Overview

overview

10

Static

static

1

b4eedd9198...18.exe

windows7-x64

10

b4eedd9198...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2024 05:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4eedd919843a6803fe3a7695ee154c0_JaffaCakes118.exe

  • Size

    970KB

  • MD5

    b4eedd919843a6803fe3a7695ee154c0

  • SHA1

    533cc556310b099034116e9e31eb56f31db09ea0

  • SHA256

    50672a7690d16a2cd3281c19929b1d7ee307409a731bc52fcbb52ce2a50d93c4

  • SHA512

    04003fb8894324990552cac995bb1852e84204f8f35b04e4c6056d78987d46fac0ea82ce40b9188252a213e90148b0e2d310294fc003c23005c83d75d34a4748

  • SSDEEP

    1536:7ws+Dd8oVCTSzQHhn0lIF2rX2OKvQ4m6OXHGvA3D0FsBRyBYOKG0Ph:8ZCoaSzQB0iiaSvTyCRy+4

Score
10/10
defense_evasiondiscoveryevasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Indicator Removal: Clear Persistence 1 TTPs 46 IoCs

    remove IFEO.

    defense_evasion
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4eedd919843a6803fe3a7695ee154c0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b4eedd919843a6803fe3a7695ee154c0_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3680
    • C:\Users\Admin\AppData\Local\Temp\b4eedd919843a6803fe3a7695ee154c0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\b4eedd919843a6803fe3a7695ee154c0_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4944
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3684
        • C:\Users\Admin\E696D64614\winlogon.exe
          "C:\Users\Admin\E696D64614\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4792
          • C:\Users\Admin\E696D64614\winlogon.exe
            "C:\Users\Admin\E696D64614\winlogon.exe"
            5⤵
            • Modifies firewall policy service
            • Modifies security service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Event Triggered Execution: Image File Execution Options Injection
            • Drops startup file
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Indicator Removal: Clear Persistence
            • System Location Discovery: System Language Discovery
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:3332
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1040
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1440
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17410 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1296
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17430 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1200
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17436 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:856
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17442 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1068
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17448 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1696
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17454 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1640
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:82946 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3184
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:17464 /prefetch:2
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4316

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    2
    T1543

    Windows Service

    2
    T1543.003

    Event Triggered Execution

    1
    T1546

    Image File Execution Options Injection

    1
    T1546.012

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    2
    T1543

    Windows Service

    2
    T1543.003

    Event Triggered Execution

    1
    T1546

    Image File Execution Options Injection

    1
    T1546.012

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Impair Defenses

    4
    T1562

    Disable or Modify System Firewall

    1
    T1562.004

    Disable or Modify Tools

    3
    T1562.001

    Indicator Removal

    1
    T1070

    Clear Persistence

    1
    T1070.009

    Modify Registry

    11
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    3
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      2KB

      MD5

      4f051878fb4221e13b9579206d4715a1

      SHA1

      84437f26cef189bdb1236e0e57399680058f17e1

      SHA256

      a091abd3018810d079b2dd3688888ec7e0ee179573807f103926f0bdded7e418

      SHA512

      1f89ff9fa7d95dd195221f5e553a0b6c901e209335fff21b39a95cfbe96a6d041831a1dbfdd8c5672da84f73f034637180ad9d7eb575d581900e30fb0a31c810

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      549aeb864011f0c57644853ec90cbab9

      SHA1

      fd63ad25ed0824b3aa6c9bce49f55d85d0a88e3e

      SHA256

      8c2c91480d44c8881a3cde343916de69bcddf67dff17588e9640c4d7b01437ea

      SHA512

      6d6cacc4c938ff1cc53d4504fc8faa8ca2c4ddab8c0edfddfaee6039a12b9f845dca85b0ef06cad8b6a2a7f02c0b6cb47cf6ea0dda333ae21bb59d222247be7e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      488B

      MD5

      e039cb0ca24651a18b4258a538b8e61e

      SHA1

      e573d35e88498cb6e755935e8cbdb13c57db0a93

      SHA256

      20ba0a07058ea62a13fb193b8af0797bebb4405cd25fe4e8db55107202c0822d

      SHA512

      343a3d210cf5cc794687cc83ed16bdf252c6ea2488a3db9983086684c3c279cccd55512f2a5ea8b80df8110462207a92219194821ba8e1cb739062f396e0304e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      404B

      MD5

      8d57534fe2aa5e54bac8b76588c58fed

      SHA1

      afc18b6ccc5c0c1b6af206e51be57ee752178d9a

      SHA256

      2b11e8da6f7ef95e4b190be1ae6fa3cfea99953860a64c7ab969fd92ef7729de

      SHA512

      4dcdce0b1536ddb209e1bf6e04d20e848cd84cace6bd32515e849922313c6e9550915222a876a5ed636a598caa6c9e7d37dd408bde013103c5515a278976dd94

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verFC23.tmp
      Filesize

      15KB

      MD5

      1a545d0052b581fbb2ab4c52133846bc

      SHA1

      62f3266a9b9925cd6d98658b92adec673cbe3dd3

      SHA256

      557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

      SHA512

      bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\84KCLP1T\down[1]
      Filesize

      748B

      MD5

      c4f558c4c8b56858f15c09037cd6625a

      SHA1

      ee497cc061d6a7a59bb66defea65f9a8145ba240

      SHA256

      39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781

      SHA512

      d60353d3fbea2992d96795ba30b20727b022b9164b2094b922921d33ca7ce1634713693ac191f8f5708954544f7648f4840bcd5b62cb6a032ef292a8b0e52a44

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQRZN8O7\NewErrorPageTemplate[1]
      Filesize

      1KB

      MD5

      dfeabde84792228093a5a270352395b6

      SHA1

      e41258c9576721025926326f76063c2305586f76

      SHA256

      77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075

      SHA512

      e256f603e67335151bb709294749794e2e3085f4063c623461a0b3decbcca8e620807b707ec9bcbe36dcd7d639c55753da0495be85b4ae5fb6bfc52ab4b284fd

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQRZN8O7\background_gradient[1]
      Filesize

      453B

      MD5

      20f0110ed5e4e0d5384a496e4880139b

      SHA1

      51f5fc61d8bf19100df0f8aadaa57fcd9c086255

      SHA256

      1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b

      SHA512

      5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\bullet[1]
      Filesize

      447B

      MD5

      26f971d87ca00e23bd2d064524aef838

      SHA1

      7440beff2f4f8fabc9315608a13bf26cabad27d9

      SHA256

      1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d

      SHA512

      c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\errorPageStrings[1]
      Filesize

      4KB

      MD5

      d65ec06f21c379c87040b83cc1abac6b

      SHA1

      208d0a0bb775661758394be7e4afb18357e46c8b

      SHA256

      a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

      SHA512

      8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\ErrorPageTemplate[1]
      Filesize

      2KB

      MD5

      f4fe1cb77e758e1ba56b8a8ec20417c5

      SHA1

      f4eda06901edb98633a686b11d02f4925f827bf0

      SHA256

      8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

      SHA512

      62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\dnserror[1]
      Filesize

      2KB

      MD5

      2dc61eb461da1436f5d22bce51425660

      SHA1

      e1b79bcab0f073868079d807faec669596dc46c1

      SHA256

      acdeb4966289b6ce46ecc879531f85e9c6f94b718aab521d38e2e00f7f7f7993

      SHA512

      a88becb4fbddc5afc55e4dc0135af714a3eec4a63810ae5a989f2cecb824a686165d3cedb8cbd8f35c7e5b9f4136c29dea32736aabb451fe8088b978b493ac6d

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\httpErrorPagesScripts[1]
      Filesize

      11KB

      MD5

      9234071287e637f85d721463c488704c

      SHA1

      cca09b1e0fba38ba29d3972ed8dcecefdef8c152

      SHA256

      65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

      SHA512

      87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\info_48[1]
      Filesize

      4KB

      MD5

      5565250fcc163aa3a79f0b746416ce69

      SHA1

      b97cc66471fcdee07d0ee36c7fb03f342c231f8f

      SHA256

      51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859

      SHA512

      e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\navcancl[1]
      Filesize

      2KB

      MD5

      4bcfe9f8db04948cddb5e31fe6a7f984

      SHA1

      42464c70fc16f3f361c2419751acd57d51613cdf

      SHA256

      bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228

      SHA512

      bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\suggestions[1].en-US
      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\~DF2129283214C06F3E.TMP
      Filesize

      16KB

      MD5

      29f377ae4743df2c73bc8f5dc320f4af

      SHA1

      8c55ad6ac8f8f7cba739d07c1f81841a0fae482e

      SHA256

      9ebe8f9d2d098d7ae2b8ebe620098a7fd6d7b5aa8651935e4bad144b13def7b3

      SHA512

      8ca764f1d679b0712bd2a16ad64e48f748598de899692d14acee394dc92005c3159d44f4556d2895770cd62ea954b4aa83b42ce5deb148894510a3fcb72cf3c2

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
      Filesize

      3KB

      MD5

      774866c667bbacbd950c4167ec979945

      SHA1

      47367d851e4f36a3dc0693ba6cd8fdbbe650cace

      SHA256

      2bcf631c76056a59931159b86081506c93bdb77b15a0004b1a2db4258018854c

      SHA512

      77f2d74428d4a0588a1ba44da5a4d02fe29c1de4ef43e790ea034daa89b8537943d19766fcaca16cc06c0ef4fef2430552e890d03a964d7edb645a1b59b53ec7

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
      Filesize

      3KB

      MD5

      23a9749a60398ffd284a1dcba06c68ed

      SHA1

      5f064f810e70c3ef943bdd0a023f04e502d29f44

      SHA256

      76bfc4d9de09b10c60c157d0babb4a702ab804c9b45ac597db93a27264641f7c

      SHA512

      6e26356a5aa2fa102b7317fbeff838a97dcf92b2cc1c84029a07f5ac35cbcfcbf14cbd82ba6d76074168647ae8ada8cf63d384823147336895102981dde84beb

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      970KB

      MD5

      b4eedd919843a6803fe3a7695ee154c0

      SHA1

      533cc556310b099034116e9e31eb56f31db09ea0

      SHA256

      50672a7690d16a2cd3281c19929b1d7ee307409a731bc52fcbb52ce2a50d93c4

      SHA512

      04003fb8894324990552cac995bb1852e84204f8f35b04e4c6056d78987d46fac0ea82ce40b9188252a213e90148b0e2d310294fc003c23005c83d75d34a4748

      Download Submit

    • memory/3332-241-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-267-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-30-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-33-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-192-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-194-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-206-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-265-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-173-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-36-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-253-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/3332-53-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

      Download

    • memory/4792-24-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4792-47-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4944-4-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4944-3-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4944-2-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4944-0-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4944-22-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

      Download