Malware Analysis Report

2025-08-11 03:50

Sample ID 240409-pjfwraaa8w
Target e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118
SHA256 bfa0a6a94f9f940232cad86f2ec9c1a52e5de7b8e29cd22681eed52df8f6ee20
Tags
themida upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

bfa0a6a94f9f940232cad86f2ec9c1a52e5de7b8e29cd22681eed52df8f6ee20

Threat Level: Shows suspicious behavior

The file e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

themida upx

UPX packed file

Executes dropped EXE

Loads dropped DLL

Themida packer

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

NTFS ADS

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-09 12:21

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-09 12:21

Reported

2024-04-09 12:24

Platform

win7-20240221-en

Max time kernel

119s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2812 set thread context of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Internet Explorer\iexplore.exe:1 C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File created C:\Program Files (x86)\Internet Explorer\iexplore.exe:1 C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2892 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 2892 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 2892 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 2892 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 2892 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 2892 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 2892 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 2812 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2812 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2812 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2812 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2812 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2812 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2812 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2812 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2812 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2812 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 2812 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 2892 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 2892 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 2892 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 2892 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 2892 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 2892 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 2892 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 2624 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE
PID 2624 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE
PID 2624 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE
PID 2624 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE
PID 2624 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE
PID 2624 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE
PID 2624 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe

"C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.bat

C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe

"C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe"

C:\Windows\SysWOW64\MSIEXEC.EXE

MSIEXEC.EXE /p "C:\Users\Admin\AppData\Local\Temp\{6A581F85-0AB3-430D-9C9E-0BA1F4F8D8C9}\Patch106.msp" REINSTALLMODE=omus REINSTALL=ALL SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\iss.tmp0" SETUPEXENAME="setup.exe"

Network

N/A

Files

memory/2892-0-0x0000000000400000-0x0000000000433000-memory.dmp

\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe

MD5 777b643e9b61d7d240b867029a04547d
SHA1 3b0c4dc2eb5a6540eb214f035cce0da7876d9155
SHA256 e42b216953ce10d8ce84b3e536f1119c494e15dd828dfe80aa9d95bc0261f7ea
SHA512 956bb5fd11f7f40284b3c1f4891b71cececeab57f7dbca025b716d9033cd8eac281320dafcdbf96a9421731efe0baf6b994013e899f92cb7d88d68067bb72572

memory/2892-8-0x0000000003080000-0x00000000030FF000-memory.dmp

memory/2812-11-0x0000000000400000-0x000000000047E889-memory.dmp

memory/2812-13-0x0000000000400000-0x000000000047E889-memory.dmp

memory/2812-14-0x00000000003D0000-0x00000000003D1000-memory.dmp

memory/2812-16-0x0000000000250000-0x0000000000266000-memory.dmp

memory/2812-25-0x0000000000400000-0x000000000047E889-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.bat

MD5 c1fe28641bfb1c5db668dbc1abb5fc6c
SHA1 9cfbe8922d10262ddda79057e17dc26ac3b97a4a
SHA256 bdba16795d1c8314726ae86f9841d6297a937d62e81fa22d50caafd52e1dc981
SHA512 2dd5aebc9e7175e7cb1f981742c9644316e7b655b490bf8b7fcead407761a2535ea4291f5e2610b22e8b73bfe7f4cde2d1638ee54d1162051eefe9bbc305b58c

memory/2516-17-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2812-15-0x0000000000400000-0x000000000047E889-memory.dmp

\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe

MD5 07e79ffa8d7e3148c9c16537d97d10ff
SHA1 fdf1651c88e27da4b433497c420212b1e33cedf0
SHA256 698761f785aede8281bd10ee1fbd2bb5a4f350ae1c18a2119aac78e6785412a8
SHA512 71518e653702d3cdd783b79f071ca715d019c88c229dddc86698e4a2f9b6c56b36eb132788c2eadc3987355941c15c55df7b070f693f3561e116261f148d55be

C:\Users\Admin\AppData\Local\Temp\{6A581F85-0AB3-430D-9C9E-0BA1F4F8D8C9}\0x0409.ini

MD5 36affbd6ff77d1515cfc1c5e998fbaf9
SHA1 950d00ecc2e7fd2c48897814029e8eedf6397838
SHA256 fccc7f79d29318d8ae78850c262bac762c28858709a6e6cf3b62bcd2729a61e3
SHA512 2f29de86d486db783872581a43a834e5064d1488bc3f085ddc5a3287eb9ee8a4ce93d66f7b4965cafb3c4f06b38d4b0fcfdc0fcb1f99d61331a808e5d6011808

C:\Users\Admin\AppData\Local\Temp\~AB42.tmp

MD5 8c802f13322ef60e098c08e01b9987ab
SHA1 9a986a2a07e072ab39ae7a0b9c230f1592c498e9
SHA256 982c89ca9800c36870fa33a7fb3dd1634c0911f08f13dea702228e668d67cbec
SHA512 9f21e38622a8c9a1876db51f8d03111acbdbdfb8f0d7a800565f311195b18a3ff301ed29986742ce0a3a9d40cc506e0fe399d67ffc2965457ccd96755b239fa0

C:\Users\Admin\AppData\Local\Temp\_isAB43.tmp

MD5 e48def12f85132741735b067abadb174
SHA1 6ff1e37e25cd71d3825c553a44b746e2287c7bff
SHA256 766a76524cc1a9f2d57a0bb15a42f8eb14c93cfe852cc0e48fb4964576e2b793
SHA512 bdf14ab3bee25a49f19c71ac6b42e3abc8a492580817a0229648c77399ce2e88aa593adf6ee5f51aae0018b3fe9ea80c60dafe7b792a2cf2191211e9be214da9

C:\Users\Admin\AppData\Local\Temp\{6A581F85-0AB3-430D-9C9E-0BA1F4F8D8C9}\Patch106.msp

MD5 bb729faf320043046711052c3211d378
SHA1 495853a5a5f8040bcad55db6282b0a7e172d0f69
SHA256 f9bdb2a3b7d7028b860cc28bda2cf259e238a6ebcc952d50a88c6f6decb760a0
SHA512 4b86f3cfc4851b2dad32041d8a74347995e19b61f877105e10870dda355bba48b4a214616d8fe54a75b00a9ce85ac56e2d03a631aca9fff171960b880f4b4ce3

C:\Users\Admin\AppData\Local\Temp\{6A581F85-0AB3-430D-9C9E-0BA1F4F8D8C9}\_ISMSIDEL.INI

MD5 cd68fb7c1344dbfc7ea40c2207489ae4
SHA1 87f4cb149ba26189868b25e75ec2d6cfaf8804b7
SHA256 3929ad865c4b34a82acd615cc0b9f83dac65a961f8bd0759a832fdb369d50b23
SHA512 65102d2085d1a8bd3d56181bc91ec24a709d83ee5d0eb0f63881b643e18b40d1d10afed9249382b9945b308d1666481b34aad3a19ca5c9423e8fbc39a1899e6d

C:\Users\Admin\AppData\Local\Temp\{6A581F85-0AB3-430D-9C9E-0BA1F4F8D8C9}\_ISMSIDEL.INI

MD5 db9af7503f195df96593ac42d5519075
SHA1 1b487531bad10f77750b8a50aca48593379e5f56
SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

memory/2892-106-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2892-107-0x0000000003080000-0x00000000030FF000-memory.dmp

memory/2892-108-0x0000000000400000-0x0000000000433000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-09 12:21

Reported

2024-04-09 12:24

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3516 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 3516 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 3516 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe
PID 1064 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1064 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1064 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 1064 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 1064 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe C:\Windows\SysWOW64\cmd.exe
PID 3516 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 3516 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 3516 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe
PID 4204 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE
PID 4204 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE
PID 4204 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe C:\Windows\SysWOW64\MSIEXEC.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e9fa19fb977b56defd431dad3ab7f58d_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe

"C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.bat

C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe

"C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe"

C:\Windows\SysWOW64\MSIEXEC.EXE

MSIEXEC.EXE /p "C:\Users\Admin\AppData\Local\Temp\{0B75A20F-A3AD-4529-B31A-6AE635C37064}\Patch106.msp" REINSTALLMODE=omus REINSTALL=ALL SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\iss.tmp0" SETUPEXENAME="setup.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 129.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 233.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 137.71.105.51.in-addr.arpa udp

Files

memory/3516-0-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iss.tmp0\PES2012Patch106.exe

MD5 777b643e9b61d7d240b867029a04547d
SHA1 3b0c4dc2eb5a6540eb214f035cce0da7876d9155
SHA256 e42b216953ce10d8ce84b3e536f1119c494e15dd828dfe80aa9d95bc0261f7ea
SHA512 956bb5fd11f7f40284b3c1f4891b71cececeab57f7dbca025b716d9033cd8eac281320dafcdbf96a9421731efe0baf6b994013e899f92cb7d88d68067bb72572

memory/1064-15-0x0000000000400000-0x000000000047E889-memory.dmp

memory/1064-20-0x0000000000400000-0x000000000047E889-memory.dmp

memory/1064-19-0x0000000000560000-0x0000000000561000-memory.dmp

memory/1064-18-0x0000000000540000-0x0000000000556000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.exe

MD5 07e79ffa8d7e3148c9c16537d97d10ff
SHA1 fdf1651c88e27da4b433497c420212b1e33cedf0
SHA256 698761f785aede8281bd10ee1fbd2bb5a4f350ae1c18a2119aac78e6785412a8
SHA512 71518e653702d3cdd783b79f071ca715d019c88c229dddc86698e4a2f9b6c56b36eb132788c2eadc3987355941c15c55df7b070f693f3561e116261f148d55be

C:\Users\Admin\AppData\Local\Temp\iss.tmp0\setup.bat

MD5 c1fe28641bfb1c5db668dbc1abb5fc6c
SHA1 9cfbe8922d10262ddda79057e17dc26ac3b97a4a
SHA256 bdba16795d1c8314726ae86f9841d6297a937d62e81fa22d50caafd52e1dc981
SHA512 2dd5aebc9e7175e7cb1f981742c9644316e7b655b490bf8b7fcead407761a2535ea4291f5e2610b22e8b73bfe7f4cde2d1638ee54d1162051eefe9bbc305b58c

C:\Users\Admin\AppData\Local\Temp\_is3D7C.tmp

MD5 e48def12f85132741735b067abadb174
SHA1 6ff1e37e25cd71d3825c553a44b746e2287c7bff
SHA256 766a76524cc1a9f2d57a0bb15a42f8eb14c93cfe852cc0e48fb4964576e2b793
SHA512 bdf14ab3bee25a49f19c71ac6b42e3abc8a492580817a0229648c77399ce2e88aa593adf6ee5f51aae0018b3fe9ea80c60dafe7b792a2cf2191211e9be214da9

C:\Users\Admin\AppData\Local\Temp\~3D7B.tmp

MD5 8c802f13322ef60e098c08e01b9987ab
SHA1 9a986a2a07e072ab39ae7a0b9c230f1592c498e9
SHA256 982c89ca9800c36870fa33a7fb3dd1634c0911f08f13dea702228e668d67cbec
SHA512 9f21e38622a8c9a1876db51f8d03111acbdbdfb8f0d7a800565f311195b18a3ff301ed29986742ce0a3a9d40cc506e0fe399d67ffc2965457ccd96755b239fa0

C:\Users\Admin\AppData\Local\Temp\{0B75A20F-A3AD-4529-B31A-6AE635C37064}\0x0409.ini

MD5 36affbd6ff77d1515cfc1c5e998fbaf9
SHA1 950d00ecc2e7fd2c48897814029e8eedf6397838
SHA256 fccc7f79d29318d8ae78850c262bac762c28858709a6e6cf3b62bcd2729a61e3
SHA512 2f29de86d486db783872581a43a834e5064d1488bc3f085ddc5a3287eb9ee8a4ce93d66f7b4965cafb3c4f06b38d4b0fcfdc0fcb1f99d61331a808e5d6011808

C:\Users\Admin\AppData\Local\Temp\{0B75A20F-A3AD-4529-B31A-6AE635C37064}\_ISMSIDEL.INI

MD5 0ec01386b8664ceb528e98b6eb949735
SHA1 4ea397d254a8c6a257afaad367663b84339aca4e
SHA256 3a41858b8ec0905c9be820d8683ca795de7ccbf5795727294ab1b1215ec721b8
SHA512 85d81e3095602909404df567e584fbbc2c9bba3a65638c7b553d520ad478df9011f4d5898e2ff8611f317a2135e7cacb386f08483182626106d8598ffb8ebff5

C:\Users\Admin\AppData\Local\Temp\{0B75A20F-A3AD-4529-B31A-6AE635C37064}\Patch106.msp

MD5 bb729faf320043046711052c3211d378
SHA1 495853a5a5f8040bcad55db6282b0a7e172d0f69
SHA256 f9bdb2a3b7d7028b860cc28bda2cf259e238a6ebcc952d50a88c6f6decb760a0
SHA512 4b86f3cfc4851b2dad32041d8a74347995e19b61f877105e10870dda355bba48b4a214616d8fe54a75b00a9ce85ac56e2d03a631aca9fff171960b880f4b4ce3

C:\Users\Admin\AppData\Local\Temp\{0B75A20F-A3AD-4529-B31A-6AE635C37064}\_ISMSIDEL.INI

MD5 db9af7503f195df96593ac42d5519075
SHA1 1b487531bad10f77750b8a50aca48593379e5f56
SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

memory/3516-105-0x0000000000400000-0x0000000000433000-memory.dmp