Overview

overview

10

Static

static

3

JaffaCakes...e1.exe

windows7-x64

10

JaffaCakes...e1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    54s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-01-2025 04:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_7784fe587f786892f8df93f0056eade1.exe

  • Size

    808KB

  • MD5

    7784fe587f786892f8df93f0056eade1

  • SHA1

    8f60e7f8250dd2b5ddd04465f903645fa625ce27

  • SHA256

    cc2915d3d4526f27a801f573dbf06b6148367af615eda80f0ef73b8b913dfff4

  • SHA512

    69cf4f223aab358839eb0c8db828aba6e95fe1c8aacaa99138b35c34dd31973078d45f26af082895b1ccf2435bea8cd03018ee083bf71e3c61672dea4099e440

  • SSDEEP

    12288:lcyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:lc2+ms5pavs+NpM9nXg79CU

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 40 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7784fe587f786892f8df93f0056eade1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7784fe587f786892f8df93f0056eade1.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Users\Admin\x276Ht.exe
      C:\Users\Admin\x276Ht.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Users\Admin\hauaka.exe
        "C:\Users\Admin\hauaka.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3128
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del x276Ht.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1428
    • C:\Users\Admin\2xiv.exe
      C:\Users\Admin\2xiv.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Users\Admin\2xiv.exe
        "C:\Users\Admin\2xiv.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4940
    • C:\Users\Admin\3xiv.exe
      C:\Users\Admin\3xiv.exe
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:764
      • C:\Users\Admin\3xiv.exe
        C:\Users\Admin\3xiv.exe startC:\Users\Admin\AppData\Roaming\20160\6BE9E.exe%C:\Users\Admin\AppData\Roaming\20160
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3780
      • C:\Users\Admin\3xiv.exe
        C:\Users\Admin\3xiv.exe startC:\Program Files (x86)\60C82\lvvm.exe%C:\Program Files (x86)\60C82
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2372
      • C:\Program Files (x86)\LP\9E92\2E2F.tmp
        "C:\Program Files (x86)\LP\9E92\2E2F.tmp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3760
    • C:\Users\Admin\4xiv.exe
      C:\Users\Admin\4xiv.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3784
      • C:\Users\Admin\AppData\Local\6400bf14\X
        *0*bc*a2a34c7e*31.193.3.240:53
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4452
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
            PID:928
      • C:\Users\Admin\5xiv.exe
        C:\Users\Admin\5xiv.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2836
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_7784fe587f786892f8df93f0056eade1.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          PID:3916
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2992
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1536
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4180
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2320
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3248
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3216
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:4688
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2780
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1932
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:424
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3504
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4956
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3448
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2264
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2016
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3916
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3644
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:1240
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:3796
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:212
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:1672
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:2960
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3616
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:2528
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3228
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3396
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3588
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4752
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:2416
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4228
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3212
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3648
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:4900
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4008
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:4320
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:1464
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4068
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4044
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4304
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:2380
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3644
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:1240
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3524
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4708
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:704
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4436
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:3668
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:3936
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:2468
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:1372
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:2232
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:2116
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:4132
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:1932
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:1020
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:3524
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:2124
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:3616
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:3084
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:2184
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3476
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:1020
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:1128
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:4760
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:2076
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:2492
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:3168
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:2636
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:2216
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:3980
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:3984
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:1836
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:3112

                                                                                                                      Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Reconnaissance

                                                                                                                      Resource Development

                                                                                                                      Initial Access

                                                                                                                      Execution

                                                                                                                      Persistence

                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                      2
                                                                                                                      T1547

                                                                                                                      Active Setup

                                                                                                                      1
                                                                                                                      T1547.014

                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                      1
                                                                                                                      T1547.001

                                                                                                                      Create or Modify System Process

                                                                                                                      1
                                                                                                                      T1543

                                                                                                                      Windows Service

                                                                                                                      1
                                                                                                                      T1543.003

                                                                                                                      Privilege Escalation

                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                      2
                                                                                                                      T1547

                                                                                                                      Active Setup

                                                                                                                      1
                                                                                                                      T1547.014

                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                      1
                                                                                                                      T1547.001

                                                                                                                      Create or Modify System Process

                                                                                                                      1
                                                                                                                      T1543

                                                                                                                      Windows Service

                                                                                                                      1
                                                                                                                      T1543.003

                                                                                                                      Defense Evasion

                                                                                                                      Hide Artifacts

                                                                                                                      1
                                                                                                                      T1564

                                                                                                                      Hidden Files and Directories

                                                                                                                      1
                                                                                                                      T1564.001

                                                                                                                      Modify Registry

                                                                                                                      6
                                                                                                                      T1112

                                                                                                                      Credential Access

                                                                                                                      Credentials from Password Stores

                                                                                                                      1
                                                                                                                      T1555

                                                                                                                      Credentials from Web Browsers

                                                                                                                      1
                                                                                                                      T1555.003

                                                                                                                      Unsecured Credentials

                                                                                                                      3
                                                                                                                      T1552

                                                                                                                      Credentials In Files

                                                                                                                      3
                                                                                                                      T1552.001

                                                                                                                      Discovery

                                                                                                                      Peripheral Device Discovery

                                                                                                                      2
                                                                                                                      T1120

                                                                                                                      Process Discovery

                                                                                                                      1
                                                                                                                      T1057

                                                                                                                      Query Registry

                                                                                                                      5
                                                                                                                      T1012

                                                                                                                      System Information Discovery

                                                                                                                      4
                                                                                                                      T1082

                                                                                                                      System Location Discovery

                                                                                                                      1
                                                                                                                      T1614

                                                                                                                      System Language Discovery

                                                                                                                      1
                                                                                                                      T1614.001

                                                                                                                      Lateral Movement

                                                                                                                      Collection

                                                                                                                      Data from Local System

                                                                                                                      2
                                                                                                                      T1005

                                                                                                                      Command and Control

                                                                                                                      Exfiltration

                                                                                                                      Impact

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\Program Files (x86)\LP\9E92\2E2F.tmp
                                                                                                                        Filesize

                                                                                                                        101KB

                                                                                                                        MD5

                                                                                                                        8ddb300fe82a1e8ab0b0c9b704725316

                                                                                                                        SHA1

                                                                                                                        899ef3abfa492136996ccffd0958e0c607817835

                                                                                                                        SHA256

                                                                                                                        86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f

                                                                                                                        SHA512

                                                                                                                        3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\2xiv.exe
                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        MD5

                                                                                                                        930ddf5711ff276332bc5e1eec8cded0

                                                                                                                        SHA1

                                                                                                                        e14b2bdd272fe546c043ab7a2f249955e1820744

                                                                                                                        SHA256

                                                                                                                        4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d

                                                                                                                        SHA512

                                                                                                                        3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\3xiv.exe
                                                                                                                        Filesize

                                                                                                                        287KB

                                                                                                                        MD5

                                                                                                                        3d6f651187a05dfab030fd923b218279

                                                                                                                        SHA1

                                                                                                                        9d0fff6e4d22777a9f3b7c57baea9f34151eca65

                                                                                                                        SHA256

                                                                                                                        b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e

                                                                                                                        SHA512

                                                                                                                        835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\4xiv.exe
                                                                                                                        Filesize

                                                                                                                        265KB

                                                                                                                        MD5

                                                                                                                        45cba518c7a8b41f65690da873e13e3d

                                                                                                                        SHA1

                                                                                                                        5a787a1f7f7bdd22c72b0f9d26818d902b65da8b

                                                                                                                        SHA256

                                                                                                                        c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79

                                                                                                                        SHA512

                                                                                                                        7515485b6d9e90cf4dd00b076c4173f19adffe0215d95edadd4ceb61b46a06c3751aa524c70a3cac738b751bc73802877ef2d16a44b5cc0399c3e85b704249f7

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\5xiv.exe
                                                                                                                        Filesize

                                                                                                                        44KB

                                                                                                                        MD5

                                                                                                                        fd4f97e710556c5769ab1e074a5c02b5

                                                                                                                        SHA1

                                                                                                                        eaac335c1dd2cd449f4d3b4f9b5cdad0cffa6d61

                                                                                                                        SHA256

                                                                                                                        7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18

                                                                                                                        SHA512

                                                                                                                        6f01d7a97497d245cf4144fac30cd169435ad51ea432adf2469e822773c529ff08daf0ffdca80c1aab607490b9f8f7cd06e08f6219c0065b58a773d42c159726

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                        Filesize

                                                                                                                        471B

                                                                                                                        MD5

                                                                                                                        a37f9f425b9fbc2d29863365a9602196

                                                                                                                        SHA1

                                                                                                                        168930427a9d4deba1fea68766382e0ae04f3697

                                                                                                                        SHA256

                                                                                                                        6c621b7d6851feb47063398dc23ad01876dd3e2f7efee5523d409e30f77b1e31

                                                                                                                        SHA512

                                                                                                                        9b15218a1fb24909f8f0a44a460b08dbf2d947bf1b384c3460318b970cd68528b7dd0392c3e5606aac9c58a62a9165b1db8e9ff413bd91e25972fb878abff8d8

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                                                        Filesize

                                                                                                                        412B

                                                                                                                        MD5

                                                                                                                        5c9d93d3d9bd93fd584731c43e7e07b3

                                                                                                                        SHA1

                                                                                                                        704fd8ee31d2fa2f31a13fc6aed8a3ed5391cdfb

                                                                                                                        SHA256

                                                                                                                        e071a29df5a1cf8902e0aa49eb271a1ae934d1ea84a4a16c622a280e0b2ca96a

                                                                                                                        SHA512

                                                                                                                        5d42b4dc5e1518fc8bf883488bfd666bad86d69bfae7089315d5da55573b1e00a24b10fcb1b25894eeeaae10533a942da66e0812f86f8b452fbc2470e9884242

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\6400bf14\X
                                                                                                                        Filesize

                                                                                                                        38KB

                                                                                                                        MD5

                                                                                                                        72de2dadaf875e2fd7614e100419033c

                                                                                                                        SHA1

                                                                                                                        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

                                                                                                                        SHA256

                                                                                                                        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

                                                                                                                        SHA512

                                                                                                                        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        5081658ebb0e4898d4534b3c9cec3a57

                                                                                                                        SHA1

                                                                                                                        72c0c864de4abc9ca32274114d0c87827f1bbc3c

                                                                                                                        SHA256

                                                                                                                        13dbbfc0c2294ac7f09855903aebdcb62c3bd0f6ef6545547154e017405c02c6

                                                                                                                        SHA512

                                                                                                                        7e461a21c01aab8430c58dd421adc7ad7339b545d8b4206eb91d14b79967cc843202e5455241c1a996d7203e21536f847bf726a40db7c74649f27de528353c68

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\DGTT1KLJ\microsoft.windows[1].xml
                                                                                                                        Filesize

                                                                                                                        97B

                                                                                                                        MD5

                                                                                                                        dfc314c564e6dcc3d3d7f1d2cdf01ff5

                                                                                                                        SHA1

                                                                                                                        53a06942171b8047e4850e459554488280da265e

                                                                                                                        SHA256

                                                                                                                        56b9785b0255bd668bfdb7d6f789d1e54de550d567b85e52105893b8fbb45a08

                                                                                                                        SHA512

                                                                                                                        48688def79fffd15cd97505f73860552d7ad5069cd741214ca13225dd69eff4111338175bcb6fc9e1ed926f4bbc11b28865ab3df33aabf8bb7b8b68a0531f5f5

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Roaming\20160\0C82.016
                                                                                                                        Filesize

                                                                                                                        600B

                                                                                                                        MD5

                                                                                                                        da9f0544c582c569ff8c4af3d4bb359b

                                                                                                                        SHA1

                                                                                                                        dca0d1653e5c10224d9da68a569376d69ee81595

                                                                                                                        SHA256

                                                                                                                        7c58f4ecafd4d97362736f27baddaaa4640f56fd7a2821bef0babedd4a1b97fe

                                                                                                                        SHA512

                                                                                                                        fe470fce2e10e60675314dda9a2047d66d9ecf6fffb67c009b63fb6e0fec49ff5a5bdc8206b83f1a6f566a9aa89752cb233e0895a7e93a4cdbd3d5f362662709

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Roaming\20160\0C82.016
                                                                                                                        Filesize

                                                                                                                        996B

                                                                                                                        MD5

                                                                                                                        1fab68958bebb0f1cb660ecc05ba1ef1

                                                                                                                        SHA1

                                                                                                                        9b8b4fbe056cbcfcbea29326e5593a6df42e638d

                                                                                                                        SHA256

                                                                                                                        6738bd5a2401fc4a8a75649a2323f5caa20d8826658611b0ba9460ff17a79448

                                                                                                                        SHA512

                                                                                                                        5c08606ddc41c0e2e6ffa195a6cf4b83687a5ee3182e356b1e7d1baecf5eecbb8c3bbaf36cb72f2525b01f81b51f627f0c419ffe604544994f7c2786555b41f7

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Roaming\20160\0C82.016
                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        de464aea9500f90f5b3f146cd916a084

                                                                                                                        SHA1

                                                                                                                        dfc445f901efa03d090a3e5d78abfec795386bdf

                                                                                                                        SHA256

                                                                                                                        dca2555f94770bab31aa097ce173332d4c926b3a5eb9018a0b1dce40da25aee9

                                                                                                                        SHA512

                                                                                                                        9a132193e4bf0602d59ea10a9e015fa75444253c0eecf7b9f362d92bc91dc13ef53130c4bd9ee2bce5adb8d4f750ebdcaada13bc3f56e7f316a7fa08b7fe46b8

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\hauaka.exe
                                                                                                                        Filesize

                                                                                                                        332KB

                                                                                                                        MD5

                                                                                                                        bec8354f1d22f9c131b4deaa60bdedde

                                                                                                                        SHA1

                                                                                                                        a1985168ae28a75767868f747fc0c79428a6392e

                                                                                                                        SHA256

                                                                                                                        9e8613ba2281c1e007199b3212b14743e079d624a852980088bb3821229ce0c0

                                                                                                                        SHA512

                                                                                                                        dea2f12e315959bfffa7556473ff9fe76fbc7cf8c89015d8f40371207161ed1febecfcc44d44d234af0f03b7f29cb5b0992df254b28974b62598b257fba17081

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\x276Ht.exe
                                                                                                                        Filesize

                                                                                                                        332KB

                                                                                                                        MD5

                                                                                                                        ad27bc021625bc7692f942a626b3a576

                                                                                                                        SHA1

                                                                                                                        12d961ecb68e63c2cf3c3590da311a9bd5e521f7

                                                                                                                        SHA256

                                                                                                                        39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0

                                                                                                                        SHA512

                                                                                                                        2c51d8fe3cc5d2eb50d7cc5faf76f8b1d35380eb078409b1fa24caa9ca719d3b447d0669f07138330d360471a06bbc1dcca5e7a2eb81179af164a87a9f6b74bb

                                                                                                                        Download Submit

                                                                                                                      • memory/424-676-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/764-89-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                        Download

                                                                                                                      • memory/764-201-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                        Download

                                                                                                                      • memory/764-792-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                        Download

                                                                                                                      • memory/1240-976-0x0000027B7D100000-0x0000027B7D200000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/1240-981-0x0000027B7E260000-0x0000027B7E280000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1240-1005-0x0000027B7E630000-0x0000027B7E650000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1240-993-0x0000027B7E220000-0x0000027B7E240000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1672-1119-0x0000023BC4620000-0x0000023BC4720000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/1672-1118-0x0000023BC4620000-0x0000023BC4720000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/1672-1117-0x0000023BC4620000-0x0000023BC4720000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/1932-521-0x0000020A71300000-0x0000020A71400000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/1932-526-0x0000020A723E0000-0x0000020A72400000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1932-539-0x0000020A723A0000-0x0000020A723C0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/1932-557-0x0000020A729B0000-0x0000020A729D0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2016-838-0x000001E980990000-0x000001E9809B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2016-852-0x000001E980DA0000-0x000001E980DC0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2016-829-0x000001E9809D0000-0x000001E9809F0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/2016-826-0x000001E97F900000-0x000001E97FA00000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/2016-824-0x000001E97F900000-0x000001E97FA00000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/2320-355-0x00000000035C0000-0x00000000035C1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2372-203-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                        Download

                                                                                                                      • memory/3216-392-0x00000223BDD60000-0x00000223BDD80000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3216-363-0x00000223BD990000-0x00000223BD9B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3216-377-0x00000223BD950000-0x00000223BD970000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/3448-822-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/3760-673-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        116KB

                                                                                                                        Download

                                                                                                                      • memory/3780-92-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                        Download

                                                                                                                      • memory/3784-71-0x0000000030670000-0x00000000306BF000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        316KB

                                                                                                                        Download

                                                                                                                      • memory/3796-1115-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/3916-975-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/4688-519-0x0000000004550000-0x0000000004551000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/4940-53-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                        Download

                                                                                                                      • memory/4940-51-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                        Download

                                                                                                                      • memory/4940-50-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                        Download

                                                                                                                      • memory/4940-47-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        56KB

                                                                                                                        Download

                                                                                                                      • memory/4956-679-0x000001D13EA00000-0x000001D13EB00000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/4956-677-0x000001D13EA00000-0x000001D13EB00000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                        Download

                                                                                                                      • memory/4956-682-0x000001D13FB00000-0x000001D13FB20000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/4956-691-0x000001D13F7B0000-0x000001D13F7D0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download

                                                                                                                      • memory/4956-714-0x000001D13FEC0000-0x000001D13FEE0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        Download