Overview

overview

10

Static

static

3

40d74a5a02...18.exe

windows7-x64

10

40d74a5a02...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2024 16:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    40d74a5a028765d158afa53a9cf69556_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    40d74a5a028765d158afa53a9cf69556

  • SHA1

    20e36e3f82d725430c46a752b46b11b9e2342272

  • SHA256

    12a3610e72a00b67a86780d45e2bd0e38d41144275b352247232d47282567384

  • SHA512

    93321752dfaf1da0ae4217ad41e9eaa86f74e2e6acc3f2e8bcd0cbf18eba460635ef003b58708344fbf21ca2e76bebf26f2ec1b0f42148d6cab7625d9bb00c51

  • SSDEEP

    24576:ZSQHqj7vff5cIymms7K9OpkToGGTNd2+EHJnl+GyDDr4+os9V/WGNMx7lM/v3Q+j:ZSQK3mIyml7lZT321H5lDyDn4s9ZBvAK

Score
10/10
babylonratdiscoverypersistencetrojan

Malware Config

Signatures

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 33 IoCs
    persistence
  • Suspicious use of SetThreadContext 45 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40d74a5a028765d158afa53a9cf69556_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\40d74a5a028765d158afa53a9cf69556_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Users\Admin\AppData\Local\Temp\40d74a5a028765d158afa53a9cf69556_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\40d74a5a028765d158afa53a9cf69556_JaffaCakes118.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\ProgramData\Skype\Skype.exe
        "C:\ProgramData\Skype\Skype.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3116
        • C:\ProgramData\Skype\Skype.exe
          "C:\ProgramData\Skype\Skype.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1856
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1520
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:2860
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4524
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:1260
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4312
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:3120
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:112
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              PID:3860
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2164
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:4468
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1568
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:2108
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3508
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:2548
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4104
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:4604
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3004
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:4340
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3256
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:2380
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1980
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:2752
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2260
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              PID:1428
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3500
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:3420
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:5096
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:1144
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1172
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:1984
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2656
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              PID:3208
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3684
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:4544
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1408
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:2188
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4756
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:1656
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3616
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:2488
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4060
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:3576
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2572
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              PID:1184
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2416
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:2592
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4696
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              PID:4764
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3376
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              PID:4820
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1068
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              PID:3296
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:536
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              PID:3676
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1260
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              PID:4780
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2688
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              PID:1884
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:948
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              PID:316
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1264
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
              • Executes dropped EXE
              PID:3828
          • C:\ProgramData\Skype\Skype.exe
            "C:\ProgramData\Skype\Skype.exe" 1856
            5⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4792
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe"
              6⤵
                PID:2736
            • C:\ProgramData\Skype\Skype.exe
              "C:\ProgramData\Skype\Skype.exe" 1856
              5⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:4456
              • C:\ProgramData\Skype\Skype.exe
                "C:\ProgramData\Skype\Skype.exe"
                6⤵
                  PID:2912
              • C:\ProgramData\Skype\Skype.exe
                "C:\ProgramData\Skype\Skype.exe" 1856
                5⤵
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:5024
                • C:\ProgramData\Skype\Skype.exe
                  "C:\ProgramData\Skype\Skype.exe"
                  6⤵
                  • Adds Run key to start application
                  PID:4816
              • C:\ProgramData\Skype\Skype.exe
                "C:\ProgramData\Skype\Skype.exe" 1856
                5⤵
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:4592
                • C:\ProgramData\Skype\Skype.exe
                  "C:\ProgramData\Skype\Skype.exe"
                  6⤵
                    PID:4336
                • C:\ProgramData\Skype\Skype.exe
                  "C:\ProgramData\Skype\Skype.exe" 1856
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3076
                  • C:\ProgramData\Skype\Skype.exe
                    "C:\ProgramData\Skype\Skype.exe"
                    6⤵
                    • Adds Run key to start application
                    PID:3812
                • C:\ProgramData\Skype\Skype.exe
                  "C:\ProgramData\Skype\Skype.exe" 1856
                  5⤵
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:1792
                  • C:\ProgramData\Skype\Skype.exe
                    "C:\ProgramData\Skype\Skype.exe"
                    6⤵
                    • Adds Run key to start application
                    PID:4144
                • C:\ProgramData\Skype\Skype.exe
                  "C:\ProgramData\Skype\Skype.exe" 1856
                  5⤵
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:4136
                  • C:\ProgramData\Skype\Skype.exe
                    "C:\ProgramData\Skype\Skype.exe"
                    6⤵
                      PID:4760
                  • C:\ProgramData\Skype\Skype.exe
                    "C:\ProgramData\Skype\Skype.exe" 1856
                    5⤵
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:3348
                    • C:\ProgramData\Skype\Skype.exe
                      "C:\ProgramData\Skype\Skype.exe"
                      6⤵
                      • Adds Run key to start application
                      PID:2600
                  • C:\ProgramData\Skype\Skype.exe
                    "C:\ProgramData\Skype\Skype.exe" 1856
                    5⤵
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:3492
                    • C:\ProgramData\Skype\Skype.exe
                      "C:\ProgramData\Skype\Skype.exe"
                      6⤵
                      • Adds Run key to start application
                      PID:2144
                  • C:\ProgramData\Skype\Skype.exe
                    "C:\ProgramData\Skype\Skype.exe" 1856
                    5⤵
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:4580
                    • C:\ProgramData\Skype\Skype.exe
                      "C:\ProgramData\Skype\Skype.exe"
                      6⤵
                      • Adds Run key to start application
                      PID:4088
                  • C:\ProgramData\Skype\Skype.exe
                    "C:\ProgramData\Skype\Skype.exe" 1856
                    5⤵
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:4640
                    • C:\ProgramData\Skype\Skype.exe
                      "C:\ProgramData\Skype\Skype.exe"
                      6⤵
                        PID:2328
                    • C:\ProgramData\Skype\Skype.exe
                      "C:\ProgramData\Skype\Skype.exe" 1856
                      5⤵
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:1984
                      • C:\ProgramData\Skype\Skype.exe
                        "C:\ProgramData\Skype\Skype.exe"
                        6⤵
                        • Adds Run key to start application
                        PID:4612
                    • C:\ProgramData\Skype\Skype.exe
                      "C:\ProgramData\Skype\Skype.exe" 1856
                      5⤵
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:2896
                      • C:\ProgramData\Skype\Skype.exe
                        "C:\ProgramData\Skype\Skype.exe"
                        6⤵
                        • Adds Run key to start application
                        PID:3512
                    • C:\ProgramData\Skype\Skype.exe
                      "C:\ProgramData\Skype\Skype.exe" 1856
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:3380

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\Skype\Skype.exe
              Filesize

              1.3MB

              MD5

              40d74a5a028765d158afa53a9cf69556

              SHA1

              20e36e3f82d725430c46a752b46b11b9e2342272

              SHA256

              12a3610e72a00b67a86780d45e2bd0e38d41144275b352247232d47282567384

              SHA512

              93321752dfaf1da0ae4217ad41e9eaa86f74e2e6acc3f2e8bcd0cbf18eba460635ef003b58708344fbf21ca2e76bebf26f2ec1b0f42148d6cab7625d9bb00c51

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Skype.exe.log
              Filesize

              226B

              MD5

              916851e072fbabc4796d8916c5131092

              SHA1

              d48a602229a690c512d5fdaf4c8d77547a88e7a2

              SHA256

              7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

              SHA512

              07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              Download Submit

            • memory/112-47-0x00000000025F0000-0x0000000002608000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1068-192-0x0000000002F60000-0x0000000002F78000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1144-114-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1172-116-0x0000000002920000-0x0000000002938000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1260-206-0x0000000000F40000-0x0000000000F58000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1260-38-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1408-137-0x0000000002320000-0x0000000002338000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1428-104-0x0000000000700000-0x0000000000807000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1428-100-0x0000000000700000-0x0000000000807000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1568-65-0x00000000030E0000-0x00000000030F8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1792-258-0x00000000022C0000-0x00000000022D8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/1856-110-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-75-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-21-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-96-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-28-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-29-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-25-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-18-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-122-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-85-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-20-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-40-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-42-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-22-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-63-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1856-56-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1984-119-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/1984-286-0x0000000002640000-0x0000000002658000-memory.dmp

              Filesize

              96KB

              Download

            • memory/2108-68-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/2164-58-0x0000000002590000-0x00000000025A8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/2380-90-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/2416-170-0x0000000002880000-0x0000000002898000-memory.dmp

              Filesize

              96KB

              Download

            • memory/2432-1-0x00000000005F0000-0x000000000074A000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/2432-3-0x0000000004F60000-0x0000000004F78000-memory.dmp

              Filesize

              96KB

              Download

            • memory/2432-0-0x000000007450E000-0x000000007450F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2432-2-0x0000000074500000-0x0000000074CB0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/2432-4-0x0000000004F80000-0x0000000004F86000-memory.dmp

              Filesize

              24KB

              Download

            • memory/2432-31-0x0000000074500000-0x0000000074CB0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/2548-73-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/2752-94-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/2860-34-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/2896-289-0x00000000016B0000-0x00000000016C8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/3116-15-0x0000000074500000-0x0000000074CB0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3116-23-0x0000000074500000-0x0000000074CB0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3120-45-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/3256-87-0x0000000004BB0000-0x0000000004BC8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/3376-185-0x00000000028E0000-0x00000000028F8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/3420-108-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/3492-272-0x0000000005230000-0x0000000005248000-memory.dmp

              Filesize

              96KB

              Download

            • memory/3508-70-0x00000000034A0000-0x00000000034B8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/3616-149-0x0000000000EC0000-0x0000000000ED8000-memory.dmp

              Filesize

              96KB

              Download

            • memory/3860-51-0x0000000000600000-0x0000000000707000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/3860-54-0x0000000000600000-0x0000000000707000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/4340-83-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/4456-239-0x0000000004D20000-0x0000000004D38000-memory.dmp

              Filesize

              96KB

              Download

            • memory/4468-61-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/4564-10-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/4564-14-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/4564-5-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/4564-6-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/4564-8-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/4604-79-0x0000000000400000-0x0000000000507000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/4756-142-0x0000000001520000-0x0000000001538000-memory.dmp

              Filesize

              96KB

              Download