Overview

overview

10

Static

static

10

fa2bd6465b...18.exe

windows7-x64

7

fa2bd6465b...18.exe

windows10-2004-x64

7

$PLUGINSDI...ol.dll

windows7-x64

3

$PLUGINSDI...ol.dll

windows10-2004-x64

3

$PLUGINSDI...rt.dll

windows7-x64

3

$PLUGINSDI...rt.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/chkm.dll

windows7-x64

3

$PLUGINSDIR/chkm.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...up.dll

windows7-x64

3

$PLUGINSDI...up.dll

windows10-2004-x64

3

$R0/$R0/Ba...up.exe

windows7-x64

1

$R0/$R0/Ba...up.exe

windows10-2004-x64

1

$_24_/Pers...x.html

windows7-x64

3

$_24_/Pers...x.html

windows10-2004-x64

3

$_24_/Pers...ent.js

windows7-x64

3

$_24_/Pers...ent.js

windows10-2004-x64

3

$_24_/Pers...mon.js

windows7-x64

3

$_24_/Pers...mon.js

windows10-2004-x64

3

$_24_/Pers...fig.js

windows7-x64

3

$_24_/Pers...fig.js

windows10-2004-x64

3

$_24_/Pers...ram.js

windows7-x64

3

$_24_/Pers...ram.js

windows10-2004-x64

3

BDBugReport.exe

windows7-x64

3

BDBugReport.exe

windows10-2004-x64

3

BDBugReportx64.exe

windows7-x64

1

BDBugReportx64.exe

windows10-2004-x64

1

BDDownloadExe.exe

windows7-x64

6

BDDownloadExe.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 09:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fa2bd6465b8aaad26de20c4c165e8c51_JaffaCakes118.exe
  • Size 34.3MB
  • Sample240927-lnp4fawdnn
  • SHA256 742b12994ff59b3a846fb24aae2ae03325ca84d52fa360277c8637cdf893d2c9
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
bootkitdiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa2bd6465b8aaad26de20c4c165e8c51_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fa2bd6465b8aaad26de20c4c165e8c51_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dictbuilder.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dictbuilder.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:224
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe" --clean_old
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2712
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe" --quit
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --usercenter=close
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4348
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe" --moveuserdata
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5072
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --moveuserdata
        3⤵
        • Executes dropped EXE
        PID:4936
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BDDownloadExe.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BDDownloadExe.exe" 1 /product=201
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      PID:1108
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3680
      • C:\Windows\SYSTEM32\RegSvr32.exe
        RegSvr32.exe /s "C:\Windows\SysWOW64\baiducnTSF.dll"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\SysWOW64\regsvr32.exe
          /s "C:\Windows\SysWOW64\baiducnTSF.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:3476
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --startmenuopt
        3⤵
        • Executes dropped EXE
        PID:3872
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --vistataskscheduler
        3⤵
        • Executes dropped EXE
        PID:3828
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --filesec
        3⤵
        • Executes dropped EXE
        PID:3096
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --whitelist
        3⤵
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        PID:4184
      • C:\Windows\SYSTEM32\RegSvr32.exe
        RegSvr32.exe /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\Windows\SysWOW64\regsvr32.exe
          /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4292
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install-shell
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3004
        • C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe
          "C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe" --quit
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1544
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe" --quit
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --usercenter=close
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1504
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdupdate.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdupdate.exe" --installgau
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1876
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe" /u
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3588
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\cellinst.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\cellinst.exe" -reg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:3540
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\skininst.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\skininst.exe" -reg
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:1552
    • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe
      "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baidupinyin.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      PID:676
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --location
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4864
      • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
        "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3780
        • C:\Windows\SYSTEM32\RegSvr32.exe
          RegSvr32.exe /s "C:\Windows\SysWOW64\baiducnTSF.dll"
          4⤵
            PID:3168
            • C:\Windows\SysWOW64\regsvr32.exe
              /s "C:\Windows\SysWOW64\baiducnTSF.dll"
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              PID:2752
          • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
            "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --startmenuopt
            4⤵
            • Executes dropped EXE
            PID:4500
          • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
            "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --vistataskscheduler
            4⤵
            • Executes dropped EXE
            PID:620
          • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
            "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --filesec
            4⤵
            • Executes dropped EXE
            PID:4640
          • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
            "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --whitelist
            4⤵
            • Executes dropped EXE
            • Modifies Internet Explorer settings
            PID:1804
          • C:\Windows\SYSTEM32\RegSvr32.exe
            RegSvr32.exe /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
            4⤵
              PID:4192
              • C:\Windows\SysWOW64\regsvr32.exe
                /s "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiducnAx.dll"
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:1236
            • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
              "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --install-shell
              4⤵
              • Executes dropped EXE
              PID:1152
              • C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe
                "C:\Program Files (x86)\Baidu\BaiduPinyin\IMEBroker.exe" --quit
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2292
        • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
          "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --setopt /Command/ImportSogouDict bool:true
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2188
        • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
          "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --setopt /Command/ImportQQDict bool:true
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1152
        • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
          "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe" --setopt /Command/CheckImeSetup str:AD
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1804
        • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
          "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --set-first-ime
          2⤵
          • Executes dropped EXE
          PID:2712
        • C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
          "C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe" --fix
          2⤵
          • Executes dropped EXE
          PID:2292

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            BDDownloadExe.exe
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BDDownloadExe.exe
            • Size 367KB
            • SHA256 af5e02931594c41fa8cb6cdd0c5a372ab18b92c379ad517c76a18fb9bdfeddb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            BaiduPinyin.exe
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\BaiduPinyin.exe
            • Size 2.8MB
            • SHA256 020f509f0c15d6c123b02e790d4d3d674a781ceeb8d6b304bcfb7d57479c5b36
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IMEBroker.exe
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\IMEBroker.exe
            • Size 161KB
            • SHA256 044bea17ccaff8d1bd437dd13a0d37798ac1629f7fc6fb1cf6d5c4d0e065e5f4
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IMEFREETYPE.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\IMEFREETYPE.dll
            • Size 762KB
            • SHA256 c6a521c1f3c2611e063d4929fb4a2c466395d4a54a17b6c1036f9e92a0d3ede2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            baiducn.ime
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducn.ime
            • Size 399KB
            • SHA256 1ef970a39e17a0f1188f7ea88a871a833613b0fbc5fbc028f2a29bcddba72159
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            baiducnTSF.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducnTSF.dll
            • Size 518KB
            • SHA256 aca42b70ee70806ff6a298acbfda17051f3514073ba1bffeb64006d56d75a9ea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            baiducnTSFx64.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducnTSFx64.dll
            • Size 606KB
            • SHA256 6717422b8a66c295cdc52624794354c642c0f5b3c9fc945e17c700765815a2ff
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            baiducnx64.ime
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\baiducnx64.ime
            • Size 469KB
            • SHA256 a00392e1f6c235507cf6077f16052216de8c50ea3c601b32ea8f1e75f447d650
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            bdaucommon.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdaucommon.dll
            • Size 139KB
            • SHA256 6a2b893de7fbc1c0c507a35c14882236c326f553baf07409cd358308eefcb5af
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            bdnetdll.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\bdnetdll.dll
            • Size 195KB
            • SHA256 0be32940021bce94782662b3377e2658600e0ada82ad3ce561b00a3abfdc528d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            thumbnail.dat
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\Default\thumbnail.dat
            • Size 376KB
            • SHA256 0b07258015b5e139776c9be53965f4442bfc9d7265db93665f2a10a166fb04ce
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dummygram.dat
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\dummygram.dat
            • Size 16.0MB
            • SHA256 8f34cb39e843f2569e530d13f9583d385d80273c7f0a7bd3227fba11336527fa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            engraw.dat
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\engraw.dat
            • Size 385KB
            • SHA256 835828871ef9af95f85b8f249f2cacdbbae6c73ef802448f7c59584eb63265f6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            rawdict.dat
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\rawdict.dat
            • Size 6.3MB
            • SHA256 1d753a7609cfe79ec3abc6b2c0c6d552f29caf1251ffae2cb8fb81a71d80ee84
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            rawgram.dat
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dict\rawgram.dat
            • Size 15.1MB
            • SHA256 5f6bd5aa51cf2590579116816e87a26617f1424fdb00f4703dd4ee9429d425e8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dictbuilder.exe
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\dictbuilder.exe
            • Size 264KB
            • SHA256 9415b6d6014edb194cb9e428e77900c37b1b9a950e2c97bd013d4af8f5e8455a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            imeconfig.exe
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeconfig.exe
            • Size 3.2MB
            • SHA256 5893e51697c153e3ef8b257cba716577b7cc3e82fd0a8fbab51189706dedfc40
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            imepng.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imepng.dll
            • Size 298KB
            • SHA256 bb0258c4b7ea8543f2f5aced98081d7a973f337c57be08f294ab189d13e7c417
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            imetool.exe
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetool.exe
            • Size 432KB
            • SHA256 00c5a6e9b0a8cdf543c619b6415f87ab66d345b850b817794a41649b19b9a903
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            imetoolx64.exe
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imetoolx64.exe
            • Size 495KB
            • SHA256 4017c5722e4b3e922c60f6f9d3422fbce2a15edc517cc2a3792ac1472d039620
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            imeutil.exe
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imeutil.exe
            • Size 105KB
            • SHA256 756d55a8085e1b07695eb90db9266e98a0f0afc67ae188867eed96badc3d59ea
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            imezlib.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\imezlib.dll
            • Size 186KB
            • SHA256 183db759881d0213aa708410c122a7373ba08dbe122343b6acf9292741108d97
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libcurl.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\libcurl.dll
            • Size 295KB
            • SHA256 4352c68ffc4308c2e24acc19608318a52dd0a9f362f1cd2c8ff07b55ae37dde9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libeay32.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\libeay32.dll
            • Size 1.1MB
            • SHA256 1f649a43e098fef9be0cbdf6f57b1afd3aa14d06c5c1aa82f5c26b769f04f141
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msvcp120.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\msvcp120.dll
            • Size 444KB
            • SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msvcr120.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\msvcr120.dll
            • Size 948KB
            • SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssleay32.dll
            • Path C:\Program Files (x86)\Baidu\BaiduPinyin\3.3.2.1028\ssleay32.dll
            • Size 267KB
            • SHA256 6f34c5eec35a9f5af26cd163792c53fbd30ff0d04110f6bddeeff413f8dea10a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Global.db
            • Path C:\ProgramData\Baidu\Common\Global.db
            • Size 52B
            • SHA256 82abec24a9d1af7bf8d62aebc19b24172e8457a9363628076cb9cd6d20677b1d
            • MD5 SHA1 SHA512
            Submit Download

            Status.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
            • Size 1KB
            • SHA256 44ac3574349448425da5fce1b968ff639ba4b2866ce141c180d29a877784cdda
            • MD5 SHA1 SHA512
            Submit Download

            Status.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
            • Size 2KB
            • SHA256 c6bad37fde947b20e51dffd33df51298bb66cf0456a0fce31a31133072320a5e
            • MD5 SHA1 SHA512
            Submit Download

            Status.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
            • Size 2KB
            • SHA256 504ec242dacd2b1f6bbe4ebc318558528750ccfd04a874ac46036bbec7da949e
            • MD5 SHA1 SHA512
            Submit Download

            Status.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
            • Size 298B
            • SHA256 e950281839cce5b62e0ad9aceecffcd5ee10f67865af33d0bcdcd39d2eb163bb
            • MD5 SHA1 SHA512
            Submit Download

            Status.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Account\.common\Status.ini
            • Size 1KB
            • SHA256 8b19d115d94bd55f4497b22fc7e0798d2f77f7efd312a8fa89077e22be30f0c4
            • MD5 SHA1 SHA512
            Submit Download

            Status.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini
            • Size 4KB
            • SHA256 15963d5145eb555c87f444dc63c8dde3dbe679d216388a2e1bfbfd9c5ba65d1b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Status.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini
            • Size 5KB
            • SHA256 e05f678d1c9e99b9d6b35a35d23192d129a73fbed8d1aeb02f2661b8f942baae
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Status.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini
            • Size 5KB
            • SHA256 8f03b83692a332bb65406967100f58b1d0c266488162cc526c7a855f103f0c99
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Status.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\Status.ini
            • Size 269B
            • SHA256 a5a0b097e91b243371408dc0cd30d426aee25e5f51f7a2a604667f1f61e0395e
            • MD5 SHA1 SHA512
            Submit Download

            common.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\common.ini
            • Size 568B
            • SHA256 2c6c16ec784410c022bfe6dd4618fb2f4cff421c0cbc151707afbf9db0ad3a3c
            • MD5 SHA1 SHA512
            Submit Download

            config.ini
            • Path C:\Users\Admin\AppData\LocalLow\Baidu\BaiduPinyin\config.ini
            • Size 150B
            • SHA256 03d968bb42e813c141948d6ef1e16ab2c3b1a5d8c93a42f879aaebe33dd40444
            • MD5 SHA1 SHA512
            Submit Download

            Protocol.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz90B9.tmp\Src\Protocol.dll
            • Size 668KB
            • SHA256 7c301b9c44cae3a53a4f939a391ae36e79e29f9216fc903665b4551426cecd90
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Report.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz90B9.tmp\Src\Report.dll
            • Size 316KB
            • SHA256 3347ab083d69d9d4bf6c8e6816c56a1eb694b581721965ebd44d240fe956e164
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz90B9.tmp\System.dll
            • Size 19KB
            • SHA256 714bd22a836a7f164b848541b8bf8ac80a20ff38e10e412bf9ef518620a80b8c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chkm.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz90B9.tmp\chkm.dll
            • Size 74KB
            • SHA256 2061a94b4d34a77f935f95a3741f917c91b27d0e1585c2ee2f8e00806b671db7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            insthelper.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz90B9.tmp\insthelper.dll
            • Size 774KB
            • SHA256 d62d59db60544bd44db6d710f3b6d48608bee022d908dc46d16885e79dd1ca0d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            reportsetup.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsz90B9.tmp\reportsetup.dll
            • Size 309KB
            • SHA256 210876c0ff70ffaa88a05f9ef794a96136549f4168e940e256fb4ac85b0fff71
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download