Analysis

  • max time kernel
    122s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 18:26

General

  • Target

    fce3e2274c2d06fe2e10e5f5c492d93d_JaffaCakes118.exe

  • Size

    851KB

  • MD5

    fce3e2274c2d06fe2e10e5f5c492d93d

  • SHA1

    7acfd8f04490fcc524d3db32026718bf3f15f663

  • SHA256

    6f68e9504b620b6f04078e1e696a429d2757647f35101276af3de93f9042fe81

  • SHA512

    304943e12f29cc05fa97718f50ed01eca4e99ff6d46531b1e1fbedf272d655c3e5520c1acc649d7008ff59f04ddb85abd015160e667367c7d8394c6d71c469a1

  • SSDEEP

    12288:BMoVefu+XY93VM/6sSISPehPEYDxGhhkZEZivnNxaT0Iw5pkd3DUe/:BMPfuZMSsNN9GTmEsnlc5DUe/

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:756
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:764
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:316
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
          1⤵
            PID:2544
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:2552
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2824
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3448
                  • C:\Users\Admin\AppData\Local\Temp\fce3e2274c2d06fe2e10e5f5c492d93d_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\fce3e2274c2d06fe2e10e5f5c492d93d_JaffaCakes118.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Checks computer location settings
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops autorun.inf file
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:3940
                    • C:\Users\Admin\AppData\Local\Temp\~sfx0026D167E0\DDB V. 1.0.exe
                      "C:\Users\Admin\AppData\Local\Temp\~sfx0026D167E0\DDB V. 1.0.exe"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:3176
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dabat.tk/
                        4⤵
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:372
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff636c46f8,0x7fff636c4708,0x7fff636c4718
                          5⤵
                            PID:1064
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                            5⤵
                              PID:2216
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                              5⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1316
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
                              5⤵
                                PID:1028
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                                5⤵
                                  PID:1264
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
                                  5⤵
                                    PID:2192
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
                                    5⤵
                                      PID:3996
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
                                      5⤵
                                        PID:2356
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
                                        5⤵
                                          PID:4436
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
                                          5⤵
                                            PID:4608
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
                                            5⤵
                                              PID:1904
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1
                                              5⤵
                                                PID:4600
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                                                5⤵
                                                  PID:2444
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
                                                  5⤵
                                                    PID:4392
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
                                                    5⤵
                                                      PID:524
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
                                                      5⤵
                                                        PID:3516
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1471700774044028455,9834852819217076974,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5668 /prefetch:2
                                                        5⤵
                                                          PID:1484
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                  1⤵
                                                    PID:3660
                                                  • C:\Windows\system32\DllHost.exe
                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                    1⤵
                                                      PID:3848
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3964
                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                        1⤵
                                                          PID:4028
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:692
                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                            1⤵
                                                              PID:3880
                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                                              1⤵
                                                                PID:2388
                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                1⤵
                                                                  PID:3668
                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                  1⤵
                                                                    PID:4612
                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                    1⤵
                                                                      PID:1080
                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                      1⤵
                                                                        PID:636

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        b9569e123772ae290f9bac07e0d31748

                                                                        SHA1

                                                                        5806ed9b301d4178a959b26d7b7ccf2c0abc6741

                                                                        SHA256

                                                                        20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

                                                                        SHA512

                                                                        cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        eeaa8087eba2f63f31e599f6a7b46ef4

                                                                        SHA1

                                                                        f639519deee0766a39cfe258d2ac48e3a9d5ac03

                                                                        SHA256

                                                                        50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

                                                                        SHA512

                                                                        eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        35769724dd277641b1f246620e411a95

                                                                        SHA1

                                                                        5aa2da54414ba0f88368d076e1125ca4735618df

                                                                        SHA256

                                                                        6c4c1fdd9c25fc47a40ea530c13f25bb1054a9bcf50d0d6aad93965d80b894ad

                                                                        SHA512

                                                                        6b6bd3812ba183be22498268eb4f3b253784f30def841a2cd8fb4f22f30e97638df72bba337118ff583bfd7e87a622b3fa6e3a9eab81a9d078065cad768b16e9

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        5KB

                                                                        MD5

                                                                        49c64b21401867791e1a6cd64bafa538

                                                                        SHA1

                                                                        91a937006fa5812f0e54f0e98816d5eeeeb88764

                                                                        SHA256

                                                                        c1f54c6590dbb5ebb71949b3b67205ec46ad9eecda34cf5f8c35fde06b581043

                                                                        SHA512

                                                                        2daf0d9463b9cee70b09fb07170653875f2bea0aa2c91acd65e2108cb33f03a9f9d5f0911b67eb8f252716fad7fb23ce0f18a170476efd6774b93936a31a83cb

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                        Filesize

                                                                        16B

                                                                        MD5

                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                        SHA1

                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                        SHA256

                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                        SHA512

                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        69c9945efc8f33033fd8bd16767dae19

                                                                        SHA1

                                                                        3f2d93a5e7bc68e9c03bd5ef8f698dcb02f82cac

                                                                        SHA256

                                                                        fd1302188d405901ac7a7468051e55f0d0f256ffe755a88d0e0ce841a612e158

                                                                        SHA512

                                                                        7f66118e233b3bf7be85a08d4cc394c61458bce5c2c458698e64599553f49471e30dcc041022976efc332c10d405fba42fbe51978346425668c51f06b7b1c947

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        2e2d58c7def64d5a4cf9758388ed5c46

                                                                        SHA1

                                                                        18268a96ce54550abf651522444899e5feeda89a

                                                                        SHA256

                                                                        baa969e20195861b39abfacf2fa35e6356762de0aca8ba5de5a16abb3f9162cc

                                                                        SHA512

                                                                        53cb22cc4bc8f385c3094a10ef44c53e313c371b305f75630000daa460e2ab3346037e13a235533eae908f17c2d8dbd0902b1d02a6d307a8e2fa629fc1141270

                                                                      • C:\Users\Admin\AppData\Local\Temp\~sfx0026D167E0\DDB V. 1.0.exe

                                                                        Filesize

                                                                        260KB

                                                                        MD5

                                                                        99daec22ea48c348ee431c334d69feae

                                                                        SHA1

                                                                        95174432ddc9576a21dc3281a23926b67c4abb91

                                                                        SHA256

                                                                        bcf12f89c864b93a826ef9ef96a2cc238f105f1e3c45e0d24eee16af47f83219

                                                                        SHA512

                                                                        2ec5eaacaa25cd8d00c9b0f5dfbe332b4afa4c283bc1f9d9e8f282c6979776ae5d58a086ffa720e52d14ee787ec301e8fd3a3b7f24e808dc0f11f09ad12b346e

                                                                      • C:\Users\Admin\AppData\Local\Temp\~sfx0026D167E0\GIFviewer.ocx

                                                                        Filesize

                                                                        100KB

                                                                        MD5

                                                                        73404435b36b8cb9ea68be6d4249488e

                                                                        SHA1

                                                                        ecd6f0e28c4f4ac6c1943a7647f42a5d91c14f02

                                                                        SHA256

                                                                        2123cadad9f7da81601c5e09105a569fedda561b4b12e87f0c0f6b4afa286e5c

                                                                        SHA512

                                                                        e260099024bdc4711ef068455e350cb400042f5fd5066b07b024e49b8a13b6c058347f2e4e68ff73704358b51db851e4e06c28cb2f3cd36b64d9023c748dcad7

                                                                      • C:\atsigr.pif

                                                                        Filesize

                                                                        97KB

                                                                        MD5

                                                                        0f9daee2381c85988ae0ebaa155169e1

                                                                        SHA1

                                                                        7bc9139171a15cfda3adb31dbe10465adc130f0f

                                                                        SHA256

                                                                        c87daeb8e5b37836380afe4bb079d6a90d73bc9ad4f5ab01f087dbfceafc7c2e

                                                                        SHA512

                                                                        056399e5609d180d56c3938268bf408173ba041189bf388a87c66faa4cf994f82e55e3aa819aa25bc64a4d1009a02f6fb3db00c8e4283602ce50ef94a38ef283

                                                                      • memory/3176-45-0x0000000002A10000-0x0000000002A11000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3176-52-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3176-122-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3176-117-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3176-109-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3176-102-0x0000000003100000-0x0000000003101000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3176-103-0x0000000002FB0000-0x0000000002FB2000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/3176-49-0x0000000004720000-0x0000000004721000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3176-54-0x0000000004B70000-0x0000000004B71000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3176-53-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3940-104-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-4-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-51-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-21-0x0000000003480000-0x0000000003482000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/3940-61-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-19-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-69-0x0000000000400000-0x0000000000525000-memory.dmp

                                                                        Filesize

                                                                        1.1MB

                                                                      • memory/3940-68-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-70-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-20-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-27-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-87-0x0000000003480000-0x0000000003482000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/3940-28-0x0000000003480000-0x0000000003482000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/3940-97-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-30-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-17-0x0000000003480000-0x0000000003482000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/3940-29-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-105-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-0-0x0000000000400000-0x0000000000525000-memory.dmp

                                                                        Filesize

                                                                        1.1MB

                                                                      • memory/3940-111-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-5-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-50-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-118-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-119-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-31-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-125-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-127-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-18-0x0000000003490000-0x0000000003491000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                      • memory/3940-139-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-140-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-144-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-145-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-151-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-152-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-156-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-3-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-166-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-168-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-169-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-171-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-175-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-176-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-177-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB

                                                                      • memory/3940-1-0x00000000022C0000-0x000000000337A000-memory.dmp

                                                                        Filesize

                                                                        16.7MB