ee31b012b2e7d0a20115ebbdca5eb93741c6247ac984743e9b133cc79de2bca4

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.exe
Size

2.2MB
MD5

16d88e8323fa362cd5a1473578c46f6f
SHA1

f274f3a8dde5bc4385702c8040a351c12d0dd461
SHA256

ee31b012b2e7d0a20115ebbdca5eb93741c6247ac984743e9b133cc79de2bca4
SHA512

befaac12a62591eacfe66c438005ab9ddfcd781217d17655685a08f08507a7fe95c28e364e3cbb47e0b47f95e5ac62333b6592e04e3c4e5942cecb1835b7f35d
SSDEEP

49152:k0jK9+LZgR8B2dWBCp1pSei2EY48esWo/I0p6eJhvImKebA5rOYiZno:xj+u2+20BCzpziMR+f0pJhvImKebSivK

Score

7^/10

adware discovery persistence privilege_escalation stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	Inbox.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
1688	Inbox.exe
4912	Inbox.exe
4764	Inbox.exe
4408	Inbox.exe

Loads dropped DLL 6 IoCs

pid	Process
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4816	regsvr32.exe
1532	regsvr32.exe
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InboxToolbar = "\"C:\\Program Files (x86)\\Inbox Toolbar\\Inbox.exe\" /STARTUP"	Inbox.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\	regsvr32.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Inbox Toolbar\unins000.dat	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\is-FLRQ9.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\is-HL1LI.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\black_brown.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\general_youtube2.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\social_myspace.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\uninstall.ini	Inbox.exe
File created	C:\Program Files (x86)\Inbox Toolbar\is-MA5F9.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-K8UOG.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-7QL52.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-GMV62.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\setupcfg.ini	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\pinterest_button.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\uninstall.ini	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-E5JCS.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-VAMFM.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\social_facebook_panel.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\social_twitter.xml	Inbox.exe
File created	C:\Program Files (x86)\Inbox Toolbar\is-VB161.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\is-81V72.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-HRAP6.tmp	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\unins000.msg	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\unins000.dat	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\setupcfg.ini	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Inbox.ini	Inbox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inbox.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}\AppName = "Inbox.exe"	Inbox.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} = 00	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppName = "Inbox64.dll"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Policy = "3"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\DisplayName = "Inbox Search"	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}	Inbox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Policy = "3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppPath = "C:\\Program Files (x86)\\Inbox Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppPath = "C:\\Program Files (x86)\\Inbox Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\FaviconURLFallback = "http://www2.inbox.com/favicon.ico"	Inbox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{C04B7D22-5AEC-4561-8F49-27F6269208F6}.ico"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}\AppPath = "C:\\Program Files (x86)\\Inbox Toolbar"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppName = "Inbox.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppPath = "C:\\Program Files (x86)\\Inbox Toolbar"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ShowSearchSuggestions = "1"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}\AppName = "Inbox.exe"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppPath = "C:\\Program Files (x86)\\Inbox Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppName = "Inbox64.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\Main	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\URL = "http://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80861&iwk=845&lng=en"	Inbox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\SuggestionsURL_JSON = "http://www.inbox.com/s.aspx?q={searchTerms}"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}\AppPath = "C:\\Program Files (x86)\\Inbox Toolbar"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppName = "Inbox.dll"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Policy = "3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IEWatsonEnabled = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Policy = "3"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} = 00	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}\Policy = "3"	Inbox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}\Policy = "3"	Inbox.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\IEWatsonEnabled = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}	regsvr32.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.inbox.com/homepage.aspx?tbid=80861&iwk=845&lng=en"	Inbox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FAE973C-3FE3-44BF-81F0-ADB0D42CE851}	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}\1.0\0\win32\ = "C:\\Program Files (x86)\\Inbox Toolbar\\Inbox64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.IBX404\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.AppServer\Clsid	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.AppServer\Clsid\ = "{612AD33D-9824-4E87-8396-92374E91C4BB}"	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}\1.0\HELPDIR	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FAE973C-3FE3-44BF-81F0-ADB0D42CE851}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612AD33D-9824-4E87-8396-92374E91C4BB}\Version\ = "1.0"	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.Toolbar\Clsid\ = "{D7E97865-918F-41E4-9CD0-25AB1C574CE8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.Toolbar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.Toolbar\Clsid\ = "{D7E97865-918F-41E4-9CD0-25AB1C574CE8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FAE973C-3FE3-44BF-81F0-ADB0D42CE851}\TypeLib\Version = "1.0"	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.IBX404\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}\TypeLib\ = "{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}\TypeLib\ = "{CBEF8724-D080-4737-88DA-111EEC6651AA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}\TypeLib\ = "{CBEF8724-D080-4737-88DA-111EEC6651AA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}\ProgID\ = "Inbox.JSServer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\InprocServer32\ = "C:\\Program Files (x86)\\Inbox Toolbar\\Inbox64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}\1.0\FLAGS	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}\1.0\ = "Inbox"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\ = "&Inbox Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}\TypeLib\Version = "1.0"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}\ = "IAppServer"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{042DA63B-0933-403D-9395-B49307691690}\TypeLib\ = "{CBEF8724-D080-4737-88DA-111EEC6651AA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\inbox\ = "inbox"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{042DA63B-0933-403D-9395-B49307691690}\Implemented Categories\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}\1.0\0	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\inbox\CLSID = "{37540F19-DD4C-478B-B2DF-C19281BCAF27}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}\InprocServer32\ = "C:\\Program Files (x86)\\Inbox Toolbar\\Inbox64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{042DA63B-0933-403D-9395-B49307691690}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.IBX404\Clsid\ = "{37540F19-DD4C-478B-B2DF-C19281BCAF27}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Inbox Toolbar\\"	Inbox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
4408	Inbox.exe
4408	Inbox.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4408	Inbox.exe
4408	Inbox.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 4880	1284	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.exe	89
PID 1284 wrote to memory of 4880	1284	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.exe	89
PID 1284 wrote to memory of 4880	1284	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.exe	89
PID 4880 wrote to memory of 1688	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	91
PID 4880 wrote to memory of 1688	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	91
PID 4880 wrote to memory of 1688	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	91
PID 4880 wrote to memory of 4912	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	92
PID 4880 wrote to memory of 4912	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	92
PID 4880 wrote to memory of 4912	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	92
PID 4880 wrote to memory of 4816	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	93
PID 4880 wrote to memory of 4816	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	93
PID 4880 wrote to memory of 4816	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	93
PID 4880 wrote to memory of 1532	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	94
PID 4880 wrote to memory of 1532	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	94
PID 4880 wrote to memory of 4764	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	97
PID 4880 wrote to memory of 4764	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	97
PID 4880 wrote to memory of 4764	4880	16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp	97
PID 4764 wrote to memory of 4408	4764	Inbox.exe	98
PID 4764 wrote to memory of 4408	4764	Inbox.exe	98
PID 4764 wrote to memory of 4408	4764	Inbox.exe	98

C:\Users\Admin\AppData\Local\Temp\16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\is-DVPTK.tmp\16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DVPTK.tmp\16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp" /SL5="$60290,1643093,70144,C:\Users\Admin\AppData\Local\Temp\16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
    "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /regserver
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:1688
- - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
    "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /install
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:4912
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Inbox Toolbar\Inbox.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:4816
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Inbox Toolbar\Inbox64.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:1532
- - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
    "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /afterinstall
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
      "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /TRAY 0
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Inbox Toolbar\Buttons\black_brown.xml

Filesize
50KB

MD5
9db9a8baf643a3512feb2f1014782c72

SHA1
04538d23239e716694e5ea17f7bb9132aa0e3939

SHA256
82f18d65fae1ab1f78afabc7d44cf3725b4a65c93d21d40d776ef69762310f41

SHA512
612d7348882a6d0f1ddc86228556bee42e555143ee9ca78000a52d01e764078c80d205796eb9de39e903a35a84b12abf69e4bf4bfb4976396ab1109c34812a36

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\general_youtube2.xml

Filesize
5KB

MD5
9d25e413b26edd6157f92e120941a856

SHA1
97bfd31d3282cc568e74f8f8b86a3b59f32d36e9

SHA256
694696a703a7e7e27d4da7d7350c6d2eb1cdf3d4494ce523290d94e322436c08

SHA512
481416e4de97faa516d2f3f6a34f2a5a6a9c11f12365e07c712799a9f5e549fc05d1a54a0d46e72eb7c1a1525540bbe8f1e851cf8ef486808e43d77673bae056

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\pinterest_button.xml

Filesize
5KB

MD5
5edb9f1e0f48304c7e7ac837a54a12d4

SHA1
3380c2b399018cec277fb5111cb2b8dec5868815

SHA256
ad88c981ad1cfad58e72b60dfb9d4357c1337e3b32e81d80c665d3e3a9d60405

SHA512
15c4ab8e80458e5684d2ca9e41f518cbeb48cf8d783e9b75ac0925098f52f4ccec4833f0f8513c40d5330804629b57bc970edcedbcaee168efc8c6a04b585397

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\social_facebook_panel.xml

Filesize
4KB

MD5
bc28784f4872f3d8a38c058825ecdfd2

SHA1
96f0a1631f4cc51fc71faf3bca0dc27ca971ae23

SHA256
6ffb7375b67cacff0a5c4a83bde7b958fb039f2f87344ea4b2a455828f651c10

SHA512
6585a1055336a4406261d03e4f5239e0cc3a793394f56bd67b26c702de2eaf9bb252be52105f64ba3aad056f601b2e8ec7f811e4a35680489de9d51be7cecae0

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\social_myspace.xml

Filesize
4KB

MD5
0ae22594aed7c3c0f6a2346a35070bcf

SHA1
4a52f1c230ce76a949aa33d473c504c430e28e42

SHA256
a148bafd6c429e6517c1e11156cc627aa4b4522915e9bf9503319639fe6784f6

SHA512
cc2a151839e7687acf48917d0b65235b0a32011e2342d6951436d84423355efc60ee6da3f83b1fcc29b2bc08cfbfe52d51227d98fda7d2af493652a3479ef90e

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\social_twitter.xml

Filesize
7KB

MD5
a0670c3f05b5e4c2887c8fa619b8d265

SHA1
0c4f1d91cf9d72bf072ad96e24768147994c2a01

SHA256
690bc31e087aaa869edf7ac2ca8ecb16386464be67c257dcab8fd4d3b27703b8

SHA512
7317d3ca895d34afb88ef7f0a1a2e3f00c335901902bf2a4ad8397d7cb6914a27e5227d1ff63c9ffece1c28aa910813ba75525090fd0695a625baee4fe42d8c1

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox.dll

Filesize
1.0MB

MD5
5a5661aeb0941013365669cd88d9467e

SHA1
852bea09d2c0e419be8f80c82d82f369facb842e

SHA256
78f9b0f5fea9d1d87a01e61b96b4ed0e494564d7100b092d4385875aa40a4919

SHA512
c603a2da9f04994808a0e5151f53843d0a01c6ac486e5d655996f2dbb95dc4e3437471ce1a8f1537b164913942f1b6c47ba69a9b9a434073dfe18b985480148a

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox.exe

Filesize
1.3MB

MD5
4b05f0216a03ad5c4e5c9b59d60aee35

SHA1
d1a155ce0f6ce8554f4abb640660b7cfef4b5c1c

SHA256
c4d778be1dbe83532cb255516fe61ef62b1360eb0179899251c93f580110f3e2

SHA512
85bd3294472f9983ce61c97d29a67ad8a01c50a6c215c437d7826ffe980da98f4a1aad0939890388186e5147e66867fd5e5324e708c9a8efab0a727a544c9188

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox.ini

Filesize
2KB

MD5
4b7d7e04ac553df7aac162c657ba64e8

SHA1
08b4e45757c77739c32c7c9e4021a575224b8126

SHA256
80029b4dcbd30334c5956638fd47212e7af0d6c1d3dee4508e79be0817173176

SHA512
c2f4652511e2e1469be3a93910881d0f2480d3646623ce82f4f05b5ed14df0f466bfeff81a858144645ba97039a8fbfefbf4c0555cd7d0b272c878e6492ce37c

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox.ini

Filesize
2KB

MD5
ea020060dc8f25ea13ce1353841fc408

SHA1
e1bc16fd765ba496f53b3110fd7465e26403096a

SHA256
1d653e45e05655595f867f417fb011103faaa503e3b092774947d3c12af8c232

SHA512
6c52d217c8025d80c0c314dd38c4405d278d74a3bf9f8c59ebd3af938663959fee843ee6d28feeee737f51a079cd48cadc10a2790f10636dbeccefb9992291c2

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox64.dll

Filesize
1.5MB

MD5
0adf14e709da294adce48ab621e341af

SHA1
18cf3d76eccb2e62ca9cf038e75a0cbd59386d64

SHA256
0d0b5d6e107a916dbaf1b64f97dba9d8f32d0d6e0af28cb69c34656408e48c54

SHA512
ed4e4a514815632bfd9fd7fb86a54b05fc9038a3421ff0cd502110a342ccc31daa2eda06a0acf0bf74817268fbc31e50c88db20037021ea25fbb311eed256326

Download Submit
C:\Program Files (x86)\Inbox Toolbar\unins000.exe

Filesize
1.2MB

MD5
e15550cd79ff073d14cca10dbc18be3f

SHA1
d0e8fc8f42f99e346df3c0b7cda29df62130b346

SHA256
613020c2717649366d528e6f53445779f3134949053a3fea70b42117dd4970cc

SHA512
dcc22a1bac5fc97df2862e66712d35c89f4fc00ff8ec729129d32bf19d3452771d332da07289634f4e16f7a21b1d15e3eae57f8928794d1cb9a2a1d1f0c16ad9

Download Submit
C:\Program Files (x86)\Inbox Toolbar\uninstall.ini

Filesize
52B

MD5
84b25f3c870d44a561c6d554aca385ed

SHA1
5c371702a38d5e2c55ce1d7e5786a79449049ffd

SHA256
0a2afa87d19d4c805758903230938781dd7aa15d63013c342d4ca5ed41916687

SHA512
3306dbc5b456bd8b1a6f6ccea90bb6314601b1a1dc026577cb0ab3461561a88f523efb8e90cb0ee17d2fd983966d3b100ff5c9e8de72b30df62ffa0e43350b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
30B

MD5
6e154bd2aab28f37a3bbe8ef394802e6

SHA1
6efea9c0fdc55c2345369441ef19c32e182e7ce5

SHA256
b581ae9e6dd4f3dcf66fad7afbba62279d195b5af63a997abb342761a5acd2d0

SHA512
b2b8b962a63cc21b55440c38960c22f9e1c76e377244a63c737a5ac4c15d3ded143f3ebaffed74707291c4526ed9a80f9a9e5ef351b50b4f4bb08b81e92669f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
70B

MD5
6d1114852117bbd33547ef2b4413d13c

SHA1
a27c3507b713dea0fa66d8c0c175c88dd598e90e

SHA256
96fd13d97c09cd84f097cffd823f41d9a36b2ba2ea45370428c65d56871513a0

SHA512
25fefd5f5ecb71c953af533eb855df7a193373fe28bba351c366e78a8343aa1cd3de40a00fc57a2843a756b039aecea26335d1d75773cb0ac4939398ab0d4f8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
99B

MD5
58b0a159c9492c589bbe878b8315f27c

SHA1
741bb375b35dd5336b1d7ce6ed937c9987d4a354

SHA256
26300dbd3586e50e3c15103d5a4d9a6fea0c3bef3ccd176e77d900267aeac723

SHA512
494dc9e4f6d8e9ef538145004a6b7d25af17617056bbce01f264828bcb14db44fd1a821d8bc294799a6c39492085d00405a3a1a55d04aa80165432ff4ebe3b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
112B

MD5
8686f04d9115878c4e06b95c34092fd5

SHA1
ab695e86c10b759c171ebc85eda58342db27c4a9

SHA256
7ceafbb7ea2b38b715bdd0bcc4711e88f31ecfc468be37b147facf19c439f0e5

SHA512
f8b6b2eb8c5d1803e1b326cc75422ad5115c17f129986f4513b3b9e311ca673537882dbb362341f6761695b9fde81f4c77c74eb9c304b58cb3dc9b53c221f64e

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
152B

MD5
3dfcf58dc77c41680693df46e210a7e7

SHA1
f2b581e8268994a77f6fd187f1c5afa2721c6a11

SHA256
01bbdadd592bec18470e94ad7692a1e361c625689fe257fa29015861f7f54f36

SHA512
ebc9a4ba13e688a346a340871156a69559fee33981a7e6ef6ec1c8ecdb60142a16db847f445c1130518d5e907ea0000db9bbb5af5fd76e8fa0c13bd1934550b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\translate.ini

Filesize
89KB

MD5
6b72fbdc939dffb3c9d268d521459f91

SHA1
948023c34ddd35bab4b83d80cabf6b7fb06eb5f2

SHA256
9b1c3b8a08541289d360526f37a4647a59fa40f474d2288ea6a5c3a947364fff

SHA512
f8948e0cc24361f361886a4f9467b8316ed093e0def78df860ed221e345a69a8cae785f57d08cfd3ac54741ea9dbde97f035eb88aa8d35b5529c32cf50b1d8e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B624848E7D0C04204BF0E664FB37FBEA

Filesize
504B

MD5
53e4c765a72d4470b65a0a6045fec024

SHA1
f37af6a8616b1d81e56a7874552fbe7a885ea88e

SHA256
9213f5800edcf705e1809c7ddf05ecf13d01037b066d3b5e003c1f5ae0230171

SHA512
decced1fcfac40e21f2d77c7a85e91bb6b45fd97693fb7cfddd6f3fe1325c7c051de74314fd4f8fbef41096ddc7da3850196aa211d26a53b2cdff30dcd3d2821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF5A8FFDB77E427DAA4FCC1F3D18CADC

Filesize
504B

MD5
7eccaeff527cb3069767514aafa09109

SHA1
a96d7983270e571fe8144ed8e147d58f41e0b231

SHA256
6fc1342d660af0c1f65dae50ad9fd656dc49c2e69f626e47966f1db851249752

SHA512
e9ea3e0101b5f5fa7ec4b54a33659340d908d74eab4f95d2971fa9d1ee565022a516ec981602cbae6ec70305e1ede876df528f517b856aa3c7bba69bde907b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
bafafd12f462f78117c86eb8871e3b69

SHA1
29af15ca1dd0739e102c4f5649f26fc4188e126c

SHA256
b0143127c4f8fd644f6837b3441ad44b5e033d6e72b7a6eec68525334fe5552e

SHA512
124bb843b36d624508e56118564ab0c06f59758e82c90c17b1f0d5b5801feb385121b42ae4ee3320fbf040063dd25cbcf5779154e84b2a2cccb4d984cd037b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B624848E7D0C04204BF0E664FB37FBEA

Filesize
550B

MD5
086ae5149c579009b770b74af931c0fa

SHA1
abc4e7beb683c0272972a0055bd402c2a7dbdace

SHA256
5b88a353ea0b3084795795f183a02e97193a3424862780d247f1e77f8bde89f3

SHA512
45c325131558685ba715ad63b501ec27074dcec1b71b117f028e5883983b20870d6451aceea484154962572abce65077d71ccdfd65e48148be1cfbca2541d5cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF5A8FFDB77E427DAA4FCC1F3D18CADC

Filesize
550B

MD5
061a1fa005680a7a13f53f61c65d9e11

SHA1
082a3148a1b0d6b669052ea3ac7342fea7a2cd2e

SHA256
e7eb1c717ca9002e012ac18f8b8bbc72d37f7047ce45ceb8a48ac3a3b58383e4

SHA512
28ac85b695ebf4537d476d0ae9d2d2db3af1fde5e7abdae0c351c6901cdefab79f85104992fa47468d6227454ea8b14f582a72ca7a3e2215f96b4c485f5e8f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DVPTK.tmp\16d88e8323fa362cd5a1473578c46f6f_JaffaCakes118.tmp

Filesize
1.2MB

MD5
e7106fbf42fbc6d5b08a18ada4f781b4

SHA1
36d4a629f79d772c0b0df8bd2ae2ea09108d239d

SHA256
64e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635

SHA512
adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OCUS4.tmp\DownLib.dll

Filesize
183KB

MD5
db25dfdd4c1f2b65c68a230881072695

SHA1
94cd6a3438041f0e61b0a1bea7b66461854efe69

SHA256
1b66aaf1e7e3c493dd96af3b7442ea60072f6e93ba45281eacd31a14ca7e7e73

SHA512
db69e4ab2218856e5184d9094e7e39705b83e3efdc15225067205c8faf6e5836145364f1d509192defa3b48864e72b9f8c0f2dc53a7adb2b86c655318b7afc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OCUS4.tmp\setupcfg.ini

Filesize
44B

MD5
5753e5bb7fbc363a4ab377b73800d0a3

SHA1
6094bda27e5573ee704b3359bab3a9107ed5e6bf

SHA256
37f3e5c1039d640824e16f316145de37328a0a32e9b8c334699a3e8d98574732

SHA512
77d7853b1f7859ab81ead1842db4372168b47735ed8402fff6618744fd528499bf2690ef751183b64fadb6419c71f3936b16fdeb7f6f73f0ad7e2b91400a594a

Download Submit
memory/1284-100-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1284-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1284-2-0x0000000000401000-0x000000000040D000-memory.dmp

Filesize
48KB

Download
memory/1688-134-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/4408-329-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/4764-283-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/4880-341-0x0000000004890000-0x000000000499B000-memory.dmp

Filesize
1.0MB

Download
memory/4880-102-0x0000000003AC0000-0x0000000003AF7000-memory.dmp

Filesize
220KB

Download
memory/4880-20-0x0000000003AC0000-0x0000000003AF7000-memory.dmp

Filesize
220KB

Download
memory/4880-210-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4880-351-0x0000000003AC0000-0x0000000003AF7000-memory.dmp

Filesize
220KB

Download
memory/4880-193-0x0000000004890000-0x000000000499B000-memory.dmp

Filesize
1.0MB

Download
memory/4880-191-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4880-167-0x0000000004890000-0x000000000499B000-memory.dmp

Filesize
1.0MB

Download
memory/4880-326-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4880-101-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4880-7-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4880-340-0x0000000003AC0000-0x0000000003AF7000-memory.dmp

Filesize
220KB

Download
memory/4880-339-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4880-344-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4880-350-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4912-197-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download