exe
        "C:\Users\Admin\2eaj.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2880
      • C:\Users\Admin\2eaj.exe
        "C:\Users\Admin\2eaj.exe"
        3⤵
        • Executes dropped EXE
        PID:2688
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 80
          4⤵
          • Program crash
          PID:4836
    • C:\Users\Admin\3eaj.exe
      C:\Users\Admin\3eaj.exe
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • System policy modification
      PID:2736
      • C:\Users\Admin\3eaj.exe
        C:\Users\Admin\3eaj.exe startC:\Users\Admin\AppData\Roaming\765D1\C7061.exe%C:\Users\Admin\AppData\Roaming\765D1
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3448
      • C:\Users\Admin\3eaj.exe
        C:\Users\Admin\3eaj.exe startC:\Program Files (x86)\D1525\lvvm.exe%C:\Program Files (x86)\D1525
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2488
      • C:\Program Files (x86)\LP\6107\ED4E.tmp
        "C:\Program Files (x86)\LP\6107\ED4E.tmp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1032
    • C:\Users\Admin\4eaj.exe
      C:\Users\Admin\4eaj.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3880
      • C:\Users\Admin\AppData\Local\3401ab0d\X
        *0*bc*e5aafd59*31.193.3.240:53
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
          • Modifies registry class
          PID:5012
    • C:\Users\Admin\5eaj.exe
      C:\Users\Admin\5eaj.exe
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:3332
      • C:\Users\Admin\AppData\Roaming\xtzu2yjpoyuobvmm3qaxf3eklnfnecnl2\svcnost.exe
        "C:\Users\Admin\AppData\Roaming\xtzu2yjpoyuobvmm3qaxf3eklnfnecnl2\svcnost.exe"
        3⤵
        • Modifies firewall policy service
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:232
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del f467ad374c4a6a470cde9f4893fd628c_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3604
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2724
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2688 -ip 2688
    1⤵
      PID:2288
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4056
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2148
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1524
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4208
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4092
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4324
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Suspicious use of SendNotifyMessage
      PID:2212
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5104
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2724
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:2668
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4808
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4128
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3696
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4260
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3728
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4092
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2876
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2664
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4172
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1612
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3824
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3812
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3352
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:1328
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3808
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4708
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:3880
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:784
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:836
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1616
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2488
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1108
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3304
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5044
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4328
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3172
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:4796
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:2560
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:5068
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1104
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:4492
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3464
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:220
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4068
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:2360
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:2816
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:2904
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:1368
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3684
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:2848
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2020
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:2220
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:3612
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:2712
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4332
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:3464
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1128
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:1148
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:1428
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3988
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:3964
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:224
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:2272
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:4488
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:4328
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3588
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:4624
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:3948
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:2876
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:408
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:2972
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4036
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:1516
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:1452
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:1060
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:544
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:688

                                                                                            Network

                                                                                            MITRE ATT&CK Enterprise v15

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\Program Files (x86)\LP\6107\ED4E.tmp

                                                                                              Filesize

                                                                                              100KB

                                                                                              MD5

                                                                                              8659e2fdb286421874e997e5b1d56ae4

                                                                                              SHA1

                                                                                              e3b46183011a317dd80baf92ff9ef1b2da53cc05

                                                                                              SHA256

                                                                                              80ceedded02c13a9c4ade2d2242b2bb295bc122b5c7c0f6b3332b0f4fceae2b8

                                                                                              SHA512

                                                                                              ae12fd737c0a6f765ebe7a6e312230220e5fb79d42c1478a6f00edf5e67b6dec201aee90d3082b7817726c6501c7c94ce4a8eab72b2a00547bfdc382bbf2a8dc

                                                                                            • C:\Users\Admin\2eaj.exe

                                                                                              Filesize

                                                                                              132KB

                                                                                              MD5

                                                                                              afaca64214594290a9e01c2ab012f00c

                                                                                              SHA1

                                                                                              eb1183a49d6da506072d34673f60a623687d2f82

                                                                                              SHA256

                                                                                              ca9e0ce2d0cf500ddbad4e9ad42e6e4136e3fa351839ccc654f393e624528f7a

                                                                                              SHA512

                                                                                              9f91e78c3a1de2e877e16b3cc862bc512051ccd011868c333dc66487bf1979c5f52406fa3498996e397705050b9c41a65a318d1f72e1e611dd9e2674a794a8b7

                                                                                            • C:\Users\Admin\3eaj.exe

                                                                                              Filesize

                                                                                              283KB

                                                                                              MD5

                                                                                              ab0bbc81ff15b6d295989e4076711c04

                                                                                              SHA1

                                                                                              99372e440fceb26128534ae44ba6649f4d6f5354

                                                                                              SHA256

                                                                                              b936e7056270188775662177402c86da4028950320a772f3d56763e2f935b4e5

                                                                                              SHA512

                                                                                              f1fa46e0fc9480766b68f7b3aba23bf41bb66e22d529d1006f5dbbfe467ec0bf490b50067184b38fa76639a76c15e88ca654544ea045bcbfce8c12d3d8347077

                                                                                            • C:\Users\Admin\4eaj.exe

                                                                                              Filesize

                                                                                              273KB

                                                                                              MD5

                                                                                              90cfd3294a276c3bc20a9fddf574a8d1

                                                                                              SHA1

                                                                                              fc294843a290d0bc223e67f3370009e0bd63e3b8

                                                                                              SHA256

                                                                                              5b076d47b571824cd668c26e7fc0a53b54a58547b7cb6a70eccdf44b4ccbda14

                                                                                              SHA512

                                                                                              a1ffc3e46490c74e7cd45b919b4668e0f38cbf28b3c3b81a25c68233cd68b72a5d9444306b9e8ef03fa1739d441c7f6504a36aabc2c53a7025b3c6260adc1aeb

                                                                                            • C:\Users\Admin\5eaj.exe

                                                                                              Filesize

                                                                                              121KB

                                                                                              MD5

                                                                                              6735cacc68031001bcf6459daa770b42

                                                                                              SHA1

                                                                                              78fc873eee60454534d7f39279d53d9bd9780c77

                                                                                              SHA256

                                                                                              b1a7250c0fc8caa1a26ca2ebf18507ba4dcc564149ccfa81ed07e4fe2fbed026

                                                                                              SHA512

                                                                                              ef092414d0b7f51ec8ec697148dba5656ba13987f2b7f746bda77267320dbbfdc0504e51699becbe30162ee0dd102cea80ab689f74221a2c6a50e1912ab82f08

                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                              Filesize

                                                                                              471B

                                                                                              MD5

                                                                                              a2232b63310bba942fe5a356bf502b6f

                                                                                              SHA1

                                                                                              941127c244f9c1e99a6d9745d658d23609e594a7

                                                                                              SHA256

                                                                                              75dd35ee237609b8a35b1fe2003ecbb2baec23a089e151c2f2909b09e75e6e4d

                                                                                              SHA512

                                                                                              75a572fbf471fb1da76cd087c9770751ef47684762bde9ee73f74610b52c8a5b248a3ac23f4b55b45b2aec8392bd71242b405079dab187c8cc7f41749e1282e0

                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                              Filesize

                                                                                              420B

                                                                                              MD5

                                                                                              87ce0598f3b0069f9c99173493c8736c

                                                                                              SHA1

                                                                                              5f502614d2a262fc4a98218a6b65cdacd0909dbf

                                                                                              SHA256

                                                                                              7e6aea5013198ad46bc7bc09f0f3142fd595f55026e8020ca48194d74dd44142

                                                                                              SHA512

                                                                                              283536d29b037103cc825510baca5c8a00dc37f6b29253e37f1d03bde0449e68497b31ac36022a982be959fe506771fdd1fe1c6a122b1de712fcaabee2c19261

                                                                                            • C:\Users\Admin\AppData\Local\3401ab0d\X

                                                                                              Filesize

                                                                                              38KB

                                                                                              MD5

                                                                                              72de2dadaf875e2fd7614e100419033c

                                                                                              SHA1

                                                                                              5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

                                                                                              SHA256

                                                                                              c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

                                                                                              SHA512

                                                                                              e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                              Filesize

                                                                                              2KB

                                                                                              MD5

                                                                                              d0a3e08de27fac169724affac5269d73

                                                                                              SHA1

                                                                                              bb0ce26812ec3710d79df502d6137d7dcc3c823b

                                                                                              SHA256

                                                                                              e29796a8dd53067240fad33671edcb6dcc0ba42542433d14473ec4cd8b96410b

                                                                                              SHA512

                                                                                              f71c77caa394fdc5072b0432424b0bec5810f9de7faf1dbff00dd3a7e76f1a3f291eb71adab8d367dfc86177c54a6e2217dbfee56cb33bfa98cecb98bafb289c

                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Y25IPP08\microsoft.windows[1].xml

                                                                                              Filesize

                                                                                              97B

                                                                                              MD5

                                                                                              d07a8eeeb6da833c3c127ff207daead9

                                                                                              SHA1

                                                                                              cc8a12f7c600ac6ad8211f50045ca376f88f3cb6

                                                                                              SHA256

                                                                                              113038e3d15cda4a50c0980cb7075456d00b0770a1c436b68cea36b435363392

                                                                                              SHA512

                                                                                              84bac1ea9a2bac093a6356933b08c841d1ef922937d05db05b388b6b107d77a7edcf6431db083a89e611c86c2ed9e8e83207e798edb08e3e056045780a432800

                                                                                            • C:\Users\Admin\AppData\Roaming\765D1\1525.65D

                                                                                              Filesize

                                                                                              600B

                                                                                              MD5

                                                                                              71cb28b7eed88b3f059bc1c19bc484e9

                                                                                              SHA1

                                                                                              a8e7b79751f668c6a589515c58ff07709bef6540

                                                                                              SHA256

                                                                                              61bed70b9a147f267e23736bec9565aa8b60ac4d630e4a2a32aa798a75163b0c

                                                                                              SHA512

                                                                                              04befe4cd6fde92229043d60be0d42943e5c83dfc4cfe5971058c8626bde456655e23ab44f547a3a9573e55a77e2cc2dc3f7a865bb6eacc52a3cf3a1f6f24489

                                                                                            • C:\Users\Admin\AppData\Roaming\765D1\1525.65D

                                                                                              Filesize

                                                                                              996B

                                                                                              MD5

                                                                                              af0bd31a0c683587365cdb6c7c42ee23

                                                                                              SHA1

                                                                                              5e6bffa19e9f82503ed1fe5082d48f82f9e3650f

                                                                                              SHA256

                                                                                              e83088ec8bb5da8e97b3dde56b431b482643671a3d462adc38f250d61acbd78d

                                                                                              SHA512

                                                                                              67e0c187462b4a4cc0498c3ec65473513f99d1343ea348255eb3fcb1543568b726fb943418ba7d4da006892bb85a8aee135d8d7ff3abb63887289802c0f6533f

                                                                                            • C:\Users\Admin\AppData\Roaming\765D1\1525.65D

                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              383ab6d906bb828ba0e599bc2750e84f

                                                                                              SHA1

                                                                                              96fc54a08b9bdde9019c7a0f13403b68c02ec2da

                                                                                              SHA256

                                                                                              c0b16b559a1d99e72159ed495fdc9a91aef322f7b6596d5e9b35b79c8fda4604

                                                                                              SHA512

                                                                                              23460211aff17a18c9d6ace7af48883dcb550a6ee2ca0c61817a1cb05165f25da47cb3e2fc7b1cb74127d5c54294a6d11be27c67451a51fe258cebaa53f492b4

                                                                                            • C:\Users\Admin\AppData\Roaming\desktop.ini

                                                                                              Filesize

                                                                                              9KB

                                                                                              MD5

                                                                                              4a27242b307c6a836993353035fafc16

                                                                                              SHA1

                                                                                              5fea7a41b8f9071848108015d8a952e6f944eea0

                                                                                              SHA256

                                                                                              02fd93f64bda51e1e2991184cac13f077d509712e462c9e44be9cf8e22c06de1

                                                                                              SHA512

                                                                                              35e9c87642b82df2bf0a9312bb0e9abfb98282db1e34032a4d0150d82c5e2f2e13150ddc896f1e954f02288a1e696a4306ee595b94b1e404c6ec17bac64c44be

                                                                                            • C:\Users\Admin\AppData\Roaming\ntuser.dat

                                                                                              Filesize

                                                                                              54KB

                                                                                              MD5

                                                                                              7e8e966927e04a35aec644602b8a9e05

                                                                                              SHA1

                                                                                              d201b0b41e8701818d60ddbf9f334332a512c4da

                                                                                              SHA256

                                                                                              46f18d9fbf63f378d86962cbf24f5ce57ce257555acd4effdcc41c1e2f1adf5c

                                                                                              SHA512

                                                                                              246777c79129a5076b71ca5d3f7e59b06d344f6b5e771892ae8ee68c0b5af9207cd1868b1336b49e6a84665309ad379a33ec6c8e72d7ce41de72153637921a51

                                                                                            • C:\Users\Admin\MDdyAsuPL1.exe

                                                                                              Filesize

                                                                                              256KB

                                                                                              MD5

                                                                                              601683a024c1e27dd62d33de59536641

                                                                                              SHA1

                                                                                              4584d66af41c4f77a6e1b7df3dcd3e78217ad270

                                                                                              SHA256

                                                                                              11ba7731f1b9b48116167234553254116e86f06091b0bbd7eaf0cbea4c2df049

                                                                                              SHA512

                                                                                              b6ee2b371198d5a70124444596fb28831ec6b2f06910e0f772852f7d80ad2974373aead6f9597c61a89bd99496ca33a838030e458265f6ddea4920ffb0472008

                                                                                            • C:\Users\Admin\seoriu.exe

                                                                                              Filesize

                                                                                              256KB

                                                                                              MD5

                                                                                              55707cbf9f23ca6aa1915c0d6c730507

                                                                                              SHA1

                                                                                              9c9de2b6cc043fe34a21169fae3b2b76545fb263

                                                                                              SHA256

                                                                                              3dd8d9ec6147ad52588af9a4024f01438e37c56a32dbeaa2967051f31a5f174a

                                                                                              SHA512

                                                                                              1e385f80ef3b0dee9f68607160946550c704cb532bf17ea7f9b4044897ec8f82313b58b31ef58412ed5286ab9c17b313bbfb87e3cc5447470eecf9231f244706

                                                                                            • memory/232-106-0x0000000000400000-0x0000000000B19000-memory.dmp

                                                                                              Filesize

                                                                                              7.1MB

                                                                                            • memory/232-109-0x0000000000CD0000-0x0000000000CED000-memory.dmp

                                                                                              Filesize

                                                                                              116KB

                                                                                            • memory/232-253-0x0000000000400000-0x0000000000B19000-memory.dmp

                                                                                              Filesize

                                                                                              7.1MB

                                                                                            • memory/900-43-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                              Filesize

                                                                                              56KB

                                                                                            • memory/900-42-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                              Filesize

                                                                                              56KB

                                                                                            • memory/900-40-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                              Filesize

                                                                                              56KB

                                                                                            • memory/900-45-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                              Filesize

                                                                                              56KB

                                                                                            • memory/1032-756-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                              Filesize

                                                                                              112KB

                                                                                            • memory/1808-96-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                              Filesize

                                                                                              156KB

                                                                                            • memory/1808-47-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                              Filesize

                                                                                              156KB

                                                                                            • memory/1808-51-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                              Filesize

                                                                                              156KB

                                                                                            • memory/1808-53-0x0000000000400000-0x0000000000427000-memory.dmp

                                                                                              Filesize

                                                                                              156KB

                                                                                            • memory/2212-594-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                            • memory/2488-251-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                              Filesize

                                                                                              428KB

                                                                                            • memory/2724-595-0x00000290E1F00000-0x00000290E2000000-memory.dmp

                                                                                              Filesize

                                                                                              1024KB

                                                                                            • memory/2724-600-0x00000290E2DE0000-0x00000290E2E00000-memory.dmp

                                                                                              Filesize

                                                                                              128KB

                                                                                            • memory/2724-630-0x00000290E33B0000-0x00000290E33D0000-memory.dmp

                                                                                              Filesize

                                                                                              128KB

                                                                                            • memory/2724-612-0x00000290E2DA0000-0x00000290E2DC0000-memory.dmp

                                                                                              Filesize

                                                                                              128KB

                                                                                            • memory/2736-101-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                              Filesize

                                                                                              428KB

                                                                                            • memory/2736-249-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                              Filesize

                                                                                              428KB

                                                                                            • memory/2736-758-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                              Filesize

                                                                                              428KB

                                                                                            • memory/2880-55-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                              Filesize

                                                                                              28KB

                                                                                            • memory/2880-58-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                              Filesize

                                                                                              28KB

                                                                                            • memory/2880-52-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                              Filesize

                                                                                              28KB

                                                                                            • memory/2880-99-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                              Filesize

                                                                                              28KB

                                                                                            • memory/3332-85-0x0000000000400000-0x0000000000B19000-memory.dmp

                                                                                              Filesize

                                                                                              7.1MB

                                                                                            • memory/3332-112-0x0000000000400000-0x0000000000B19000-memory.dmp

                                                                                              Filesize

                                                                                              7.1MB

                                                                                            • memory/3448-104-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                              Filesize

                                                                                              428KB

                                                                                            • memory/3704-37-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                              Filesize

                                                                                              28KB

                                                                                            • memory/3704-35-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                              Filesize

                                                                                              28KB

                                                                                            • memory/3704-39-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                              Filesize

                                                                                              28KB

                                                                                            • memory/3704-65-0x0000000000400000-0x0000000000407000-memory.dmp

                                                                                              Filesize

                                                                                              28KB

                                                                                            • memory/3880-80-0x0000000030670000-0x00000000306BF000-memory.dmp

                                                                                              Filesize

                                                                                              316KB

                                                                                            • memory/4128-759-0x00000000026D0000-0x00000000026D1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                            • memory/4208-433-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                            • memory/4260-762-0x000001A1BFB60000-0x000001A1BFC60000-memory.dmp

                                                                                              Filesize

                                                                                              1024KB

                                                                                            • memory/4260-761-0x000001A1BFB60000-0x000001A1BFC60000-memory.dmp

                                                                                              Filesize

                                                                                              1024KB

                                                                                            • memory/4260-763-0x000001A1BFB60000-0x000001A1BFC60000-memory.dmp

                                                                                              Filesize

                                                                                              1024KB

                                                                                            • memory/4324-454-0x000001F3852A0000-0x000001F3852C0000-memory.dmp

                                                                                              Filesize

                                                                                              128KB

                                                                                            • memory/4324-469-0x000001F3858C0000-0x000001F3858E0000-memory.dmp

                                                                                              Filesize

                                                                                              128KB

                                                                                            • memory/4324-440-0x000001F3852E0000-0x000001F385300000-memory.dmp

                                                                                              Filesize

                                                                                              128KB