Overview

overview

8

Static

static

7

29f9cfeda4...18.exe

windows7-x64

8

29f9cfeda4...18.exe

windows10-2004-x64

7

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...md.dll

windows7-x64

3

$PLUGINSDI...md.dll

windows10-2004-x64

3

$PLUGINSDI...mp.exe

windows7-x64

1

$PLUGINSDI...mp.exe

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...er.exe

windows7-x64

3

$PLUGINSDI...er.exe

windows10-2004-x64

3

$PLUGINSDI...64.exe

windows7-x64

1

$PLUGINSDI...64.exe

windows10-2004-x64

1

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

$PROGRAMFI...st.exe

windows7-x64

7

$PROGRAMFI...st.exe

windows10-2004-x64

7

$PLUGINSDI...md.dll

windows7-x64

3

$PLUGINSDI...md.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    92s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 03:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    29f9cfeda401c46c17767ee0c60359fa_JaffaCakes118.exe
  • Size 22.4MB
  • Sample241009-d1b4cavbjb
  • SHA256 8d03960cb9aa16abcff1f99970a14ab762c4ceeb8094761e1fe84e444039cc6d
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryransomwareupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 47 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Control Panel 17 IoCs
    evasion
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29f9cfeda401c46c17767ee0c60359fa_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\29f9cfeda401c46c17767ee0c60359fa_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\UXTheme Patcher64.exe
      "C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\UXTheme Patcher64.exe" -silent
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1792
    • C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\UXTheme Patcher.exe
      "C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\UXTheme Patcher.exe" -silent
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4904
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\imageres.dll\imageres.dll.txt"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:4284
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\system32\imageres.dll.xpize" "C:\Windows\system32\imageres.dll"
      2⤵
      • Executes dropped EXE
      PID:5044
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\imagesp1.dll\imagesp1.dll.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4944
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\system32\imagesp1.dll.xpize" "C:\Windows\system32\imagesp1.dll"
      2⤵
      • Executes dropped EXE
      PID:3464
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\authui.dll\authui.dll.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3732
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\system32\authui.dll.xpize" "C:\Windows\system32\authui.dll"
      2⤵
      • Executes dropped EXE
      PID:4360
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\batmeter.dll\batmeter.dll.txt"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:2056
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\system32\batmeter.dll.xpize" "C:\Windows\system32\batmeter.dll"
      2⤵
      • Executes dropped EXE
      PID:1920
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\pnidui.dll.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1444
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\system32\pnidui.dll.xpize" "C:\Windows\system32\pnidui.dll"
      2⤵
      • Executes dropped EXE
      PID:4380
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\SndVolSSO.dll\SndVolSSO.dll.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4148
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\system32\SndVolSSO.dll.xpize" "C:\Windows\system32\SndVolSSO.dll"
      2⤵
      • Executes dropped EXE
      PID:2904
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\stobject.dll\stobject.dll.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4008
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\system32\stobject.dll.xpize" "C:\Windows\system32\stobject.dll"
      2⤵
      • Executes dropped EXE
      PID:4612
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\basebrd.dll\basebrd.dll.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5096
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\Branding\Basebrd\basebrd.dll.xpize" "C:\Windows\Branding\Basebrd\basebrd.dll"
      2⤵
      • Executes dropped EXE
      PID:5104
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\ExplorerFrame.dll\ExplorerFrame.dll.txt"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1732
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\system32\ExplorerFrame.dll.xpize" "C:\Windows\system32\ExplorerFrame.dll"
      2⤵
      • Executes dropped EXE
      PID:2340
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\shellbrd.dll\shellbrd.dll.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4240
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\Branding\ShellBrd\shellbrd.dll.xpize" "C:\Windows\Branding\ShellBrd\shellbrd.dll"
      2⤵
      • Executes dropped EXE
      PID:1052
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\explorer.exe\explorer.exe.txt"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:3208
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\explorer.exe.xpize" "C:\Windows\explorer.exe"
      2⤵
      • Executes dropped EXE
      PID:2428
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\iexplore.exe\iexplore.exe.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4396
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Program Files (x86)\Internet Explorer\iexplore.exe.xpize" "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      2⤵
      • Executes dropped EXE
      PID:4564
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\notepad.exe\notepad.exe.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2528
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Windows\system32\notepad.exe.xpize" "C:\Windows\system32\notepad.exe"
      2⤵
      • Executes dropped EXE
      PID:1588
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\wmplayer.exe\wmplayer.exe.txt"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4468
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Program Files (x86)\Windows Media Player\wmplayer.exe.xpize" "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
      2⤵
      • Executes dropped EXE
      PID:4300
    • C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\JpgToBmp.exe
      C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\JpgToBmp.exe C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\Android.jpg - C:\Windows\Web\Wallpaper\Android.bmp
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4372
    • C:\Program Files (x86)\Jelly Bean Skin Pack\boot.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\boot.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2744
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Skin Pack\android4\install.cmd" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4288
        • C:\Program Files (x86)\Skin Pack\android4\Win7BootUpdaterCmd.exe
          Win7BootUpdaterCmd boot.bs7
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3656
    • C:\Program Files (x86)\Jelly Bean Skin Pack\TopTaskbar.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\TopTaskbar.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4904
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Skin Pack\Lion\KEX.cmd" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1492
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im explorer.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:1200
    • C:\Program Files (x86)\Jelly Bean Skin Pack\RIC.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\RIC.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3112
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Skin Pack\refresh icon\ric7.cmd" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:376
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im explorer.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          PID:3124
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:\Users\Admin\AppData\Local\IconCache.db"
      2⤵
      • Executes dropped EXE
      PID:1636
    • C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
      "C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe" "C:n\AppData\Local\IconCache.db"
      2⤵
      • Executes dropped EXE
      PID:3800

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        authui.dll
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Backup\authui.dll
        • Size 275KB
        • SHA256 1bf55c034d54c4925896e30ae3c772e1520c768e64f499d766d026a0de55e3a0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        batmeter.dll
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Backup\batmeter.dll
        • Size 40KB
        • SHA256 61903d145506ce4857e5211e289dd9e0251b1081a2417d268d373284c76293f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        imageres.dll
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Backup\imageres.dll
        • Size 2KB
        • SHA256 67c93e5c99187db024be2ddbf26020911d1f6e8836ddb2da2e51a87228c3182b
        • MD5 SHA1 SHA512
        Submit Download

        imagesp1.dll
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Backup\imagesp1.dll
        • Size 2KB
        • SHA256 494b5be61b561db063677b15fa0093efde12edb921fb2b6fde8db9c50c5c9f47
        • MD5 SHA1 SHA512
        Submit Download

        pnidui.dll
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Backup\pnidui.dll
        • Size 2.1MB
        • SHA256 c4b3df6dc6a078b73a3dd935b807060ca323a98653eb13ec72582e6c98abafe4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        12269.bmp
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\authui.dll\12269.bmp
        • Size 3KB
        • SHA256 4f973fc52c1e800b857035ad041ebe9fc2bcb8e04e94d3ce6b9737d5b84b8f6a
        • MD5 SHA1 SHA512
        Submit Download

        12270.bmp
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\authui.dll\12270.bmp
        • Size 3KB
        • SHA256 b5d942187d3fdce96d2b0dd9c4c5614f24fe625c7077064685fdd1cb367e44b8
        • MD5 SHA1 SHA512
        Submit Download

        12281.bmp
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\authui.dll\12281.bmp
        • Size 3KB
        • SHA256 50fa178e1d5da32749302dd7e0043c4bc215dfaab620127eccaabede20534fa8
        • MD5 SHA1 SHA512
        Submit Download

        12320.bmp
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\authui.dll\12320.bmp
        • Size 2KB
        • SHA256 d568b1e48f1fac4e0c98ae4287e8eb80366bea619d010f9003784f664367012b
        • MD5 SHA1 SHA512
        Submit Download

        12321.bmp
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\authui.dll\12321.bmp
        • Size 2KB
        • SHA256 07d7cd4fb7f981ad1880000c4447564a5469eac43ad016941906afaa2e185a4c
        • MD5 SHA1 SHA512
        Submit Download

        authui.dll.txt
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\authui.dll\authui.dll.txt
        • Size 4KB
        • SHA256 3bca07d71ccf1f4cb12141f75436a2616845e83e6612f671c1719e22b71be18a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        batmeter.dll.txt
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\batmeter.dll\batmeter.dll.txt
        • Size 345B
        • SHA256 e605a11d4c1b4519e8f44f0e85ac6473696b51e81e6ac8afb7be88a2313ad5c6
        • MD5 SHA1 SHA512
        Submit Download

        139.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\imageres.dll\139.ico
        • Size 106KB
        • SHA256 84567059fc3215de5a0f30c1fbecc8ee0486028b15e303cf184ddf2bd4feb4f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        imageres.dll.txt
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\imageres.dll\imageres.dll.txt
        • Size 12KB
        • SHA256 f0635f35c1d17c30ca85e5981cecc53289d0ebcba8656a3f136538df8fb61e29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        208.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\imagesp1.dll\208.ico
        • Size 102KB
        • SHA256 a8a1946eaa7ec9c2a3a67af760fc20b3ec2fea471897ae2ef579396fc4b7b4fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        imagesp1.dll.txt
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\imagesp1.dll\imagesp1.dll.txt
        • Size 652B
        • SHA256 705747bb0e913391544740615b1a4514792ddf864fad1eac896869cfab5b86c6
        • MD5 SHA1 SHA512
        Submit Download

        3020.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3020.ico
        • Size 4KB
        • SHA256 03136b58bc58b85d59f5a0010c1f292b036e3560da41977b73536cb8a92d3152
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3021.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3021.ico
        • Size 4KB
        • SHA256 b13e4b55b8115f3621f0cd3de152086d35c85a1a01ee2f5fc850b492f3553cab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3022.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3022.ico
        • Size 4KB
        • SHA256 2fb4fba23e1cffe4bdb50add8d8131bd51e8a7935acf084518d3a20fafc2f68b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3023.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3023.ico
        • Size 4KB
        • SHA256 4e529462b548c53da222d56db981f97abb705dc61ccf4ff8f1db39db94f101c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3024.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3024.ico
        • Size 4KB
        • SHA256 644cd4c4f1b118d4a5dbc9f58ebf2ad1d1cb9d5f90f8ac64f33d2054f44746a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3025.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3025.ico
        • Size 4KB
        • SHA256 232e73491cdf7d55e32d3b9f64e32be4ad74fbf8e550707f135bc4faeb50b9e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3027.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3027.ico
        • Size 4KB
        • SHA256 fb76d4b92419ee8f32285451fd90c708cb475a340ba5c1dbebc269027907c8be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3028.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3028.ico
        • Size 4KB
        • SHA256 cf47be4a4733cdd6b5303bcb2f740edca742332327b904aa370e8cb8f4adc584
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3029.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3029.ico
        • Size 4KB
        • SHA256 3b9032199f6335c4cc07eeea66921023059eb22a8ffd1d7cd7e935a997cf2e35
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3030.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3030.ico
        • Size 4KB
        • SHA256 ef88023aa4cc474e5b2ee442fa758af056ce451a7d447065db26ed5d8e6d2309
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3031.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3031.ico
        • Size 4KB
        • SHA256 b0e5e667c4d503e94963253a8085a3cc93edff67f6e0d034d2ac859e9d861639
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3032.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3032.ico
        • Size 4KB
        • SHA256 76e7b5621f1bfe5260e4f74a51249dc603a314043b987d241e6bad8bd55ab93a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3048.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3048.ico
        • Size 1KB
        • SHA256 e69c7eb0869db7fba6b7f38531cf711a475b77850fa90eacd4b62a57a16faeca
        • MD5 SHA1 SHA512
        Submit Download

        3051.ico
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\3051.ico
        • Size 4KB
        • SHA256 921d20feadfd5365ed89b16999510f61c5a479c65efb391692b3ec31fcfc2687
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pnidui.dll.txt
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Resources\pnidui.dll\pnidui.dll.txt
        • Size 2KB
        • SHA256 5597879476354685146eb23355ee8e6428cb77e342f42483536a783ba4b4ffd8
        • MD5 SHA1 SHA512
        Submit Download

        RocketDock.exe
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\RocketDock\RocketDock.exe
        • Size 484KB
        • SHA256 9ff98d6fd2539cefc9f42103a7f72388bed6ee590400559b92bc7430228da36a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        background.ini
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\RocketDock\Skins\AstroOrange\background.ini
        • Size 223B
        • SHA256 2f9a65652dcfd86b9a423926171a475d45085ba1447c2a0b553da2c3875043f3
        • MD5 SHA1 SHA512
        Submit Download

        separator.ini
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\RocketDock\Skins\AstroOrange\separator.ini
        • Size 63B
        • SHA256 1b5fbb364299f161c9a6ee23d64a611492761c9712e349132915b7717cce77f4
        • MD5 SHA1 SHA512
        Submit Download

        Separator.ini
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\RocketDock\Skins\Milk1\Separator.ini
        • Size 69B
        • SHA256 3209912209357823aa3bc1f6fd45e2bcdaaa6b47bbc60233731601d10acb4ef6
        • MD5 SHA1 SHA512
        Submit Download

        background.ini
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\RocketDock\Skins\ProtoSky\background.ini
        • Size 223B
        • SHA256 fab2d4d53b491671deb18cb13402a2e26208a533eaaced4a326ff3dc8da79d12
        • MD5 SHA1 SHA512
        Submit Download

        MoveEx.exe
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\MoveEx.exe
        • Size 15KB
        • SHA256 e0017fb1874641754b228fe0d50e23302e69b93e4331d535c6fe6d0c22199629
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ResHacker.exe
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.exe
        • Size 997KB
        • SHA256 52cad2ada36a7a4b8d5e653cfe1854d32210ef198561e4cf53ea1c4e5ebbb84f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ResHacker.ini
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.ini
        • Size 257B
        • SHA256 99c104a02846d22b412ce62354be18d51533cadba15315d1f2aee05fb1a820a3
        • MD5 SHA1 SHA512
        Submit Download

        ResHacker.ini
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.ini
        • Size 276B
        • SHA256 256be57b9632bb3a6d8efdc676f52695fe2fb5634e410be108edb660888ec123
        • MD5 SHA1 SHA512
        Submit Download

        ResHacker.ini
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.ini
        • Size 293B
        • SHA256 df10aadffbdcaf245c041118d916c36035bf68e526503f37fdd2c91fe9161811
        • MD5 SHA1 SHA512
        Submit Download

        ResHacker.ini
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\Tools\ResHacker.ini
        • Size 312B
        • SHA256 7caaefb5cc65fd06ac317559685fce129e9d8f5fd65dbae824b926658781d4a0
        • MD5 SHA1 SHA512
        Submit Download

        23.png
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\xwidget\Res\Template\weatherTemp\Icon\23.png
        • Size 11KB
        • SHA256 29cba7577d397dc14d0a1837fa779701c80dd029573d6df78619201915d478f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        26.png
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\xwidget\Res\Template\weatherTemp\Icon\26.png
        • Size 10KB
        • SHA256 c0f902e9e3c01d6f0d1249bb9cb703432aedd55f363a2c6b6d5340ca75741e82
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        xwidget.exe
        • Path C:\Program Files (x86)\Jelly Bean Skin Pack\xwidget\xwidget.exe
        • Size 1.6MB
        • SHA256 56bb657fafd05ebd86c5b7efba8f00c4226008a121eedc81bfadce48bc506f18
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        KEX.cmd
        • Path C:\Program Files (x86)\Skin Pack\Lion\KEX.cmd
        • Size 31B
        • SHA256 5da151a916d4a9118e82ea8d783e4545441612833e4f555e0948e696f35ef996
        • MD5 SHA1 SHA512
        Submit Download

        install.cmd
        • Path C:\Program Files (x86)\Skin Pack\android4\install.cmd
        • Size 27B
        • SHA256 3a393057c762af5c067ca058924ec5e64921a798aaee2f9bd818d88d50adbdff
        • MD5 SHA1 SHA512
        Submit Download

        ric7.cmd
        • Path C:\Program Files (x86)\Skin Pack\refresh icon\ric7.cmd
        • Size 89B
        • SHA256 61ad0a31a74ad1eeb7ed490188a4562c0a1a8ac832bacf467131c2bc0a887dbf
        • MD5 SHA1 SHA512
        Submit Download

        2.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
        • Size 36B
        • SHA256 a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
        • MD5 SHA1 SHA512
        Submit Download

        Banner.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\Banner.dll
        • Size 4KB
        • SHA256 ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b
        • MD5 SHA1 SHA512
        Submit Download

        ExecCmd.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\ExecCmd.dll
        • Size 4KB
        • SHA256 c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69
        • MD5 SHA1 SHA512
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UXTheme Patcher.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\UXTheme Patcher.exe
        • Size 72KB
        • SHA256 558f6e38c300957234231234c44ccf41217182677e859c9005a51094bdf01794
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UXTheme Patcher64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\UXTheme Patcher64.exe
        • Size 92KB
        • SHA256 196756bea46f45de4b8e2eedebd51df8222f627f1eb9c2876d927718c85286e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        inetc.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\inetc.dll
        • Size 20KB
        • SHA256 096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\nsExec.dll
        • Size 6KB
        • SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        xml.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsbA29B.tmp\xml.dll
        • Size 118KB
        • SHA256 e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1052-633-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/1444-535-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/1588-683-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/1636-1515-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/1732-614-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/1920-464-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/2056-456-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/2340-619-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/2428-651-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/2528-678-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/2744-1466-0x0000000000400000-0x0000000000427000-memory.dmp
        Download

        memory/2904-560-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/3112-1498-0x0000000000400000-0x0000000000428000-memory.dmp
        Download

        memory/3208-646-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/3464-348-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/3732-432-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/3800-1520-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/4008-569-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/4148-555-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/4240-628-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/4284-308-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/4300-699-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/4360-440-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/4380-540-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/4396-664-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/4468-694-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/4564-669-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/4612-574-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/4744-37-0x00000000056B0000-0x00000000056D1000-memory.dmp
        Download

        memory/4904-1482-0x0000000000400000-0x0000000000422000-memory.dmp
        Download

        memory/4944-340-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/5044-319-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/5096-584-0x0000000000400000-0x0000000000502000-memory.dmp
        Download

        memory/5104-589-0x0000000000400000-0x0000000000409000-memory.dmp
        Download