6d0b1b4966e0fdd6789559dccc9e58705dec700a574123370d0d4c80392eedc7

Analysis

max time kernel
132s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e8ba128d482d62804dfe6043f5c3e20_JaffaCakes118.exe
Size

1.1MB
MD5

3e8ba128d482d62804dfe6043f5c3e20
SHA1

5b32a32828a5e74f20bb584c86c1e2c6f9a078d6
SHA256

6d0b1b4966e0fdd6789559dccc9e58705dec700a574123370d0d4c80392eedc7
SHA512

e1aac6de99edd3bda1702e49820c7df65e69a0da09e6600a86eaddf4c0e725b1ef2af533671996cae912049b270672c13141571f7687a450898aa2647fe96485
SSDEEP

24576:UQKUKub/0V6fr4k1EPhJ7HAjzVtNSxWkoXZo27Iw5l:3KUKubsO4cghONSxBqZo27Icl

Score

10^/10

discovery evasion persistence privilege_escalation spyware stealer upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
haricerahku

Signatures

Detected Nirsoft tools 8 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1472-64-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral2/memory/4692-72-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral2/memory/2032-80-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral2/memory/4872-90-0x0000000000400000-0x0000000000425000-memory.dmp	Nirsoft
behavioral2/memory/4296-97-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4768-106-0x0000000000400000-0x000000000043D000-memory.dmp	Nirsoft
behavioral2/memory/3776-115-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral2/memory/452-117-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	96141.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	96141.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
752	netsh.exe
4480	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	3e8ba128d482d62804dfe6043f5c3e20_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	96141.exe

Executes dropped EXE 11 IoCs

pid	Process
428	96141.exe
1924	20570.exe
5100	96141.exe
1472	dialup.exe
4692	passwordfox.exe
2032	dialup.exe
452	passwordfox.exe
4872	mspass.exe
4296	iepv.exe
4768	ChromePass.exe
3776	OperaPassView.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Windows\\system32\\96141.exe"	96141.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\96141.exe"	96141.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\96141.exe	96141.exe
File opened for modification	C:\Windows\system32\96141.exe	96141.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f000000023b8b-58.dat	upx
behavioral2/memory/1472-59-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/1472-64-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/files/0x000b000000023b91-67.dat	upx
behavioral2/memory/4692-68-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/4692-72-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/2032-80-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-87.dat	upx
behavioral2/memory/4872-88-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4872-90-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-93.dat	upx
behavioral2/memory/4296-94-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/4296-97-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-100.dat	upx
behavioral2/memory/4768-101-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral2/memory/4768-106-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-109.dat	upx
behavioral2/memory/3776-110-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/3776-115-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/452-117-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\melt.txt	96141.exe
File opened for modification	C:\Windows\ZTSLLRFH10-13-2024---7-26-56---AM.gif	96141.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChromePass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	passwordfox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	passwordfox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iepv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaPassView.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
428	96141.exe
428	96141.exe
428	96141.exe
428	96141.exe
428	96141.exe
428	96141.exe
428	96141.exe
428	96141.exe
428	96141.exe
428	96141.exe
428	96141.exe
428	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
5100	96141.exe
4872	mspass.exe
4872	mspass.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5100	96141.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	428	96141.exe
Token: SeDebugPrivilege	5100	96141.exe
Token: SeDebugPrivilege	4872	mspass.exe
Token: SeDebugPrivilege	4296	iepv.exe
Token: SeRestorePrivilege	4296	iepv.exe
Token: SeBackupPrivilege	4296	iepv.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
428	96141.exe
1924	20570.exe
5100	96141.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 428	652	3e8ba128d482d62804dfe6043f5c3e20_JaffaCakes118.exe	86
PID 652 wrote to memory of 428	652	3e8ba128d482d62804dfe6043f5c3e20_JaffaCakes118.exe	86
PID 652 wrote to memory of 1924	652	3e8ba128d482d62804dfe6043f5c3e20_JaffaCakes118.exe	87
PID 652 wrote to memory of 1924	652	3e8ba128d482d62804dfe6043f5c3e20_JaffaCakes118.exe	87
PID 652 wrote to memory of 1924	652	3e8ba128d482d62804dfe6043f5c3e20_JaffaCakes118.exe	87
PID 428 wrote to memory of 4480	428	96141.exe	88
PID 428 wrote to memory of 4480	428	96141.exe	88
PID 428 wrote to memory of 5100	428	96141.exe	90
PID 428 wrote to memory of 5100	428	96141.exe	90
PID 5100 wrote to memory of 752	5100	96141.exe	91
PID 5100 wrote to memory of 752	5100	96141.exe	91
PID 5100 wrote to memory of 1472	5100	96141.exe	98
PID 5100 wrote to memory of 1472	5100	96141.exe	98
PID 5100 wrote to memory of 1472	5100	96141.exe	98
PID 5100 wrote to memory of 4692	5100	96141.exe	99
PID 5100 wrote to memory of 4692	5100	96141.exe	99
PID 5100 wrote to memory of 4692	5100	96141.exe	99
PID 5100 wrote to memory of 2032	5100	96141.exe	100
PID 5100 wrote to memory of 2032	5100	96141.exe	100
PID 5100 wrote to memory of 2032	5100	96141.exe	100
PID 5100 wrote to memory of 452	5100	96141.exe	101
PID 5100 wrote to memory of 452	5100	96141.exe	101
PID 5100 wrote to memory of 452	5100	96141.exe	101
PID 5100 wrote to memory of 4872	5100	96141.exe	102
PID 5100 wrote to memory of 4872	5100	96141.exe	102
PID 5100 wrote to memory of 4872	5100	96141.exe	102
PID 5100 wrote to memory of 4296	5100	96141.exe	103
PID 5100 wrote to memory of 4296	5100	96141.exe	103
PID 5100 wrote to memory of 4296	5100	96141.exe	103
PID 5100 wrote to memory of 4768	5100	96141.exe	105
PID 5100 wrote to memory of 4768	5100	96141.exe	105
PID 5100 wrote to memory of 4768	5100	96141.exe	105
PID 5100 wrote to memory of 3776	5100	96141.exe	106
PID 5100 wrote to memory of 3776	5100	96141.exe	106
PID 5100 wrote to memory of 3776	5100	96141.exe	106

C:\Users\Admin\AppData\Local\Temp\3e8ba128d482d62804dfe6043f5c3e20_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e8ba128d482d62804dfe6043f5c3e20_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:652
- C:\Users\Admin\AppData\Local\Temp\96141.exe
  "C:\Users\Admin\AppData\Local\Temp\96141.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4480
- - C:\Windows\system32\96141.exe
    "C:\Windows\system32\96141.exe"
    3⤵
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\system32\netsh.exe
      "netsh.exe" firewall set opmode disable
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:752
  - - C:\Users\Admin\AppData\Local\Temp\dialup.exe
      C:\Users\Admin\AppData\Local\Temp\dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\du.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1472
  - - C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
      C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\dialup.exe
      C:\Users\Admin\AppData\Local\Temp\dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\du.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
      C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:452
  - - C:\Users\Admin\AppData\Local\Temp\mspass.exe
      C:\Users\Admin\AppData\Local\Temp\mspass.exe /stext C:\Users\Admin\AppData\Local\Temp\mess.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\iepv.exe
      C:\Users\Admin\AppData\Local\Temp\iepv.exe /stext C:\Users\Admin\AppData\Local\Temp\iepv.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
      C:\Users\Admin\AppData\Local\Temp\ChromePass.exe /stext C:\Users\Admin\AppData\Local\Temp\ChromePass.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
      C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe /stext C:\Users\Admin\AppData\Local\Temp\OperaPassView.txt
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3776
- C:\Users\Admin\AppData\Local\Temp\20570.exe
  "C:\Users\Admin\AppData\Local\Temp\20570.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\20570.exe

Filesize
416KB

MD5
ae98850a426dcb5d3bf4bf30d1efea73

SHA1
9a0cea3d197086c86f6731aae516120ecd3a7f39

SHA256
2dd671b19f4e00f32cbb5d323a92b6c4235b2cb6e150ca6a39d0aa2b80c623f6

SHA512
9253cdf6d12f9c776a25e667c81006eb8462c8bb555d2ccf69b5dc0fd81fb97a2c459654f11967360e95fced59d11255157088323d75712dc9052565c97ba314

Download Submit
C:\Users\Admin\AppData\Local\Temp\96141.exe

Filesize
600KB

MD5
4ad5d1507ef028de701e5a0b2aa90cef

SHA1
a7ac601534031ed8374e6a9c2f075ddfa4b7565b

SHA256
e8e1d5e59f88f1ed553009a6860ead5d9af08c97fa38ad7ef523ee1e7b65d56b

SHA512
d7240efc46176fe4e27f82e39e186be4823ac81cfdc9431b06ca1a09e8466cc766eb8349bc196820b477eb87ad9fc6b33137c51f3db917d5f2135b7b55c4b28d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ChromePass.exe

Filesize
125KB

MD5
9b3b1c0db965166319469b2afa6c4f0c

SHA1
9f1e65a3056dff872949329c4e5e70c007cc5621

SHA256
dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89

SHA512
c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe

Filesize
38KB

MD5
37a89021ab1fbe5668c3974abc794bd4

SHA1
8ccaa4406f907a5a938fbb2db9d5af27092b811d

SHA256
2cb9a3d9587f79a6b1cfa95020b81d7d0d3cf9aa6ebf992f3b5e4ecf19bca8a8

SHA512
6eaef2c2c29eb5363a0193489dc989527e4087c61fe926efbbd8a0e3cc8b9675285a94d392ee0a906dfc109566cc144ab07166fd5b3defbfc8afd66d3fe8d1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\dialup.exe

Filesize
37KB

MD5
9c8872c879d0a9d82988920488370864

SHA1
87ff4231547462e6474c832e28831dd691d83fd4

SHA256
8f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97

SHA512
3c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\du.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\iepv.exe

Filesize
42KB

MD5
28c110b8d0ad095131c8d06043678086

SHA1
c684cf321e890e0e766a97609a4cde866156d6c5

SHA256
dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1

SHA512
065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922

Download Submit
C:\Users\Admin\AppData\Local\Temp\mspass.exe

Filesize
63KB

MD5
fbb93d4c91453b06414d6973152d904e

SHA1
4624232c5450e7e9e7ba1f2113a07f8800dc5b5f

SHA256
8898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe

SHA512
4ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\passwordfox.exe

Filesize
37KB

MD5
a1d6a37917dcf4471486bc5a0e725cc6

SHA1
5b09f10dc215078ae44f535de12630c38f3b86e3

SHA256
8a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17

SHA512
5798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2

Download Submit
C:\Windows\melt.txt

Filesize
43B

MD5
7304dccdca2d783954bd96d427de158e

SHA1
ffd1511298c8892c09f621aa16d4bd133aeef00c

SHA256
0c1d12bad9951e11b261834610c01a630142cbe9f24ad89eb20bbdc61ff5ef4c

SHA512
5f6069b8851854e36089e0670eeb6571072ae4167a3700473715265299226b4b8f462434afc410c2a52ee58f081a4a107c6ac0b29afe74991624ed9bdc6adfbf

Download Submit
memory/428-53-0x00007FFCBD2F0000-0x00007FFCBDC91000-memory.dmp

Filesize
9.6MB

Download
memory/428-30-0x00007FFCBD2F0000-0x00007FFCBDC91000-memory.dmp

Filesize
9.6MB

Download
memory/428-23-0x00007FFCBD2F0000-0x00007FFCBDC91000-memory.dmp

Filesize
9.6MB

Download
memory/428-33-0x00007FFCBD2F0000-0x00007FFCBDC91000-memory.dmp

Filesize
9.6MB

Download
memory/452-117-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/652-6-0x000000001B2D0000-0x000000001B2D8000-memory.dmp

Filesize
32KB

Download
memory/652-34-0x00007FFCBD2F0000-0x00007FFCBDC91000-memory.dmp

Filesize
9.6MB

Download
memory/652-8-0x00007FFCBD2F0000-0x00007FFCBDC91000-memory.dmp

Filesize
9.6MB

Download
memory/652-0-0x00007FFCBD5A5000-0x00007FFCBD5A6000-memory.dmp

Filesize
4KB

Download
memory/652-7-0x000000001C0A0000-0x000000001C0EC000-memory.dmp

Filesize
304KB

Download
memory/652-5-0x00007FFCBD2F0000-0x00007FFCBDC91000-memory.dmp

Filesize
9.6MB

Download
memory/652-4-0x000000001BF40000-0x000000001BFDC000-memory.dmp

Filesize
624KB

Download
memory/652-3-0x000000001B990000-0x000000001BE5E000-memory.dmp

Filesize
4.8MB

Download
memory/652-2-0x00007FFCBD2F0000-0x00007FFCBDC91000-memory.dmp

Filesize
9.6MB

Download
memory/652-1-0x000000001B410000-0x000000001B4B6000-memory.dmp

Filesize
664KB

Download
memory/1472-59-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1472-64-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2032-80-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3776-110-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3776-115-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4296-94-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4296-97-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4692-72-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4692-68-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4768-101-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4768-106-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4872-88-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4872-90-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download