Overview

overview

10

Static

static

3

JaffaCakes...50.exe

windows7-x64

10

JaffaCakes...50.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-01-2025 13:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_57c5deca4b2e9dca6f2e37c59983b150.exe

  • Size

    808KB

  • MD5

    57c5deca4b2e9dca6f2e37c59983b150

  • SHA1

    4d2f55cf77ecd6851747f7cc730876e4c06e0e26

  • SHA256

    5eea185811d3ff23b7f3ddf213e651856cbf0d70e23faf6c8e7837ed31162540

  • SHA512

    2b368fe7c778a6fd596fe1dfb4775a9cf09077db5426515dcd95c544d72b3fb9568ca3a22c12ad711eec445277bd4d184b30efe5a8b7252a9e1025e8c5506a4b

  • SSDEEP

    12288:kcyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:kc2+ms5pavs+NpM9nXg79CU

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 38 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57c5deca4b2e9dca6f2e37c59983b150.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57c5deca4b2e9dca6f2e37c59983b150.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\x276Ht.exe
      C:\Users\Admin\x276Ht.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Users\Admin\maitoi.exe
        "C:\Users\Admin\maitoi.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1824
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del x276Ht.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1424
    • C:\Users\Admin\2xiv.exe
      C:\Users\Admin\2xiv.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Users\Admin\2xiv.exe
        "C:\Users\Admin\2xiv.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3096
    • C:\Users\Admin\3xiv.exe
      C:\Users\Admin\3xiv.exe
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1316
      • C:\Users\Admin\3xiv.exe
        C:\Users\Admin\3xiv.exe startC:\Users\Admin\AppData\Roaming\F4C23\85BB8.exe%C:\Users\Admin\AppData\Roaming\F4C23
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4892
      • C:\Users\Admin\3xiv.exe
        C:\Users\Admin\3xiv.exe startC:\Program Files (x86)\234B8\lvvm.exe%C:\Program Files (x86)\234B8
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3736
      • C:\Program Files (x86)\LP\B83F\1F2B.tmp
        "C:\Program Files (x86)\LP\B83F\1F2B.tmp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:404
    • C:\Users\Admin\4xiv.exe
      C:\Users\Admin\4xiv.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Users\Admin\AppData\Local\6400bf14\X
        *0*bc*aad7cef5*31.193.3.240:53
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4868
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
            PID:4916
      • C:\Users\Admin\5xiv.exe
        C:\Users\Admin\5xiv.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4652
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_57c5deca4b2e9dca6f2e37c59983b150.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3848
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          PID:1040
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:868
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1872
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4944
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3964
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:456
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:4228
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:556
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5032
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:3628
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1352
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2252
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      PID:528
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2732
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2972
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4504
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:1852
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:3964
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:2812
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3928
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:4980
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4196
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:2336
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:3640
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3068
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:5092
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:1772
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4200
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 4200 -s 6012
                                  2⤵
                                    PID:3848
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:1496
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:2616
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1920
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3092
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:3884
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3652
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:2896
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4360
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4492
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3212
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1352
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4084
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:808
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4768
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3592
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4228
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:5036
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4040
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4304
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3536
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3452
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4308
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4372
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:1036
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:4064
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:3668
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:3796
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:2284
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:3728
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:3168
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:4684
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:2732
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:672
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:3732
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:1512
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4900
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:2020
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                            1⤵
                                                                                                              PID:948
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:4992
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:3396
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4816
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:2580
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:2440
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:716
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:736
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                            1⤵
                                                                                                                              PID:2924

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                            Reconnaissance

                                                                                                                            Resource Development

                                                                                                                            Initial Access

                                                                                                                            Execution

                                                                                                                            Persistence

                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                            2
                                                                                                                            T1547

                                                                                                                            Active Setup

                                                                                                                            1
                                                                                                                            T1547.014

                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                            1
                                                                                                                            T1547.001

                                                                                                                            Create or Modify System Process

                                                                                                                            1
                                                                                                                            T1543

                                                                                                                            Windows Service

                                                                                                                            1
                                                                                                                            T1543.003

                                                                                                                            Privilege Escalation

                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                            2
                                                                                                                            T1547

                                                                                                                            Active Setup

                                                                                                                            1
                                                                                                                            T1547.014

                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                            1
                                                                                                                            T1547.001

                                                                                                                            Create or Modify System Process

                                                                                                                            1
                                                                                                                            T1543

                                                                                                                            Windows Service

                                                                                                                            1
                                                                                                                            T1543.003

                                                                                                                            Defense Evasion

                                                                                                                            Hide Artifacts

                                                                                                                            1
                                                                                                                            T1564

                                                                                                                            Hidden Files and Directories

                                                                                                                            1
                                                                                                                            T1564.001

                                                                                                                            Modify Registry

                                                                                                                            6
                                                                                                                            T1112

                                                                                                                            Credential Access

                                                                                                                            Credentials from Password Stores

                                                                                                                            1
                                                                                                                            T1555

                                                                                                                            Credentials from Web Browsers

                                                                                                                            1
                                                                                                                            T1555.003

                                                                                                                            Unsecured Credentials

                                                                                                                            3
                                                                                                                            T1552

                                                                                                                            Credentials In Files

                                                                                                                            3
                                                                                                                            T1552.001

                                                                                                                            Discovery

                                                                                                                            Peripheral Device Discovery

                                                                                                                            2
                                                                                                                            T1120

                                                                                                                            Process Discovery

                                                                                                                            1
                                                                                                                            T1057

                                                                                                                            Query Registry

                                                                                                                            5
                                                                                                                            T1012

                                                                                                                            System Information Discovery

                                                                                                                            4
                                                                                                                            T1082

                                                                                                                            System Location Discovery

                                                                                                                            1
                                                                                                                            T1614

                                                                                                                            System Language Discovery

                                                                                                                            1
                                                                                                                            T1614.001

                                                                                                                            Lateral Movement

                                                                                                                            Collection

                                                                                                                            Data from Local System

                                                                                                                            2
                                                                                                                            T1005

                                                                                                                            Command and Control

                                                                                                                            Exfiltration

                                                                                                                            Impact

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • C:\Program Files (x86)\LP\B83F\1F2B.tmp
                                                                                                                              Filesize

                                                                                                                              101KB

                                                                                                                              MD5

                                                                                                                              8ddb300fe82a1e8ab0b0c9b704725316

                                                                                                                              SHA1

                                                                                                                              899ef3abfa492136996ccffd0958e0c607817835

                                                                                                                              SHA256

                                                                                                                              86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f

                                                                                                                              SHA512

                                                                                                                              3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\2xiv.exe
                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                              MD5

                                                                                                                              930ddf5711ff276332bc5e1eec8cded0

                                                                                                                              SHA1

                                                                                                                              e14b2bdd272fe546c043ab7a2f249955e1820744

                                                                                                                              SHA256

                                                                                                                              4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d

                                                                                                                              SHA512

                                                                                                                              3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\3xiv.exe
                                                                                                                              Filesize

                                                                                                                              287KB

                                                                                                                              MD5

                                                                                                                              3d6f651187a05dfab030fd923b218279

                                                                                                                              SHA1

                                                                                                                              9d0fff6e4d22777a9f3b7c57baea9f34151eca65

                                                                                                                              SHA256

                                                                                                                              b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e

                                                                                                                              SHA512

                                                                                                                              835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\4xiv.exe
                                                                                                                              Filesize

                                                                                                                              265KB

                                                                                                                              MD5

                                                                                                                              45cba518c7a8b41f65690da873e13e3d

                                                                                                                              SHA1

                                                                                                                              5a787a1f7f7bdd22c72b0f9d26818d902b65da8b

                                                                                                                              SHA256

                                                                                                                              c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79

                                                                                                                              SHA512

                                                                                                                              7515485b6d9e90cf4dd00b076c4173f19adffe0215d95edadd4ceb61b46a06c3751aa524c70a3cac738b751bc73802877ef2d16a44b5cc0399c3e85b704249f7

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\5xiv.exe
                                                                                                                              Filesize

                                                                                                                              44KB

                                                                                                                              MD5

                                                                                                                              fd4f97e710556c5769ab1e074a5c02b5

                                                                                                                              SHA1

                                                                                                                              eaac335c1dd2cd449f4d3b4f9b5cdad0cffa6d61

                                                                                                                              SHA256

                                                                                                                              7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18

                                                                                                                              SHA512

                                                                                                                              6f01d7a97497d245cf4144fac30cd169435ad51ea432adf2469e822773c529ff08daf0ffdca80c1aab607490b9f8f7cd06e08f6219c0065b58a773d42c159726

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                              Filesize

                                                                                                                              471B

                                                                                                                              MD5

                                                                                                                              04813c2e01bae56ddd2d943fcb96910c

                                                                                                                              SHA1

                                                                                                                              bacbb2e023ce07201a180a241642427740b1a220

                                                                                                                              SHA256

                                                                                                                              f402f46c2cbe5c4049fd10104af51ae77db4eb5a5d257a775b4d9283b52ee6ab

                                                                                                                              SHA512

                                                                                                                              19f74ee2665fc74f0a4e72e67f5f447403a03445e68db0599c2e121676a8eda92a191674b91a33c358a6bff6b25526dffdff16dc57c31369ec43f55f3f8e438b

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                              Filesize

                                                                                                                              412B

                                                                                                                              MD5

                                                                                                                              d3f520a9748a0a9cf5e57828bf8d53b2

                                                                                                                              SHA1

                                                                                                                              d26cff8453fc7b522cb59ee07fb64f8b3655a81a

                                                                                                                              SHA256

                                                                                                                              0ce6ce57c88dbba678bb5fce94fcd08bbdc3a427bc9f45d5781804cb5bfb9587

                                                                                                                              SHA512

                                                                                                                              1ab0721efe631c5d00000fe33bdd0ed8f9fbf67a532aed182bcf203390f057559791955f4ee857c4647aee954a0921adfe4bc03394e7aa3661ac11a01dec2899

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\6400bf14\X
                                                                                                                              Filesize

                                                                                                                              38KB

                                                                                                                              MD5

                                                                                                                              72de2dadaf875e2fd7614e100419033c

                                                                                                                              SHA1

                                                                                                                              5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

                                                                                                                              SHA256

                                                                                                                              c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

                                                                                                                              SHA512

                                                                                                                              e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              e396d2eef79f6fa9893b8b95ad2d332e

                                                                                                                              SHA1

                                                                                                                              643195b78ecc6bb948d23e276e80f6e82ca565c6

                                                                                                                              SHA256

                                                                                                                              2dcb1e53f294c89fc613b060771663a876fba6215575af9ae31f404924382830

                                                                                                                              SHA512

                                                                                                                              b4900d740cbe1d5daeaac0c8c63f4eef1bae1085b4d0cb80be6876381b56ff83a05a4da783b2eeae1620af4b0016460c28fb96b1239e56fe485bec11d6fff701

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DGTT1KLJ\microsoft.windows[1].xml
                                                                                                                              Filesize

                                                                                                                              97B

                                                                                                                              MD5

                                                                                                                              dfc314c564e6dcc3d3d7f1d2cdf01ff5

                                                                                                                              SHA1

                                                                                                                              53a06942171b8047e4850e459554488280da265e

                                                                                                                              SHA256

                                                                                                                              56b9785b0255bd668bfdb7d6f789d1e54de550d567b85e52105893b8fbb45a08

                                                                                                                              SHA512

                                                                                                                              48688def79fffd15cd97505f73860552d7ad5069cd741214ca13225dd69eff4111338175bcb6fc9e1ed926f4bbc11b28865ab3df33aabf8bb7b8b68a0531f5f5

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Roaming\F4C23\34B8.4C2
                                                                                                                              Filesize

                                                                                                                              996B

                                                                                                                              MD5

                                                                                                                              26bb0d4637b0907d2a2603f6b19b2f9c

                                                                                                                              SHA1

                                                                                                                              7c422423736d75c0e649bcf40211fa7712ca1d76

                                                                                                                              SHA256

                                                                                                                              2d17d2ea29e45bb6416361f55c27bb1d3a651bc66b1bd4c73673940e396d6497

                                                                                                                              SHA512

                                                                                                                              d4517e12967b7f2e671f381783a94f106d0bb79e6c054f3350ddc8d909c6cfe3bbe2fea489a9e09f945efe8a6c07afb9291fae86643d29ee3fa725a713d3cf31

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Roaming\F4C23\34B8.4C2
                                                                                                                              Filesize

                                                                                                                              1KB

                                                                                                                              MD5

                                                                                                                              bc4dadc132c5d72d6bf700e81e868171

                                                                                                                              SHA1

                                                                                                                              c7a37970aba715ac9f20b2298d9a03f74a591b8d

                                                                                                                              SHA256

                                                                                                                              f74afd6fb6318da640ea3854982bb15b3813db49d0042e8ad880590b50b27f08

                                                                                                                              SHA512

                                                                                                                              270fa38b1e7ae77da92ab2bfd11d969778868f5571e4ca0e23669ac93163cfee8b99c1926a6b6a7fec66681806bd669420613ebd04d06a17aaab864fce38bf98

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Roaming\F4C23\34B8.4C2
                                                                                                                              Filesize

                                                                                                                              600B

                                                                                                                              MD5

                                                                                                                              31c284d302cde513da7ecff785092d65

                                                                                                                              SHA1

                                                                                                                              28675a72b34d59f767b7753182823d15dfa0ac2a

                                                                                                                              SHA256

                                                                                                                              3bce29e53fe26ce7100d533ad096cc3388532c327d9de5aff764da828ddeff28

                                                                                                                              SHA512

                                                                                                                              fb731737f8982f293b34050ff2b217370bee9ef1a3c8562f39b93c6d11e2d48c6cfae2f90bd36a23c9b47104ad103549825b2a390092647e8b931d29b2077a82

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\maitoi.exe
                                                                                                                              Filesize

                                                                                                                              332KB

                                                                                                                              MD5

                                                                                                                              40f7e03c509a35ed66898c3786efbfc6

                                                                                                                              SHA1

                                                                                                                              b050172e22f13ed31b91104502b3748bf849fbce

                                                                                                                              SHA256

                                                                                                                              6b5f2f66a34eed22a44d4a7c9961f6059b95f972a907e38e55f7351eac6cf210

                                                                                                                              SHA512

                                                                                                                              f357265c25b1e9db1dfe442bd1eeca16b70badf3877922b163d343da0c9087747549bb668d83f488d86793e2ff6503a35944cfc0c21d8371601d3b088ce3faab

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\x276Ht.exe
                                                                                                                              Filesize

                                                                                                                              332KB

                                                                                                                              MD5

                                                                                                                              ad27bc021625bc7692f942a626b3a576

                                                                                                                              SHA1

                                                                                                                              12d961ecb68e63c2cf3c3590da311a9bd5e521f7

                                                                                                                              SHA256

                                                                                                                              39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0

                                                                                                                              SHA512

                                                                                                                              2c51d8fe3cc5d2eb50d7cc5faf76f8b1d35380eb078409b1fa24caa9ca719d3b447d0669f07138330d360471a06bbc1dcca5e7a2eb81179af164a87a9f6b74bb

                                                                                                                              Download Submit

                                                                                                                            • memory/404-686-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              116KB

                                                                                                                              Download

                                                                                                                            • memory/456-387-0x000001EBF6500000-0x000001EBF6520000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/456-406-0x000001EBF6910000-0x000001EBF6930000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/456-370-0x000001EBF5520000-0x000001EBF5620000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1024KB

                                                                                                                              Download

                                                                                                                            • memory/456-375-0x000001EBF6540000-0x000001EBF6560000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/528-830-0x0000000002390000-0x0000000002391000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/1316-89-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              428KB

                                                                                                                              Download

                                                                                                                            • memory/1316-189-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              428KB

                                                                                                                              Download

                                                                                                                            • memory/1316-696-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              428KB

                                                                                                                              Download

                                                                                                                            • memory/2252-708-0x0000022C2E470000-0x0000022C2E490000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/2252-694-0x0000022C2E4B0000-0x0000022C2E4D0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/2252-690-0x0000022C2D150000-0x0000022C2D250000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1024KB

                                                                                                                              Download

                                                                                                                            • memory/2252-727-0x0000022C2E880000-0x0000022C2E8A0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/2252-689-0x0000022C2D150000-0x0000022C2D250000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1024KB

                                                                                                                              Download

                                                                                                                            • memory/2812-1138-0x00000000046D0000-0x00000000046D1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2972-834-0x0000022B12820000-0x0000022B12920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1024KB

                                                                                                                              Download

                                                                                                                            • memory/2972-850-0x0000022B13930000-0x0000022B13950000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/2972-860-0x0000022B13D40000-0x0000022B13D60000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/2972-837-0x0000022B13970000-0x0000022B13990000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/3096-45-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              56KB

                                                                                                                              Download

                                                                                                                            • memory/3096-51-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              56KB

                                                                                                                              Download

                                                                                                                            • memory/3096-49-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              56KB

                                                                                                                              Download

                                                                                                                            • memory/3096-48-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              56KB

                                                                                                                              Download

                                                                                                                            • memory/3628-687-0x00000000048A0000-0x00000000048A1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3736-191-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              428KB

                                                                                                                              Download

                                                                                                                            • memory/3964-985-0x0000022510400000-0x0000022510500000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1024KB

                                                                                                                              Download

                                                                                                                            • memory/3964-1000-0x00000225112C0000-0x00000225112E0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/3964-1012-0x00000225118E0000-0x0000022511900000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/3964-990-0x0000022511300000-0x0000022511320000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/3964-986-0x0000022510400000-0x0000022510500000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1024KB

                                                                                                                              Download

                                                                                                                            • memory/3980-71-0x0000000030670000-0x00000000306BF000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              316KB

                                                                                                                              Download

                                                                                                                            • memory/4228-532-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/4504-983-0x00000000045A0000-0x00000000045A1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/4892-92-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              428KB

                                                                                                                              Download

                                                                                                                            • memory/4944-368-0x0000000002A80000-0x0000000002A81000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/4980-1142-0x000002964C040000-0x000002964C140000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1024KB

                                                                                                                              Download

                                                                                                                            • memory/4980-1141-0x000002964C040000-0x000002964C140000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1024KB

                                                                                                                              Download

                                                                                                                            • memory/4980-1145-0x000002964D1A0000-0x000002964D1C0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/4980-1155-0x000002964D160000-0x000002964D180000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/4980-1177-0x000002964D570000-0x000002964D590000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/5032-551-0x00000239DC350000-0x00000239DC370000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/5032-570-0x00000239DC960000-0x00000239DC980000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download

                                                                                                                            • memory/5032-539-0x00000239DC390000-0x00000239DC3B0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              128KB

                                                                                                                              Download