afedb875319524d0e60de4d91e23f0b5510d18d6996298d1a7fdf01e0df58af1

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af418f4b5539878900750f8de9751413_JaffaCakes118.exe
Size

132KB
MD5

af418f4b5539878900750f8de9751413
SHA1

5cccb0409f8aa1a15ac6ef70f4c71f81059144ee
SHA256

afedb875319524d0e60de4d91e23f0b5510d18d6996298d1a7fdf01e0df58af1
SHA512

e47b84036c4d946d9eda635aa477d9cf467f944506312f1af396fe88554d6ee52ffd642a4186fdda1e3453f43e0be52378771bef004ace376b22ba3fc7489f9d
SSDEEP

768:t/raHM782f9rvs2Zg5nicskQzTGfxgzh3emu4v/eB4z7VP7LdGSu2HyTAzfMgTA1:t/roM7ZJfUQWgY54v

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	af418f4b5539878900750f8de9751413_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msng.exe

Executes dropped EXE 1 IoCs

pid	Process
2752	msng.exe

Loads dropped DLL 2 IoCs

pid	Process
1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe
1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	af418f4b5539878900750f8de9751413_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	msng.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	msng.exe
File opened (read-only)	\??\b:	msng.exe
File opened (read-only)	\??\e:	msng.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File opened for modification	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File created	C:\Windows\SysWOW64\rundll32.exe	msng.exe
File created	C:\Windows\SysWOW64\msng.exe	af418f4b5539878900750f8de9751413_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msng.exe	af418f4b5539878900750f8de9751413_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rundII32.exe	af418f4b5539878900750f8de9751413_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rundll32.exe	af418f4b5539878900750f8de9751413_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af418f4b5539878900750f8de9751413_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F389BF1-5EF1-11EF-9363-5E10E05FA61A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e44129fef2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430319465"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000af54e3f56f45dd08a0e86fc834cf8d5e457581ad112a52accd314f6e471e6c5d000000000e800000000200002000000002c7fecf1a8a4e394f20001e645da7fc6b11e9c7f06e64efca373a40bf7d77ee9000000021d93b042de3b05ce656c912287214ab20fa53fe35304acec89d416a5433bafbd05b1f7c100d52d22df932965791f8c33e2121fcbfe5f76aa7a1eb0751bdc2016a69a21f620f0f32bf8c0479a16a2140e12653f53b0697b779e78734e8bb6b7a8d8be3c4e8ad6ab90f3a6a32f36739deafea13798e507cf4c3c13473d4e225757f1cfc92052ab01136fe5d17679c4269400000008f4b3bf558168f450563bc11e92615cdd212a7e3cdf57649a2eadb6cedc06ac8bfc8d38990927882cc26dcae0ff9c53b8ea6b31fe20ff643b581d99105a64bd9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000055a5612af8274b8a972d263b70f97d0776950da418886d4729d505173cec915d000000000e8000000002000020000000c671592c023e9a5c089132412622c6ab21fa4501a4d14186b6a4d1dc2624a099200000007478ba86bdb77278fa6b625577d6a92f697da48d9ea3cc4d555af7d746baa8a840000000243a1eaba6e44dd9844eaba4cd9537bc21ae9e09079c3a957dff7375769cb4d888b4f094edf54a770d7708ed3254499852bbea2e19960d047c5acca65638b6a8	iexplore.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000fd583981122041707044617461003c0008000400efbefd583881fd5839812a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000fd587585100041646d696e00380008000400efbefd583881fd5875852a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000fd5838811100557365727300600008000400efbeee3a851afd5838812a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a0031000000000014590065102054656d700000360008000400efbefd583881145900652a00000001020000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000fd58108310204c6f63616c00380008000400efbefd583881fd5810832a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = a2003100000000001459006510204146343138467e3100008a0008000400efbe14590065145900652a0000007c6d0100000008000000000000000000000000000000610066003400310038006600340062003500350033003900380037003800390030003000370035003000660038006400650039003700350031003400310033005f004a006100660066006100430061006b0065007300310031003800000018000000	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe
2752	msng.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	msng.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
452	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe
2752	msng.exe
452	iexplore.exe
452	iexplore.exe
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2288	1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe	29
PID 1720 wrote to memory of 2288	1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe	29
PID 1720 wrote to memory of 2288	1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe	29
PID 1720 wrote to memory of 2288	1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe	29
PID 1720 wrote to memory of 2752	1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe	30
PID 1720 wrote to memory of 2752	1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe	30
PID 1720 wrote to memory of 2752	1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe	30
PID 1720 wrote to memory of 2752	1720	af418f4b5539878900750f8de9751413_JaffaCakes118.exe	30
PID 2752 wrote to memory of 2760	2752	msng.exe	32
PID 2752 wrote to memory of 2760	2752	msng.exe	32
PID 2752 wrote to memory of 2760	2752	msng.exe	32
PID 2752 wrote to memory of 2760	2752	msng.exe	32
PID 2660 wrote to memory of 452	2660	explorer.exe	34
PID 2660 wrote to memory of 452	2660	explorer.exe	34
PID 2660 wrote to memory of 452	2660	explorer.exe	34
PID 452 wrote to memory of 1444	452	iexplore.exe	35
PID 452 wrote to memory of 1444	452	iexplore.exe	35
PID 452 wrote to memory of 1444	452	iexplore.exe	35
PID 452 wrote to memory of 1444	452	iexplore.exe	35

C:\Users\Admin\AppData\Local\Temp\af418f4b5539878900750f8de9751413_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\af418f4b5539878900750f8de9751413_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\af418f4b5539878900750f8de9751413_JaffaCakes118
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288
- C:\Windows\SysWOW64\msng.exe
  "C:\Windows\system32\msng.exe" fuckystart
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe http://www.OpenClose.ir
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.openclose.ir/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:452 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b6f5715f8bfe0f319e404b4fff1ec35

SHA1
fa81e4aab5b20d959bc2cd9ae0f2ab2680d83320

SHA256
04ef11f06e9b2095841f4a0db4086184bd5258192cdfc987e2f8f6f93af0c567

SHA512
6b70cebc2a492bd9dfb4410bd889f092af63ae892d35624572f4b9e40ed650cbb951cb83897d26b71fdb99c530044361c99387160a4f96322abd26594c209dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
812612dcbb7816bbcb88489ae8368711

SHA1
f50f83f41b101003e227b0cf1607e10069f97bdc

SHA256
dc0e2f96200eeb964a1d29ccc11bc1ddd13dad406b7625443cf59ee4c55ec6cf

SHA512
a649a8162664b92a52d4c658ba1607fc237f8144c579ce6398b38ea120a98912b467e720b49a05107d06fc6c605a782ca64ae63ea150d3141ce1c180ffa1b98a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc90e79b8c22b759e5ff62baca01aea0

SHA1
c0821760de6d0e601c03c8d44fe6b666d67c489a

SHA256
2b0c70a26c78811be7934277e60d1de274af78121d49c6843d03363c9303f315

SHA512
cab45c80253a3b7d90509b712e06305ab6611705008cfe6a9717971b7dcee31d3c68c6e9e4c464b3b2d5f8dec761731eb8cbfc0b94afd9c1d4dc94baa774526c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6e5d8686b7fdbcbd43203a5402cbf6d

SHA1
c82815c77e7f4eb986a536e4488e4150a961c40e

SHA256
f1d0228f1da7bd354ade094085a303d12a458fb18c08ad0481f023dcf4b96552

SHA512
8cbfa9e222ae33ebfa7c2f3adf9794b03c7875988dcf12a71f7b272985966592e59f611cc1c922b5b9b45e97e74d5217c477ec26b7aa2b4f13880c19e4bc15f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7068ab929e7cebf92542a2ca440ee51b

SHA1
6defd548ad3492954c63e730a2052c3708dc2de9

SHA256
393083a4fcc5959c2355b039a7c5f36b2475ed31c871541e5519c2be788022ac

SHA512
25dc10805cb9f1ed0c27f55d4d883e77fdbdb4e2eeb4dbad4404a975b57d092ab5cc1df2c726e65365de31cdd02bf46a0b40e9bbc8b295c65b0d78cf4df7070f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a66233abf87ce3c4612092b6e177077

SHA1
085b87b0edc9b3deec01fe62f1f991fa01236349

SHA256
c768042ad4f1a51353e78f4fe4d6e3a16a269ce5fc983ca64cbea4ccc72a9a49

SHA512
5dba102a097bf8845f005f990c2b673a01e03b568944546f37e4531c21a1a930127efb9092650871c30e9797ac0714ffb3edf1a8c6b0f65b5eb7aa192a12c267

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa63444b5d7a31c6df091b196c2064cb

SHA1
127e7442cc4c32e69d621711bde8601c0ca5ab58

SHA256
d4ad88ea275c24c6a0cccaa1735e599f95a139fb6988906aff638db8a0836cd6

SHA512
e9c6e73207240afaecc6837efeda34ef994565c0ae4ed961832ffa044683939036987f2e3de57e085d2352c3c9fbc394d5705412bc61ea8689d1adf8a5773249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
542a853309cc853bef362d782a2e967b

SHA1
06bdc47d04909bb07c10493e40e629992b815448

SHA256
6b683125e69ddd8c23e07fff056717875c17684b1e854741b0094e6776b956d2

SHA512
0b03ebdebd5015a4cc092e77f3851aceec49d0a5d90d10082e289ea4f7140bbb55a791744fa92b977ae299357a65194c9b48b5437e78cf05d196aa33c9fe06cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9605563fd08c78acaea6622bfb273083

SHA1
492e579b22ef5c3ff9e22c337c9ae80ddc8c9f97

SHA256
094a0895c6d0c56ab09a7feb1bf79bd00fefcf73b62d3edb9fe00c5917ffe395

SHA512
553561ceca6baff62c85f782cc6edda30a8f776c8f6c79876789fdacdae1bb0fb383228e740853a62474a1cf89d445916b65f5b3aef08b88dfd772dca6afd465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8addb3530d0a047c11bfde6bc553533

SHA1
f63d2ad546a108376fc774ae7310dc767c7c55af

SHA256
15bc675759d808deacf9722b2555996bfab206f49ece03412a41be49f15fe184

SHA512
43fb411e4d976776f7e5f5fce962cd4e09eeea54c0a817b8edf04878a30c5c9d2980f1e770220191e8fdd276cf5c0f6d62ce59ba84ae75452997c24e6e910662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cc0e0ecdf14db57e92c7ed7712995ce

SHA1
1ff184e3330bd9ffc2511f0c44115ae8cd6b5267

SHA256
2078f6a871fc6c57d9460d3e2292c20c831b4a31ef0c61bc5e2a66eabc141c88

SHA512
d2d0021afdb4cedd556d434e3ce864ac8fd107baec77d1b695a9009574f8ae616a70fbd236cf364e4b041b0f5563aac92ae0906630b71cc3a35fc28dab8d5bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
291a52fa762e7772fca53a5d86c8045e

SHA1
f3d6f76866eba673dc434e6d118691c7a256c76e

SHA256
f4fdaf6b70dc6eaa1c6a40c7001c6bf94819d0633460974a702d9aaddf7a5fb0

SHA512
5ddf5e541c9fa9033d45c84ac64f8655734035056ec1cb9984ea8d7cb26c91a1dfe056724b91a53b5c2e7eaab0892b64a9fa24cdc63442f08bcbec9216b4069b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2297f241d00da0e5c9a96d90593b7be

SHA1
76445721224804a6573185b34924c77ee620b7eb

SHA256
fcfbdb2caedb07fbfdac8828e3f1e1b8800b654f67229cfa890f4575508658e9

SHA512
d2302c88b45153f9287646352b565d8fad36f11d37868b9b3dd519fc89431936be47afa4f3596562852d07f61336b417fe7838e0acc372e01de0d5dcb34abf2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a186ffe59675f622f0be1805f655a05f

SHA1
d58c18690bb92f6e9b16b14558eb3839ad23d0c0

SHA256
8c20fc4aec19e764e957f881be8b8df4a26618885be9b0a2296140913d6a2ff3

SHA512
f5b355df055801a4aac4a2cc54330dc865134e4c7b9874c69d7b50aa07d3078128cd4245e10736a608a1e548645cba3d6455b0e71d7b247b9bdffe6a783b226e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a55f2f7c936cae6aecc88b549d70f287

SHA1
395ad4303dced5f51a4c74ca2255bce27fb3b828

SHA256
85071463f125cfd064b92aa18900704e09009d3a33a992728c30e123e420440f

SHA512
a65212558cdf1e1b47ec4fd9790547f027784ac26e89e32cff62bc06dac5da1062b667300cb28cf8d20e5398a852feacf7221013e6262418f9235f78a5b2dcda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
090d323bb8a8202349b84e47b53028ec

SHA1
d4cf2bd06fca305e1155d8a99f8ce9c6847c23c1

SHA256
f57db9b30061ea49bdc0a5a872e47722f79a9ff15460a96a45a71db40d919fde

SHA512
9a827ab82ea4f905f98aef26c55d35bb78bf8ef35862f0a969d4771e9c602bc9bd2d237899951b678c84fa5599c5d13a5169da64667381e1a41db0fd307b6766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69c76b02bcef61ff75dfb457a94f299a

SHA1
906b2192180f7b8a4b96e9f5a8a98f1c098699b3

SHA256
1f2b6aa539b70aba6cf39b9f3d12ccedd50d9cb49d73a7e1f8c79bd47708d509

SHA512
e220eaec070cad5b41b6fd6e392f1354d714284206ae8551b286a51418e9a25d41f85a69136465d26721da729ba1a99e4bc11594c870ffdf6f4c63356d68691f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94793984ae9bd881ec22def783d8f975

SHA1
bc2d9a8d2bf6704c68955add1d90ce1e15663b60

SHA256
ca1df761a8efe1a2a1c4603f08cf6a9e87907fce526b3c4389d0cd15cc81e212

SHA512
c6514d5b5c6d6556f34032e7e75c26bf70a2d9c79bc682cd70896b4151aef04e1e23552bf430b238bf98c1f36b33a8b527188bb4a3e0585cd7bfffde48c0c8a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
409a7d1896dc4a16ef7660fcda1fc18b

SHA1
b591f59cfd15b77e5970f7c4e3ec9fa8a41ee772

SHA256
d66054bb6e4b54d826de41c72cfd1dba44b0450fed000ac0466138cc9d5b85f0

SHA512
4bf6f2ff80b636370c2a3d7b315d4b68b58f27fea683d0b124ede4b003459fb18991c75dfb6d09868a6bd4667e5e1092e39402e2d31f65f4dacf40f5e9f4a954

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec9a558db94710c2be40205ee62b3287

SHA1
94eafbac726a203d7338de5c9cafecb9cbf4ca77

SHA256
b9ea1d25897a8d6da45315de8db288760b07653dcf183c1e4623c9202d049899

SHA512
64c2f9f629d3131a5c185abd89180a43cc470a9d7370b2033d80e3560a0055b5fd5b71e1179588b1f703d740afcc3b92e18812f999bd24f3a278ed391088b2b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f3da637c1004d578d6c8a28cb060670

SHA1
c3c72ddb97a9dc5384b33ac3cee7b0825d94f784

SHA256
f7fe786456aad27f093bcd7f6ae8aa8b77efbffaccd35c72dea16fc2d5db419a

SHA512
14d811eb9a3d9af51ae4b038a58d088105c7b608bee7ef2bd4a52df184ea930954b59070ad100f2c29957ff27d93e3b74cf8ec70ef96b782d3da8b22ef9bb4fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2c0cdeb9bb4b9f59c1a43383041d7e3

SHA1
b1f24ee0044e8be0680f1c8908585598fb5622c2

SHA256
a50195fcd5ba6fa4e78d0f78c6608a42fbdc7e77d7d30af63db3967b998c3839

SHA512
bd524d979de440a5747fdea03510a7fa0485ee857194f814bb5d9b11b8a433c3fba22e8317bcbabd73392ed81279fbcc18c8f49e0b3f6c1f2f90daa8ddb73f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c28153e9adeaee7900ca38ee86f7f497

SHA1
d68b24477e45fbc8bfaea41af6c2bbbfe228b51c

SHA256
23926ddea3a22fc7d0e1339d967f3ad6389107370496972f51fc57a32a371db4

SHA512
268bdd3e04c19041144c0b7ba5d1f065aa4ed19f4fa2fd4489a9379e667ae6d687c1e67c2565dbc5735d7b12f341ddc52fd3f0ce374bafa55ea1d17f00ffb3f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9D5B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9DCB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\msng.exe

Filesize
132KB

MD5
af418f4b5539878900750f8de9751413

SHA1
5cccb0409f8aa1a15ac6ef70f4c71f81059144ee

SHA256
afedb875319524d0e60de4d91e23f0b5510d18d6996298d1a7fdf01e0df58af1

SHA512
e47b84036c4d946d9eda635aa477d9cf467f944506312f1af396fe88554d6ee52ffd642a4186fdda1e3453f43e0be52378771bef004ace376b22ba3fc7489f9d

Download Submit
C:\Windows\SysWOW64\rundII32.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\~0002ftd.tmp

Filesize
82B

MD5
af8efdf07e1790512cb3fc53f19866ac

SHA1
13531d128815042ca04c289652b2f1076bd68178

SHA256
18e5d646ae9611aef1e01d000f7808d62c7796439638f21e2c457e0e8ce33976

SHA512
f237b3914733651b7be64ab6ac11f6d36b4a0f607757cf996494c446729d1148df7b8ac15b7b10c486b72df9d31b0f48c602946077e29330d378e9c9039b2904

Download Submit
memory/1720-23-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1720-15-0x0000000003320000-0x00000000033D6000-memory.dmp

Filesize
728KB

Download
memory/1720-0-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2124-26-0x0000000003D00000-0x0000000003D10000-memory.dmp

Filesize
64KB

Download
memory/2752-34-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2752-115-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2752-16-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download