Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 07:25

General

  • Target

    3e59c458450dfd778e339697d8e96f9c_JaffaCakes118.exe

  • Size

    3.6MB

  • MD5

    3e59c458450dfd778e339697d8e96f9c

  • SHA1

    b1c46b975e0b37d1a6be42b82f2c70154f24c21a

  • SHA256

    13f00933d7878d47be34fa4d649203e518cb3975206163ea76f740240c583884

  • SHA512

    d2b50e330caa84c133d036022b64fee9c7423554a87370909a0505930fddf817a75370bea71bcd599ba13de5e9609e3fefbb4ddf6e4ff9e494ca1e64045b4c66

  • SSDEEP

    49152:u93FJkyk4y5IyKgS6UYpFZP/LHFQ85RGoG+QbYhLf8Y/yk0i7zu2xtCjbNWJArbA:IVaYyDKLlYpFVLHyzo4Mx/lxAWJ4Ju

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Enumerates processes with tasklist 1 TTPs 21 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Gathers network information 2 TTPs 5 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e59c458450dfd778e339697d8e96f9c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3e59c458450dfd778e339697d8e96f9c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Users\Admin\AppData\Local\Temp\is-3B3C9.tmp\3e59c458450dfd778e339697d8e96f9c_JaffaCakes118.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3B3C9.tmp\3e59c458450dfd778e339697d8e96f9c_JaffaCakes118.tmp" /SL5="$E002A,2885950,56832,C:\Users\Admin\AppData\Local\Temp\3e59c458450dfd778e339697d8e96f9c_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\ex.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:112
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2328
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4396
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2172
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3872
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3716
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3020
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4036
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3096
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4076
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4660
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1976
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3464
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5040
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3156
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3456
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3688
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2980
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
        3⤵
          PID:4992
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
            4⤵
              PID:2804
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
                5⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:4676
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
            3⤵
              PID:1124
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
                4⤵
                  PID:2812
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
                    5⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3548
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                3⤵
                  PID:1380
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
                    4⤵
                      PID:4492
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
                        5⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3916
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                    3⤵
                      PID:4228
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
                        4⤵
                          PID:820
                          • C:\Windows\SysWOW64\tasklist.exe
                            tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
                            5⤵
                            • Enumerates processes with tasklist
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4724
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                        3⤵
                          PID:4952
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
                            4⤵
                              PID:2308
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
                                5⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2192
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c tasklist /FI "WINDOWTITLE eq Process Monitor*" |find "PID"
                            3⤵
                              PID:3096
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist /FI "WINDOWTITLE eq Process Monitor*"
                                4⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:656
                              • C:\Windows\SysWOW64\find.exe
                                find "PID"
                                4⤵
                                  PID:3120
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                3⤵
                                  PID:4272
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
                                    4⤵
                                      PID:116
                                      • C:\Windows\SysWOW64\tasklist.exe
                                        tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
                                        5⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3108
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                    3⤵
                                      PID:1040
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
                                        4⤵
                                          PID:2792
                                          • C:\Windows\SysWOW64\tasklist.exe
                                            tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
                                            5⤵
                                            • Enumerates processes with tasklist
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5044
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                        3⤵
                                          PID:2336
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
                                            4⤵
                                              PID:2388
                                              • C:\Windows\SysWOW64\tasklist.exe
                                                tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
                                                5⤵
                                                • Enumerates processes with tasklist
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2692
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                            3⤵
                                              PID:4628
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
                                                4⤵
                                                  PID:3016
                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                    tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
                                                    5⤵
                                                    • Enumerates processes with tasklist
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2824
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                3⤵
                                                  PID:844
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
                                                    4⤵
                                                      PID:2836
                                                      • C:\Windows\SysWOW64\tasklist.exe
                                                        tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
                                                        5⤵
                                                        • Enumerates processes with tasklist
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4728
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\cmd.bat""
                                                    3⤵
                                                      PID:448
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5900 " | findstr /C:"ESTABLISHED"
                                                      3⤵
                                                        PID:1000
                                                        • C:\Windows\SysWOW64\NETSTAT.EXE
                                                          netstat -na
                                                          4⤵
                                                          • Gathers network information
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3488
                                                        • C:\Windows\SysWOW64\findstr.exe
                                                          findstr /C:":5900 "
                                                          4⤵
                                                            PID:3056
                                                          • C:\Windows\SysWOW64\findstr.exe
                                                            findstr /C:"ESTABLISHED"
                                                            4⤵
                                                              PID:4944
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5901 " | findstr /C:"ESTABLISHED"
                                                            3⤵
                                                              PID:4496
                                                              • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                netstat -na
                                                                4⤵
                                                                • Gathers network information
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4132
                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                findstr /C:":5901 "
                                                                4⤵
                                                                  PID:1284
                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                  findstr /C:"ESTABLISHED"
                                                                  4⤵
                                                                    PID:3204
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5902 " | findstr /C:"ESTABLISHED"
                                                                  3⤵
                                                                    PID:4720
                                                                    • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                      netstat -na
                                                                      4⤵
                                                                      • Gathers network information
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2352
                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                      findstr /C:":5902 "
                                                                      4⤵
                                                                        PID:436
                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                        findstr /C:"ESTABLISHED"
                                                                        4⤵
                                                                          PID:1076
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5903 " | findstr /C:"ESTABLISHED"
                                                                        3⤵
                                                                          PID:2192
                                                                          • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                            netstat -na
                                                                            4⤵
                                                                            • Gathers network information
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3964
                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                            findstr /C:":5903 "
                                                                            4⤵
                                                                              PID:2364
                                                                            • C:\Windows\SysWOW64\findstr.exe
                                                                              findstr /C:"ESTABLISHED"
                                                                              4⤵
                                                                                PID:3512
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5904 " | findstr /C:"ESTABLISHED"
                                                                              3⤵
                                                                                PID:4976
                                                                                • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                  netstat -na
                                                                                  4⤵
                                                                                  • Gathers network information
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5012
                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                  findstr /C:":5904 "
                                                                                  4⤵
                                                                                    PID:1864
                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                    findstr /C:"ESTABLISHED"
                                                                                    4⤵
                                                                                      PID:4140
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                                    3⤵
                                                                                      PID:3148
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
                                                                                        4⤵
                                                                                          PID:4844
                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                            tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
                                                                                            5⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4532
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                                        3⤵
                                                                                          PID:2832
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
                                                                                            4⤵
                                                                                              PID:3124
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
                                                                                                5⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1800
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                                            3⤵
                                                                                              PID:2980
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
                                                                                                4⤵
                                                                                                  PID:4404
                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                    tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
                                                                                                    5⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2996
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
                                                                                                3⤵
                                                                                                  PID:5064
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
                                                                                                    4⤵
                                                                                                      PID:1088
                                                                                                      • C:\Windows\SysWOW64\tasklist.exe
                                                                                                        tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
                                                                                                        5⤵
                                                                                                        • Enumerates processes with tasklist
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1256
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\gentlemjmp_ieeuu.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\gentlemjmp_ieeuu.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\3e59c458450dfd778e339697d8e96f9c_JaffaCakes118.exe
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1412
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-VMMDC.tmp\gentlemjmp_ieeuu.tmp
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-VMMDC.tmp\gentlemjmp_ieeuu.tmp" /SL5="$F007C,2492150,56832,C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\gentlemjmp_ieeuu.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\3e59c458450dfd778e339697d8e96f9c_JaffaCakes118.exe
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      PID:3832
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-D9EOQ.tmp\ex.bat""
                                                                                                        5⤵
                                                                                                          PID:4760
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
                                                                                                            6⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2132
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
                                                                                                  1⤵
                                                                                                    PID:1288

                                                                                                  Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    0774a05ce5ee4c1af7097353c9296c62

                                                                                                    SHA1

                                                                                                    658ff96b111c21c39d7ad5f510fb72f9762114bb

                                                                                                    SHA256

                                                                                                    d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4

                                                                                                    SHA512

                                                                                                    104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                    Filesize

                                                                                                    17KB

                                                                                                    MD5

                                                                                                    6e583cb93beddf2934b14869e063f3cb

                                                                                                    SHA1

                                                                                                    5d60abe3c38d66e7e2bf9f46e6fbd1769cd5f194

                                                                                                    SHA256

                                                                                                    47d29fb6d17f33f11127759efedae83267cbe2022b5f3716b21e30f17d22480c

                                                                                                    SHA512

                                                                                                    d6bb43db364303defb35f23dd74b9320db8b5cd1137f8b0109cddce5bc7f6eb762789be6058a3e1afc94fdd2e7fe5db4240cee1dbcaee38b83d85227f643b771

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1xfpuju2.mdr.ps1

                                                                                                    Filesize

                                                                                                    60B

                                                                                                    MD5

                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                    SHA1

                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                    SHA256

                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                    SHA512

                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-3B3C9.tmp\3e59c458450dfd778e339697d8e96f9c_JaffaCakes118.tmp

                                                                                                    Filesize

                                                                                                    691KB

                                                                                                    MD5

                                                                                                    9303156631ee2436db23827e27337be4

                                                                                                    SHA1

                                                                                                    018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

                                                                                                    SHA256

                                                                                                    bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

                                                                                                    SHA512

                                                                                                    9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    126B

                                                                                                    MD5

                                                                                                    8fec1ab28e8ee7394915990458fb85dc

                                                                                                    SHA1

                                                                                                    c70e183a783a9621cd64584de99f8163deb40872

                                                                                                    SHA256

                                                                                                    b96251154ddbfd11d36e74eae84537229912a54dcb86f1277deab084322ce4dd

                                                                                                    SHA512

                                                                                                    c33223c094764b9704ced1ab6256aa227873c2be81acce328d12113504e55716563ad561641b726dcd2939c6237b4a4dad522512a4f59e3f805f91ffaf3a3be9

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    144B

                                                                                                    MD5

                                                                                                    e902b4bcf5b531d057d091d00be3daee

                                                                                                    SHA1

                                                                                                    0cd058fcfab51dbfe91b139dc52245d5a4326f55

                                                                                                    SHA256

                                                                                                    9daadc1e6c019a712e5236eafc29e687ea79efd4de1310dc2eeb1ed165ea26c3

                                                                                                    SHA512

                                                                                                    5f7a84040b4bbf46173ff5404d970af5cb3e54c0dfc0d6ab6b161c2f417b6b1a023abe7b9f2b723b2985511894649c54c045204de01b2a52a51d7143e8f82c11

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    132B

                                                                                                    MD5

                                                                                                    97cc4c6dda23b9631b8c9185859ad061

                                                                                                    SHA1

                                                                                                    5f912a6c094bd918afe5e9f0c70cd45b36dff722

                                                                                                    SHA256

                                                                                                    55b728e4cc0974b19641d1dc77df0f381f244b254d39e2566dcf525b9d106cd8

                                                                                                    SHA512

                                                                                                    cf82517f44425d402305129821cff7668c5db27d5427b8a8886e99146a1a56ef43b8055e6c62929fbfdf293a88664a760e49443ac89453fa3163ed1ebfb8469e

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    120B

                                                                                                    MD5

                                                                                                    c842d438cebab4b876572a8bc032aabe

                                                                                                    SHA1

                                                                                                    e95c7d4e2f6246daba6f0baec8e1b94c91384c4d

                                                                                                    SHA256

                                                                                                    ef7d9a0d456e1901b0bdebdce961d480bcf8270a7d7646591bdc2886c8716218

                                                                                                    SHA512

                                                                                                    aa8a28a1b0a0b9b65db195863fec9b903ffa335ccee7d50dc514f5d9c63f2ca51b2bf52694879adf43021cedfc4c5f8e7c3c90bb6dc493114a700cd79cce183c

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    118B

                                                                                                    MD5

                                                                                                    f0315949ccc3d22d958503f5735cfbcc

                                                                                                    SHA1

                                                                                                    883bf4e366046eb1ef6e2d81fd74fe75ae73b2c0

                                                                                                    SHA256

                                                                                                    201c4e665ce446e067cb152d1c3834e416f6a09a9e6d7c45c20f1bc1cc74534d

                                                                                                    SHA512

                                                                                                    aa1faa44ba8f47052bf236d5135dc70f1293028663f4abbc7cc043277428217b047b25d6e6691c1685db52bd2065f0d5c4306d9db590696773c3becf2481a251

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    122B

                                                                                                    MD5

                                                                                                    b921f2f9f97a642d513e1307f7685e0f

                                                                                                    SHA1

                                                                                                    3489b63a484a6114f1828100908bbbc622b07ed1

                                                                                                    SHA256

                                                                                                    953998031a5ac3582232545f923b32f02587fb233791a0326b889f28af4cfabc

                                                                                                    SHA512

                                                                                                    1da42e0ed2dca9f2a559739c6a0c6b28a54e0d8d0617bec542729a362dd0f36f9287bcd4433c9cabd7db7430e7295f6879c7777a86035c4f3c86b3b05847ae0e

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    132B

                                                                                                    MD5

                                                                                                    410515fbd7d2a2b4fab0fb80c76c2a74

                                                                                                    SHA1

                                                                                                    f32bd4fc7ade9efdc92b99e79a0b2f95edfc5893

                                                                                                    SHA256

                                                                                                    6b398a1053c39530e13afb3bad98900d9a5a6d27523a0c5d44c746afb539fe99

                                                                                                    SHA512

                                                                                                    f301aaeb96aa848eb6823830397c9fb12086db558663235c8b0882cefe2ae105cc75e2cc70315ce2fdfa17d3538427f4afa6a9cf24834a884a10cb4cb87652aa

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    128B

                                                                                                    MD5

                                                                                                    dae8768bbb8a4fddc4dca8eae7c4d65f

                                                                                                    SHA1

                                                                                                    385ffb932fcff489392536d62e291ed9e0beea98

                                                                                                    SHA256

                                                                                                    ca1bf4fe8a59a31f06a4f2d975671fbb2eeca33d40b0c35318f2131a118754cf

                                                                                                    SHA512

                                                                                                    492feada84b7064547bd6d22ed13cf6949156eb3daa9af5aa9c3da44dd6ac7e540904c494de14a7858d498944ab51c7525caac3c9aa933d1e55ca35442c075b6

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    126B

                                                                                                    MD5

                                                                                                    110d64c0e450ff59542f81690a2d53b7

                                                                                                    SHA1

                                                                                                    7f2e989deb095a0530792989e5fa9d7279d5f3e7

                                                                                                    SHA256

                                                                                                    735ca381b6d3cbb675e698aa92222566d5174c0fbdf7807605f105c512c9fa1e

                                                                                                    SHA512

                                                                                                    00b86a1fd4db9e8861d3973a395c34b41a5a277901552b66ac671ced492638174f256785f563bfad263bc93315544bce87c91d26bd48a39fbab7daccceae0d34

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    126B

                                                                                                    MD5

                                                                                                    b35e8ab65e7f8a4edb3663885f775681

                                                                                                    SHA1

                                                                                                    49b66b2e3cff64dd7d8315c53d852c19a46e8609

                                                                                                    SHA256

                                                                                                    9b78165c2b44ba6675654f776e34815c19482a84c87e6a7dc9d1a68d3d5a5e53

                                                                                                    SHA512

                                                                                                    3ec1fad817117f00f620103666b1caa2ece51b9cc1a9b3fb2142d57aedc745e9bc69608e0cb2a2eff1879c7ad6741b66751049020620bac8659598080404adcc

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    130B

                                                                                                    MD5

                                                                                                    0cbb771b9f9523adb96d5bae77154a05

                                                                                                    SHA1

                                                                                                    528330a335047039ab012b01bb7a3f585e6f5a8d

                                                                                                    SHA256

                                                                                                    4b6e256fc13fdb04ac97e583dda99f6ade2356f9c692f5150b262d3e464bd71e

                                                                                                    SHA512

                                                                                                    41f44acafb84b24e15ebee4a18c2ae39c06ad401db2272939ad1d650c27e1a219d7c05df63a7ec2ab0676c7ed34ca5c7ed1d4cfaa143998e90ce12f13875f0f1

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    128B

                                                                                                    MD5

                                                                                                    6a745081c62a706c014a876f45b5a56b

                                                                                                    SHA1

                                                                                                    25f17fcc50dd202d2381c00970e2dc04c2ad9707

                                                                                                    SHA256

                                                                                                    e9f9690b327cf24e6c260f93232dd4b961d82a709c16589ba72aabcdba0c039c

                                                                                                    SHA512

                                                                                                    a420efa894ef6fedad4fafd5e15042f947ff96a169031b7299afeba797bcaefa675508f72f57bfa8452a35d61314a544e26bc535ddb61a0cdfdca03c07ae372f

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    118B

                                                                                                    MD5

                                                                                                    f1b6aae3dcd94b94aee326517e3dc583

                                                                                                    SHA1

                                                                                                    3418fdda1ad30df64d7bac068e1a0c4e305cfd75

                                                                                                    SHA256

                                                                                                    a02aa2b143a8e126b1a044e1f036a912a0ac134e8e1f56836805b15819e43f6b

                                                                                                    SHA512

                                                                                                    dae27c24d2ef685e4f968dcd91cda18bfa605fd924b1bf928307107630bd671d6623e78451d3f397dfc93cc4e1c0f74c25e962b5669e2350a79b72ec061ec1ba

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    120B

                                                                                                    MD5

                                                                                                    d93cc818d32f755945cddfc02b29fb89

                                                                                                    SHA1

                                                                                                    fc564e791326d269d005c894cfca674352dae814

                                                                                                    SHA256

                                                                                                    c3fabcab01d67640320ce0a5354e4fc6a7832beebe2e9a7610f43614eefce32c

                                                                                                    SHA512

                                                                                                    62c20691da188a45b59c468826706ed47ad285d9e23996b714c03b4c639d87d93b57e22f9e4504be42a742ee4c64657d87565f9ce65b677d05f66d0bbef0e0d5

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    122B

                                                                                                    MD5

                                                                                                    660d266764b1952b43431d6c7dc0dfa9

                                                                                                    SHA1

                                                                                                    809794738d6ca580d6ec14e77a717e831b0d0e5c

                                                                                                    SHA256

                                                                                                    e3c86ead8667eac8c9ea88e2ee5f5f14f0f0be59a54864f99cbee17d554f74e5

                                                                                                    SHA512

                                                                                                    6fc27ec6f453c2791aa9d0c38817128ed8e2fff26748fbe0cfee6411d8a120970494b3504078a3079c90d409434f22b35974efd5cbbaf14ce3657715fc18f4c3

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    122B

                                                                                                    MD5

                                                                                                    59a8010aab7eb203cd9fda8f6be1beca

                                                                                                    SHA1

                                                                                                    b9a07636b921183c88880320294e279c935cddd7

                                                                                                    SHA256

                                                                                                    2a5b80a6a1522b75fda6e7f99ceb912bc7db1bd6be11995fdcbde1ab7d836dba

                                                                                                    SHA512

                                                                                                    26ae700f89e827f9d5f8d29c7f393eb3e5885d32266591d61b20ffd7ba1d08dfbc0e6e9368c94288185a01960cbd0a8ce96b063187396465e640e963e9b3666e

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    122B

                                                                                                    MD5

                                                                                                    a59dd0f9883ea39c5119831b0eed46cc

                                                                                                    SHA1

                                                                                                    8c9354051f7d92310636f0f17e5770aede9d1ad3

                                                                                                    SHA256

                                                                                                    ff1f1293c860b0709d0244a8c6a29294543efdc698a70469e1cd388c0db84493

                                                                                                    SHA512

                                                                                                    4a07eac5507fc174879eb960becf19b3a20b224232f74dfeb28d393bed3f181a0d4020efb9b656000d4ce756491c44f4f5a86dec184feca593c9bf6bd8700dac

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    122B

                                                                                                    MD5

                                                                                                    32b997a9d994996a4369a580e6541b7d

                                                                                                    SHA1

                                                                                                    d61b48404dd6f6dd43d90858ffb7ddb967ecb1f1

                                                                                                    SHA256

                                                                                                    39863141871b63880b4282066451321a902a7e6b97264c9ffdfd8128ac8293b8

                                                                                                    SHA512

                                                                                                    f3ff262b5986436671b4cf970d2ab4eb0dfd3d70651e7e84c8ae38788ef12032db825b81e6e1d8c4f20f0aa5a8067e6e7943b7e3e3c9817e97f0ab227f3fbe1f

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    146B

                                                                                                    MD5

                                                                                                    f0b99c1273d3787f7769feb4d56e6803

                                                                                                    SHA1

                                                                                                    6105232df9585072be8ca04712f8760812943cbf

                                                                                                    SHA256

                                                                                                    176a95493ca3bbfc9a68b4283b53a291faef0f9a7c413b43e1bdad86834a820d

                                                                                                    SHA512

                                                                                                    73b313c0046f6fcec974f2af64859c0af122e9f86503c7427519b7d2aaaf67e2f8cc68de17b93f24604aff815b843fce9a01571c1db48d3c12867e49daab0133

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\CheckProc.cmd

                                                                                                    Filesize

                                                                                                    138B

                                                                                                    MD5

                                                                                                    755c6764b8ecbb83798450705f51510f

                                                                                                    SHA1

                                                                                                    deb141c4fc3220f0ff5c16eabf1adf850bf55610

                                                                                                    SHA256

                                                                                                    cfe680c9896cade2f5163ee0a463a7f7dbae7ee4aadf8de15c6c119a1d582016

                                                                                                    SHA512

                                                                                                    a6292b9416cbbc4a407d143acd502b6a726abb5411309e292f6696a7e55ecb5b78b4bdc764dc3484e85a5a40f21d410018172544b00882759b251aa9dce5df89

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\av.txt

                                                                                                    Filesize

                                                                                                    1B

                                                                                                    MD5

                                                                                                    68b329da9893e34099c7d8ad5cb9c940

                                                                                                    SHA1

                                                                                                    adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

                                                                                                    SHA256

                                                                                                    01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

                                                                                                    SHA512

                                                                                                    be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\cmd.bat

                                                                                                    Filesize

                                                                                                    81B

                                                                                                    MD5

                                                                                                    1b91a1eff5abb76a8a6f47161fd7654d

                                                                                                    SHA1

                                                                                                    7634766e24312fbb9a810bc63a542fc973dbdec0

                                                                                                    SHA256

                                                                                                    b01621458b3f63d5ec5982ec1a33a75fc09559a4f69ccd0d64c189c5bd3915ce

                                                                                                    SHA512

                                                                                                    58df5071af160945a43c634acc453e26588ddae13bab1169817127bf17cdcb45d38e29c15e18d43851c62d2faa124e4e74b106d9c2641f8d58d915e587d5939f

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\ex.bat

                                                                                                    Filesize

                                                                                                    786B

                                                                                                    MD5

                                                                                                    6e18c28d0dec7ddbdbac413f6f66c6de

                                                                                                    SHA1

                                                                                                    266a0a67deefc5327e4c46e2fb082ff29be0d637

                                                                                                    SHA256

                                                                                                    65274b63d3f90972d3f279d1fb5755f8ef0259595c6d6d676d689e77be321753

                                                                                                    SHA512

                                                                                                    20691073b87b63256c1a8897e333b1fdd1c40f958a554d9163ad7157324d0b2aa884c25acdb2fcaef1877119c054b15d9cb6c5e57c63bae98e2fee5463565a49

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\favicon.ico

                                                                                                    Filesize

                                                                                                    10B

                                                                                                    MD5

                                                                                                    f0b81e3ecd1b5d144558da07bece8803

                                                                                                    SHA1

                                                                                                    9ee5bf12a207859d89dc893b8d02bd5c739edb52

                                                                                                    SHA256

                                                                                                    dd7aaa38192189cbf2adfc9416289be6ea3c2e10f2ca08bae453cb1df66babc1

                                                                                                    SHA512

                                                                                                    774a7485d316be62ca6a2303cf0e8f59611b804eb2d518dd76bcdbf755544818032be367d9c2d5ad778059b0c2da2d5a0e46e2a5420d6fd2da3cc0b2bcbe34a6

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-89E5H.tmp\gentlemjmp_ieeuu.exe

                                                                                                    Filesize

                                                                                                    2.7MB

                                                                                                    MD5

                                                                                                    2068ad991521554005676f17007f8ad0

                                                                                                    SHA1

                                                                                                    77047553ff1eca3cd788c2b9124bd876df7602b0

                                                                                                    SHA256

                                                                                                    9b1b56b118bc43660cbdeed7ea4bd891e405e963483827c1ccb32e351ab68ab0

                                                                                                    SHA512

                                                                                                    da7024042dd2e990dd2f6c01f761273ff4850e17c548bf53bbda338d12b4b125540ae868717a87eeeeb2a3601b63365fdaf3a005161af5ccee1e23f4709bd52b

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-D9EOQ.tmp\_isetup\_shfoldr.dll

                                                                                                    Filesize

                                                                                                    22KB

                                                                                                    MD5

                                                                                                    92dc6ef532fbb4a5c3201469a5b5eb63

                                                                                                    SHA1

                                                                                                    3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                                                    SHA256

                                                                                                    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                                                    SHA512

                                                                                                    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-D9EOQ.tmp\ex.bat

                                                                                                    Filesize

                                                                                                    786B

                                                                                                    MD5

                                                                                                    ae43a73bca351b357b4ddd3116571067

                                                                                                    SHA1

                                                                                                    a0e01ff5cac5b11f9dfb2bf995e59d42387643d7

                                                                                                    SHA256

                                                                                                    a264989735e381c073b2c4a5d7256381b9776b8bdb2173d412d36b2ee0f29f9b

                                                                                                    SHA512

                                                                                                    fe775a22443fc691ad43de989826d00ebde3ba4cfe834f5e90fb5f1879c13b5ad3d0f1a2468141ca41743b0d0ab9800e5af1c3e5eb0562da1c3de24be9c41f71

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-D9EOQ.tmp\innocallback.dll

                                                                                                    Filesize

                                                                                                    63KB

                                                                                                    MD5

                                                                                                    1c55ae5ef9980e3b1028447da6105c75

                                                                                                    SHA1

                                                                                                    f85218e10e6aa23b2f5a3ed512895b437e41b45c

                                                                                                    SHA256

                                                                                                    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

                                                                                                    SHA512

                                                                                                    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-D9EOQ.tmp\isskin.dll

                                                                                                    Filesize

                                                                                                    385KB

                                                                                                    MD5

                                                                                                    92c2e247392e0e02261dea67e1bb1a5e

                                                                                                    SHA1

                                                                                                    db72fed8771364bf8039b2bc83ed01dda2908554

                                                                                                    SHA256

                                                                                                    25fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68

                                                                                                    SHA512

                                                                                                    e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-D9EOQ.tmp\itdownload.dll

                                                                                                    Filesize

                                                                                                    200KB

                                                                                                    MD5

                                                                                                    d82a429efd885ca0f324dd92afb6b7b8

                                                                                                    SHA1

                                                                                                    86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea

                                                                                                    SHA256

                                                                                                    b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3

                                                                                                    SHA512

                                                                                                    5bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df

                                                                                                  • memory/1412-143-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                    Filesize

                                                                                                    80KB

                                                                                                  • memory/1412-92-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                    Filesize

                                                                                                    80KB

                                                                                                  • memory/2132-128-0x0000000005ED0000-0x0000000006224000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.3MB

                                                                                                  • memory/2132-134-0x00000000066D0000-0x000000000671C000-memory.dmp

                                                                                                    Filesize

                                                                                                    304KB

                                                                                                  • memory/2328-20-0x0000000005F80000-0x0000000005FE6000-memory.dmp

                                                                                                    Filesize

                                                                                                    408KB

                                                                                                  • memory/2328-35-0x0000000006C40000-0x0000000006C5A000-memory.dmp

                                                                                                    Filesize

                                                                                                    104KB

                                                                                                  • memory/2328-32-0x0000000006720000-0x000000000673E000-memory.dmp

                                                                                                    Filesize

                                                                                                    120KB

                                                                                                  • memory/2328-22-0x0000000006060000-0x00000000063B4000-memory.dmp

                                                                                                    Filesize

                                                                                                    3.3MB

                                                                                                  • memory/2328-21-0x0000000005FF0000-0x0000000006056000-memory.dmp

                                                                                                    Filesize

                                                                                                    408KB

                                                                                                  • memory/2328-34-0x0000000007800000-0x0000000007896000-memory.dmp

                                                                                                    Filesize

                                                                                                    600KB

                                                                                                  • memory/2328-19-0x0000000005EE0000-0x0000000005F02000-memory.dmp

                                                                                                    Filesize

                                                                                                    136KB

                                                                                                  • memory/2328-18-0x0000000073580000-0x0000000073D30000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/2328-16-0x0000000073580000-0x0000000073D30000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/2328-33-0x0000000006780000-0x00000000067CC000-memory.dmp

                                                                                                    Filesize

                                                                                                    304KB

                                                                                                  • memory/2328-17-0x00000000058B0000-0x0000000005ED8000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.2MB

                                                                                                  • memory/2328-41-0x0000000073580000-0x0000000073D30000-memory.dmp

                                                                                                    Filesize

                                                                                                    7.7MB

                                                                                                  • memory/2328-36-0x0000000006CD0000-0x0000000006CF2000-memory.dmp

                                                                                                    Filesize

                                                                                                    136KB

                                                                                                  • memory/2328-37-0x0000000007E50000-0x00000000083F4000-memory.dmp

                                                                                                    Filesize

                                                                                                    5.6MB

                                                                                                  • memory/2328-15-0x0000000003170000-0x00000000031A6000-memory.dmp

                                                                                                    Filesize

                                                                                                    216KB

                                                                                                  • memory/2328-38-0x0000000008A80000-0x00000000090FA000-memory.dmp

                                                                                                    Filesize

                                                                                                    6.5MB

                                                                                                  • memory/2328-14-0x000000007358E000-0x000000007358F000-memory.dmp

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                  • memory/2532-0-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                    Filesize

                                                                                                    80KB

                                                                                                  • memory/2532-3-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                                    Filesize

                                                                                                    40KB

                                                                                                  • memory/2532-135-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                    Filesize

                                                                                                    80KB

                                                                                                  • memory/2532-146-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                    Filesize

                                                                                                    80KB

                                                                                                  • memory/2636-11-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                    Filesize

                                                                                                    756KB

                                                                                                  • memory/2636-136-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                    Filesize

                                                                                                    756KB

                                                                                                  • memory/2636-145-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                    Filesize

                                                                                                    756KB

                                                                                                  • memory/3832-117-0x0000000002510000-0x0000000002525000-memory.dmp

                                                                                                    Filesize

                                                                                                    84KB

                                                                                                  • memory/3832-141-0x00000000024D0000-0x000000000250C000-memory.dmp

                                                                                                    Filesize

                                                                                                    240KB

                                                                                                  • memory/3832-142-0x0000000002510000-0x0000000002525000-memory.dmp

                                                                                                    Filesize

                                                                                                    84KB

                                                                                                  • memory/3832-140-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                                                                    Filesize

                                                                                                    756KB

                                                                                                  • memory/3832-110-0x00000000024D0000-0x000000000250C000-memory.dmp

                                                                                                    Filesize

                                                                                                    240KB