Malware Analysis Report

2024-12-07 14:50

Sample ID 241009-hezdzatcld
Target 2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118
SHA256 1b491752f18b866c048ebd243a4ef8a68d358c7d23b228705d06b1d9f612da75
Tags
discovery ransomware exploit
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

1b491752f18b866c048ebd243a4ef8a68d358c7d23b228705d06b1d9f612da75

Threat Level: Likely malicious

The file 2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware exploit

Possible privilege escalation attempt

Checks computer location settings

Modifies file permissions

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Sets desktop wallpaper using registry

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

System Location Discovery: System Language Discovery

NSIS installer

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Modifies Control Panel

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-09 06:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win7-20240903-en

Max time kernel

122s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.117.18:80 crl.microsoft.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.117.18:80 crl.microsoft.com tcp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win7-20240903-en

Max time kernel

121s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 224

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3952 wrote to memory of 3732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3952 wrote to memory of 3732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3952 wrote to memory of 3732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3732 -ip 3732

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 636

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 141.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\JpgToBmp.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe N/A
N/A N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Checks installed software on the system

discovery

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Web\\Wallpaper\\angry.bmp" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\579.bmp C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1054.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Aero Milk\Aeroglass.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1115.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\basebrd.dll C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\RocketDock.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Data\Style.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\My Music.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1069.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1058.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\ProtoSea\bg.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\29.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\5080.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\6.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Data\General.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\14.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1051.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1063.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\185.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\87.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\Untitled-15.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroGlass\background.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\ProtoSky\sep.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\161.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\My Pictures.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\Untitled-25.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroGlass\bg.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\ProtoTree\bg.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Special-RD\Background.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Skin Pack\angry\install.cmd C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\24.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\5022.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\110.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\Untitled-24.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroGrey\separator.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Brushed\Separator.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1058.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\113.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\36.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\7.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1071.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1115.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\CrystalXP.net\separator.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Luminous\Separator.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Special-RD\Separator.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\Untitled-19.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1044.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\WhiteCristal\Background.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1025.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1051.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\UberAPI\exports.def C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Logs\ExplorerFrame.dll.log C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\5034.jpg C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroGrey\background.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroSteel\bg.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1054.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\basebrd.dll\120.bmp C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\34582.bmp C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\164.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\LibMusic.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Vista\Vista.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Skin Pack\angry\boot.bs7 C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\wmplayer.exe\IDR_MAINFRAME.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Cursors\angry\Alternate Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Precision Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry.theme C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\Shell\NormalColor\en-US\shellstyle.dll.mui C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Print complete.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Logon Sound.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Notify.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\en-US\osituro.msstyles.mui C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Hardware Insert 2.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Diagonal Resize 1.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Move.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Recycle.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Vertical Resize.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Restore.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Critical Stop.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Unavailable.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Change Theme.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Navigation Start.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Handwriting.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\busy.ani C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Hardware Fail.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Help Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Text Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\Shell\NormalColor\shellstyle.dll C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Web\Wallpaper\angry.bmp C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\JpgToBmp.exe N/A
File created C:\Windows\Media\angry\Windows Exclamation.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Minimize.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows User Account Control.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\angry.msstyles C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Information Bar.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Logon.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Cross.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Diagonal Resize 2.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Web\Wallpaper\angry.jpg C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Hardware Remove.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Link Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Pop_up Blocked.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Ringin.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Horizontal Resize.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Battery Low.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Startup.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Battery Critical.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Menu Command.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Shutdown.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Normal Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\en-US\ANGRY-BIRDS.msstyles.mui C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Feed Discovered.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Hardware Insert.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Pop-up Blocked.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Ringout.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Working In Background.ani C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Error.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Start.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Logoff Sound.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Balloon.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\JpgToBmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\SizeNS = "%SYSTEMROOT%\\Cursors\\angry\\Vertical Resize.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\Crosshair = "%SYSTEMROOT%\\Cursors\\angry\\Precision Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\SizeNESW = "%SYSTEMROOT%\\Cursors\\angry\\Diagonal Resize 1.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\Hand = "%SYSTEMROOT%\\Cursors\\angry\\Link Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\Help = "%SYSTEMROOT%\\Cursors\\angry\\Help Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\IBeam = "%SYSTEMROOT%\\Cursors\\angry\\Text Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\SizeNWSE = "%SYSTEMROOT%\\Cursors\\angry\\Diagonal Resize 2.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\SizeAll = "%SYSTEMROOT%\\Cursors\\angry\\Move.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\UpArrow = "%SYSTEMROOT%\\Cursors\\angry\\Alternate Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\Wait = "%SYSTEMROOT%\\Cursors\\angry\\Busy.ani" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\NWPen = "%SYSTEMROOT%\\Cursors\\angry\\Handwriting.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\AppStarting = "%SYSTEMROOT%\\Cursors\\angry\\Working In Background.ani" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\Arrow = "%SYSTEMROOT%\\Cursors\\angry\\Normal Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\No = "%SYSTEMROOT%\\Cursors\\angry\\Unavailable.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Cursors\SizeWE = "%SYSTEMROOT%\\Cursors\\angry\\Horizontal Resize.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 33 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 34 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 35 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 36 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 33 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 34 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 35 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 36 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 33 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 728 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe
PID 728 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe
PID 728 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe
PID 728 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 1308 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 728 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\JpgToBmp.exe
PID 728 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\JpgToBmp.exe
PID 728 wrote to memory of 520 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\JpgToBmp.exe
PID 728 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe
PID 728 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe
PID 728 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe
PID 2620 wrote to memory of 556 N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 556 N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 556 N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe C:\Windows\SysWOW64\cmd.exe
PID 556 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe
PID 556 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe
PID 556 wrote to memory of 1460 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe
PID 728 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe
PID 728 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe
PID 728 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe
PID 4768 wrote to memory of 1148 N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe C:\Windows\SysWOW64\cmd.exe
PID 4768 wrote to memory of 1148 N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe C:\Windows\SysWOW64\cmd.exe
PID 4768 wrote to memory of 1148 N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe C:\Windows\SysWOW64\cmd.exe
PID 728 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 728 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 1148 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1148 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1148 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 728 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe

"C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe" -silent

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\basebrd.dll\basebrd.dll.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Windows\Branding\Basebrd\basebrd.dll.xpize" "C:\Windows\Branding\Basebrd\basebrd.dll"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\ExplorerFrame.dll.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Windows\System32\ExplorerFrame.dll.xpize" "C:\Windows\System32\ExplorerFrame.dll"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\imageres.dll.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Windows\System32\imageres.dll.xpize" "C:\Windows\System32\imageres.dll"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\explorer.exe\explorer.exe.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Windows\explorer.exe.xpize" "C:\Windows\explorer.exe"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\iexplore.exe\iexplore.exe.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Program Files (x86)\Internet Explorer\iexplore.exe.xpize" "C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\wmplayer.exe\wmplayer.exe.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Program Files (x86)\Windows Media Player\wmplayer.exe.xpize" "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\JpgToBmp.exe

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\JpgToBmp.exe C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\angry.jpg - C:\Windows\Web\Wallpaper\angry.bmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Skin Pack\angry\install.cmd" "

C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe

Win7BootUpdaterCmd boot.bs7

C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Skin Pack\refresh icon\ric7.cmd" "

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Users\Admin\AppData\Local\IconCache.db"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:n\AppData\Local\IconCache.db"

Network

Country Destination Domain Proto
US 8.8.8.8:53 installer.filebulldog.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 54.161.222.85:80 installer.filebulldog.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 www.hugedomains.com udp
US 104.26.7.37:443 www.hugedomains.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.195:80 c.pki.goog tcp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 85.222.161.54.in-addr.arpa udp
US 8.8.8.8:53 37.7.26.104.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\Banner.dll

MD5 0116a50101c4107a138a588d1e46fca5
SHA1 b781dce23e828cf2b97306661c7dad250a6aaf77
SHA256 ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b
SHA512 55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\inetc.dll

MD5 f02155fa3e59a8fc48a74a236b2bb42e
SHA1 6d76ee8f86fb29f3352c9546250d940f1a476fb8
SHA256 096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999
SHA512 8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\xml.dll

MD5 42df1fbaa87567adf2b4050805a1a545
SHA1 b892a6efbb39b7144248e0c0d79e53da474a9373
SHA256 e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845
SHA512 4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

memory/728-37-0x0000000005710000-0x0000000005731000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\nsExec.dll

MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\UXTheme Patcher.exe

MD5 c35efaa15f6f1da888efc247e886389d
SHA1 e3f35519380a564ff62f5ea2fa95fd5bca38bb1a
SHA256 558f6e38c300957234231234c44ccf41217182677e859c9005a51094bdf01794
SHA512 fd3d27271cab60f51929a4e92cccd0ce2edf8c95fd2db6cc957620ff2f7522e644b67862ec7803e6068f5ae75caedad9daae3dafdd4b7f4898c618c8498dca16

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

MD5 2f92eed4e2061af0961f379e9ded70d6
SHA1 8b58dcd428759d3633a14bcfc62a8cb6deb66de5
SHA256 52cad2ada36a7a4b8d5e653cfe1854d32210ef198561e4cf53ea1c4e5ebbb84f
SHA512 909561ad25f5a4af7360004a6b259bdb70dfad4ced7fe0f39a72ed61f421bc943dce9c7215634ed12284811f36d9a5bae8d1f439412a94bbbd4c24cb4f4962ac

memory/1952-75-0x00000000006D0000-0x00000000006D1000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\basebrd.dll\basebrd.dll.txt

MD5 1a362b7dcdb72a8fd94e6450294b2d67
SHA1 2a246f3e4263bb1080e17c3cc87a66a77f860b65
SHA256 7df9718226c3df5fabc859151e323f1231019085d87862539aa228190c494971
SHA512 156b5bb061b653578986b8b9badb64124fed81ff131325a82cc0139a88ccb5b6e03ee947cdebbae81fef5d39c9d89fcd84f1f4d914967dba16338df5e2af5c19

C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\basebrd.dll

MD5 e7efc89da9c2aeb5665dd65d1d963afc
SHA1 0d1b06df183b5d6709414add6f81267d18bc9cb9
SHA256 c5bd5368868fdff022042ec5b599736983aa6678e939179c24cb5a9077674784
SHA512 30efb321439d052d23f729c9d442aed9330160b38661e33df1dea47aca4dbabd95249f078986872d9f189bb426aa18b4570134995d7a333e42309e9d0b0fc721

memory/1952-82-0x0000000000400000-0x0000000000502000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nskA01A.tmp\ExecCmd.dll

MD5 b1d08c24cad3f8f6ccd6b9ebd24d30c0
SHA1 d01549db25d0345c05d3c2eb90b173f937966ce5
SHA256 c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69
SHA512 9cb5735c86cdf8d126268b7b2ec8fafd654d69bdfe5336d54b7d44b5ac8e1174836c487bb4aa40517516a55323bf9f916a96753c8dd2bc9b2d481071c9d9fbf8

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

MD5 fe1200c71152ec5dabd6d344be3e107c
SHA1 8117734f47727ec915a1c8c31002ccb6f7a96141
SHA256 8d2de2d69cf62cf3206ba785461d33e47e951f7bf14be1a3fa81522149079ddb
SHA512 4b63e9ee57e45854cf9990cebd0ba8ebef0dcb7b141d34744b3d2b3c5f1f440f2a296cee371cc6436f7032a33a1fd2ed3908088251f382caa57ed2d58a317944

memory/1308-93-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\34582.bmp

MD5 c13fe437d9932aa18bedcea19717088a
SHA1 99c69867a7339acf8041b16493f679a5b39bea27
SHA256 4bb6f0d5f825b7d7c89b48e66cb3f918e433a6b78fc643ddf2315d4edf6a7818
SHA512 c8a01f2aeb6c3a2d3fec555b76672b02c8e3d63e32da43ce6c7806c1e581a8f7c2298cf502bee47c12987ae6d398cd17d324a58dab4a800f31b22c29286616f4

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.ini

MD5 29629e461745f9b94a589cb989072352
SHA1 2169a5670275210b0d0b220d7e07145b26c1c4e5
SHA256 4bee558cc944e693fcc1101bd3d0c92c046875916d14662839bf846d1c54c2eb
SHA512 9fcf37f23bb8e78b0e48152ca0be3ce5e91c82814f47ec0640d47e0b7290aea8fe5d9fff3eafee9e0ac96e94db73888f604da8d484790ac91e7ca7659d6e2ec2

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\ExplorerFrame.dll.txt

MD5 fb244867403b4484d8c02e6d6c97702f
SHA1 4ed79d27ece730a4e783e085849cee7545a49b70
SHA256 9cc3c22fa58cdff447f230016e81769a80398fcb3e43f491a0333d47f40ade6a
SHA512 da3350fe9d71223eb8031138a1b052faa2b713164f37ef764b0eb04f7d88db090d231536b7c51513595760ba7530e37e5b2c09571d8955be25a72e1a81b6e478

C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\ExplorerFrame.dll

MD5 c7a77895796d9a9d43d40a6516f07fa2
SHA1 d854686a91a34243bddd9e88724b3d03eb454372
SHA256 20bebcd9fbf7589404d90cb40a1a181ac31e687c444f35a78e469da2d554261c
SHA512 b87420ef09db9b806a0597722c28ee33cb2ab1ee7930512936a582637ab246c2f42260925346f8205ecadb63ea1a2769d97548185b7bcf3410c5c1388967058b

memory/380-126-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2788-134-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.ini

MD5 0b13c978aab9e33e60a76b9aaa8d07d5
SHA1 b1abd95a6759bf14d7b4e011f79fd4244bcf27ba
SHA256 b7b48fd0063413322c8888f1d02bb9cdcf10956db9bc1c13197d8124eea38c4e
SHA512 b2b1ede5f1f562486f1424051bfd7e12f2089bf77167efc4d6633496c88a54157b5e4bee4364c31d37d6d29dcbc72af8e0344b24efcb5ff52ba97feaeb15c4ea

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\imageres.dll.txt

MD5 5ea5808ce7c72a7f396e3f07f174d98c
SHA1 5f51316aa0f3cf7fedfe03f9e90cd901818b9166
SHA256 629a8fd47c486261a66069aa4bad8d8af227fb9492e630c68f4fef186e3f4809
SHA512 50027015456234f0a855ccdffc56efd2e380e79cf72243035894c282e3b24d579d88aa3b87d8cb3d56ff0dda16383b08cdb5cb14ff43513cd2c26b98b0638f05

C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\imageres.dll

MD5 5e2199b806a530e069afbe9228b8c8a5
SHA1 561736141049d76f76d2c433d27cf1fed451472f
SHA256 b86520c4ef54b8d21e67cdecc085892a482901d36258173d526751edcec17229
SHA512 658c28c14cbadd28c58008ff0b68241c7b14c423aaa2694e72e9ac677065a50118a02e8a8da49d41c0804f4fbfb798cd3df75880845ca0544f55189bb80c3b68

memory/3560-279-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2680-287-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.ini

MD5 0280ea4a2fda0ec71e6d0e3d61d07a82
SHA1 b8e4e270ae3be4bdbc4c6b5be92c9d00897bee71
SHA256 d3bece8fe85a48fb02a6a0e16aa771c12798bbac072a0df621c997e063e51e9f
SHA512 0ec2bc46609769ddef8e8d4f5671fb9224feee62476b0e9ab11f90c15075e3912f90932a543201377810fae148fdfee8e6f0fe5546e24ead21358368379b4e33

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\explorer.exe\explorer.exe.txt

MD5 cd62b160f24f60e84d9e90236bcab04c
SHA1 f63053fe2a00b2508f326954d705af8778d1aa72
SHA256 c6560fb2b8b4868a590ecf95d49f3839f2f228b13470706c14926dac60249e7c
SHA512 751dc90f106362a2289eef2d4f0afb6f7a28108753b54ab035d6af30079c38d80a17d5ee839e9d58cc7270ae831f767bce4145662db4f6064ebb45be7c6d7c38

C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\Explorer.exe

MD5 30decee483a8196b30643ec6a453a7de
SHA1 92266131aff3595c5a95d3aa23c9e40c85d5f982
SHA256 3dc254ad131a691acb1f9e3a5bb5ca5b3ea891869e516f4b3580ea4fcfdf2e76
SHA512 a8f370c060223d4c2985ac16e78547779e584020e95428e85b497464fc487611d7b080908f904c11aa93bc7b56ec102845fbb6554d97dcba7fdc856c93087f00

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\Explorer.exe\ICO_MYCOMPUTER.ico

MD5 a49ed10778732c120098a15005cfc962
SHA1 09c44e75c9d6ef2d0bf4313dee6f5ba7b374dbcc
SHA256 7ee8922252c8fb7e2dc1ddd28be4a6ddb82b873b926290962237458d875a28cd
SHA512 0e23096df2d8283c18ede23e5b5c674bbce79c210968532d07a623b55f6c729dee4fd551dc60205c8b0d2dbf6aff9acde10b8e01edb370a1a33f79a46258b09b

memory/2040-306-0x0000000000400000-0x0000000000502000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\NewFiles\explorer.exe

MD5 8d1b2471a0eeab622534084c10dadb2e
SHA1 3b52cb1a75f1286f3e6ef39ce4fa7879897f6c4b
SHA256 95a97c93cf4e70d143c41855672550d1d134c5087e4accc599fe5d563007bd81
SHA512 882094638535069e9099af924e259e85bf24719950e149bd9d9551d5525090a5ddd6432bc3f0b6bef5f85845add0dd29ec866d3022c9d3f7697749cdbf79800c

memory/4544-315-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.ini

MD5 da3027cf6011d9567200ee54228139fa
SHA1 610b9947b4dc7c924163fad667cecb0e54bfd08a
SHA256 63471d4367da83c1c55ac278b36f9574d337756bbdd3623c96fd6d7b195905ff
SHA512 fb2e2c83bf31106d7d6ee84d763f2ecc24f55fe0dabd0ba7a3b0a476959ef98391eb590f34ccf4f2bb506f55007c08a0f73ac625552ff0ca9fa3ab6955003c17

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\iexplore.exe\iexplore.exe.txt

MD5 193e13a60bedfdf2bf02322b5ece4062
SHA1 7ac06a0581d9d1788d0482a2b6973280e4344371
SHA256 0730f80ae68a0495805641f448990ebe2e4b823118a58eea9f3a497c3d828bb6
SHA512 90bd9cedca4e2ac293b6c0a5030963bfaab7b5e2a746376e7a4d583d35bd8fabe6cc507f11915ca2d9a7a52c88d280889ca322c750998e4bab17aaa19890aafc

C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\iexplore.exe

MD5 5e5f63cd0ca3ee94c61a2db20ce33fc9
SHA1 c90ea9645c7cc1ad7553675a7ecdf880b1fb4621
SHA256 219280ffebd3d771102fc3a7f26529e5e9161366e3a5de2f8943d81dda7756bf
SHA512 b36df698f1cbe52df754db9fcfba7e6811b6fc74f44a89378ce29356630f66a10d526402e9d133f8ab608bb614e2214945c0b732b4db3d0cad3d3665e062edcb

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\iexplore.exe\7.ico

MD5 e158ff87854dc2b1e039b19c47c9c6a2
SHA1 8a1ba99cb204f72843c562c8919b6d8d3f8c5786
SHA256 45a042a33d26ff828df088574a60fad69bf86deecfa16860198382ed22c1594e
SHA512 47dddd0235d1877d183f87e62b30ac21057f85a6cfcc5824993a228107f41b6eec7a4824276f7460a42e66a4e8cfae478444954227be5ecdf305be8e29f4fc28

memory/3440-330-0x0000000000400000-0x0000000000502000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\NewFiles\iexplore.exe

MD5 a028935b0df1c550f7831665d7a32f8c
SHA1 fad5e176c55e061886af9ac74ca5b828264b65e8
SHA256 17d3fae379f8297d9f5bed380eaa97c70569e8f68c1b7188c1131d86dbec4673
SHA512 7fbf646e7fd6c4c64c860b13ffc92e29f152e716de683910082961055a3833e029cf472030919f4a0180290d0a805ae0f302671d0d88a62f1b6544d06c40d26e

memory/748-339-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.ini

MD5 0a361e5c33c5b784ca72b1b0f45ad4c6
SHA1 a0fa482def50dea1410c0fa0ba3097894b981352
SHA256 d9d79f22211680de260a92b50a2714a78208433cf8359aa22c7a8027bfde68ba
SHA512 6f9a25843bab6da01f2b855e83d7444cdfc0015c73cf4525fca67838111e9a3dc6eff4fff236eadd38cf193538e74928388ea4f8218bd2a8cab7d86477c933b6

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\wmplayer.exe\wmplayer.exe.txt

MD5 64067588ad39363a068202ea97847e5f
SHA1 393a3b6a9654da6e96c284dbc4a1f08411002cdd
SHA256 31af57cff84dfa3ef87e2d82d7901029a7170542ac807c7acb70cf80200e1449
SHA512 2857ea0c40078af90f7c23baa876d253a4c20041f0b7698495fd279d4ee164bbd2a1b209dcbac2dd18ebf471193abaaf9a8d1e43243567d469271c5468ce2a71

C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\wmplayer.exe

MD5 a7790328035bbfcf041a6d815f9c28df
SHA1 7ee75c72f50d37b1c69f72f33ba1063e8278b29e
SHA256 6cee4877b6663fc93e94ecc0489834379d2fae6c363eb36035d863733ab7c304
SHA512 125d7e387a90dde64858a9b82e237233f3262f22f47474714d3a3fad193d1cd3bf4823e239b967ae73979bf9492dc15b3d57adbddf91831e5b6aa6b18906aa09

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\wmplayer.exe\IDR_MAINFRAME.ico

MD5 a4d93721f70314fa8f1b8a5e2eea8799
SHA1 daf20653051392c710b03d06bd08518102499bcb
SHA256 665c1f26002e1a13ce80208ea6adebf5726b27267156f77d14370a83964eab8a
SHA512 b29581fd5a6a4385dbf4dd90f6d66ca904dfda93c246874fe71138876276c00def6b2c04a700739a6ecd0f4024c33cac827170d33d9dce0b547d20166762eaf9

memory/2512-354-0x0000000000400000-0x0000000000502000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\NewFiles\wmplayer.exe

MD5 685c95d53468102bbe88c7dbada666df
SHA1 9f516e2fe0196388cf1b1fbab6bcbe19c88d3765
SHA256 53807f92dd33cf423e32398eeb91d53def8b79d7984b92cba07f033c9b6682ca
SHA512 b884ea3437f4d25e3cef208fdc186b17cf2f99fefb85a0326b58f2652bc77dc4bc58f63de909c8c6214813ce5ebf87c146bccc260638ff405fa538b50eb87b4d

memory/1904-363-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroOrange\background.ini

MD5 897b938340df28f4b6644a21e993b5b4
SHA1 2ce7d74e54923fd3c0a9d3b55198c0052e65fb11
SHA256 2f9a65652dcfd86b9a423926171a475d45085ba1447c2a0b553da2c3875043f3
SHA512 9ba3f6635cb2590bda828a88a624083db1c258d5953e82ac13a9134eceb38d8b03f60adb5d2b42479f68f294d400b2422d16784e7bd4c012f996b50eb41f47e6

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroOrange\separator.ini

MD5 d790ef81c98f5e58509753663c555450
SHA1 114b312c07d64f3bb51d58a461a79109751df34d
SHA256 1b5fbb364299f161c9a6ee23d64a611492761c9712e349132915b7717cce77f4
SHA512 460ddca2cd01449cc8312ba08816de256b06bb0c1084a2b7ed57c9afb5e01b6da23e44c4b3f07f7c348cb6a47dc5319cfd3dd83188c3fbbc29d83831920ef5d6

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Milk1\Separator.ini

MD5 61942857b9195d332e8652f327e1fc9a
SHA1 08bc1313f64cc70a4ab1c17729e04a305d536ea2
SHA256 3209912209357823aa3bc1f6fd45e2bcdaaa6b47bbc60233731601d10acb4ef6
SHA512 22323d771b2bf7f61e4a120a750f9c6125d516e01214d12e952a22046fd0326675f0e671b166ac07e73ea0f48db41dbea9ea5586ae662a5d84fa29b9b9ea5c4c

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\ProtoSky\background.ini

MD5 af5ae49010e6ca1f108b805fa8b8b098
SHA1 391b94f97e470e6e45ea32b32a1e3b0a7ab4406a
SHA256 fab2d4d53b491671deb18cb13402a2e26208a533eaaced4a326ff3dc8da79d12
SHA512 a91a9d971b42e0cdac954e663abfeea8495c255201ba7f410d39ea057052550bc7cc20778c154712753324b7306dfed6d07750e265131c3b60ba161900dd6315

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\RocketDock.exe

MD5 7dfccc67990b6de7f30f553a4e4612a4
SHA1 521e9198e3dc1d41fac02eb01fb9f47f6d2a9855
SHA256 9ff98d6fd2539cefc9f42103a7f72388bed6ee590400559b92bc7430228da36a
SHA512 e43038e184a4271633f7925656aa37d14dd67fb606aa18e8e9e18329cf9e71965217bc9687a5e317d0ab97cea40e40f0a72b0cf6d56d5c85cf1e1038e6be30eb

C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\UberIcon.exe

MD5 1f81444a2ac10ffeb46b325a1f916b12
SHA1 d21dc20f7bcdedf85e591a8434b632cdeb268e61
SHA256 648b322ca5eb272dac9ed1df902c6a25988a17f1be0011b47761461b546999db
SHA512 c660cd0a6c29d8a4e462d9aa30baa4f31a94f2ea969d6a60c6424edb63fae1320cc294e17f8d67030dff9bfd160f3f51362bc772200c33ccc0d35e69f6d2d716

C:\Program Files (x86)\Angry Birds Space Skin Pack\SP.exe

MD5 2f260ebb64afda32213668663fd83e70
SHA1 83b221ea59e2c23a9593e71b595241508b7efe17
SHA256 3e2a3388896545f9bea1d556ff6383c67f92404bfd33591988963dfae5fd3e5a
SHA512 87acfdb22a96483ad0ddd990d46d68d01b1b1bf0621b83031fdada219602b0aa91300c362749cd1e13a3ea4ed8f45a3b841c6820f4b446205dbdea39869eef2b

C:\Program Files (x86)\Skin Pack\angry\install.cmd

MD5 04a01b7bb9e5d780194d6729237f5923
SHA1 5a0e5dfebac286abe4cad1d3a99fd6ee99116cd2
SHA256 3a393057c762af5c067ca058924ec5e64921a798aaee2f9bd818d88d50adbdff
SHA512 e24d1dbfd64ec6a0621c3e3fd68d6fedea82603acefc4bc9635bf99278724678f816766d920af66291ab021b37fdeafb94337476e6b8c16a2f5c197943a7b435

memory/2620-825-0x0000000000400000-0x0000000000427000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp

MD5 8708699d2c73bed30a0a08d80f96d6d7
SHA1 684cb9d317146553e8c5269c8afb1539565f4f78
SHA256 a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
SHA512 38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

C:\Program Files (x86)\Skin Pack\refresh icon\ric7.cmd

MD5 747cf038b116aa75f173f8042fdbb7a8
SHA1 d0e6f21765d15661207986db9da2cebd21ef9bd0
SHA256 61ad0a31a74ad1eeb7ed490188a4562c0a1a8ac832bacf467131c2bc0a887dbf
SHA512 87f83dee494a3902db7ea29e2c442927f3391ce0d8021402cdf6d3fe5b42cad9fafcddf762f9fc2eed2cf52d34d5e37c285701fa618292597331ac63d0dd2d40

memory/4768-841-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1008-858-0x0000000000400000-0x0000000000416000-memory.dmp

memory/4832-863-0x0000000000400000-0x0000000000416000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:39

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 992 wrote to memory of 4716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 992 wrote to memory of 4716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 992 wrote to memory of 4716 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4716 -ip 4716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 139.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

98s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3108 wrote to memory of 400 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3108 wrote to memory of 400 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3108 wrote to memory of 400 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 141.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:39

Platform

win7-20240903-en

Max time kernel

118s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 244

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win7-20240708-en

Max time kernel

119s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 224

Network

N/A

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3304 wrote to memory of 3528 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3304 wrote to memory of 3528 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3304 wrote to memory of 3528 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3528 -ip 3528

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 83.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 78.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win7-20240903-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 244

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 224

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:40

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\registry.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2100 wrote to memory of 1992 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1992 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1992 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1992 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1992 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1992 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2100 wrote to memory of 1992 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\registry.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\registry.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

96s

Max time network

144s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\registry.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4740 wrote to memory of 760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4740 wrote to memory of 760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4740 wrote to memory of 760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\registry.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\registry.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 98.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JpgToBmp.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JpgToBmp.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JpgToBmp.exe

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JpgToBmp.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

91s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1068 wrote to memory of 1056 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1068 wrote to memory of 1056 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1068 wrote to memory of 1056 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1056 -ip 1056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 612

Network

Country Destination Domain Proto
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 880 wrote to memory of 540 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 880 wrote to memory of 540 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 880 wrote to memory of 540 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 540 -ip 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 624

Network

Country Destination Domain Proto
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:37

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3160 wrote to memory of 872 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3160 wrote to memory of 872 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3160 wrote to memory of 872 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 872 -ip 872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 636

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:39

Platform

win7-20240903-en

Max time kernel

13s

Max time network

19s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 228

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

97s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3272 wrote to memory of 3596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3272 wrote to memory of 3596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3272 wrote to memory of 3596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3596 -ip 3596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 71.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win7-20240708-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2676 wrote to memory of 2980 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2676 wrote to memory of 2980 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2676 wrote to memory of 2980 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2676 wrote to memory of 2980 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2676 wrote to memory of 2980 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2676 wrote to memory of 2980 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2676 wrote to memory of 2980 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 3328 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3008 wrote to memory of 3328 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3008 wrote to memory of 3328 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 72.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 134.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win7-20240903-en

Max time kernel

119s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 224

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:39

Platform

win7-20240903-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JpgToBmp.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JpgToBmp.exe

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\JpgToBmp.exe"

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe

"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe"

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 78.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

MD5 12341788cbeea061df74e281e568ebde
SHA1 421f17a4a59eede1263bb749ba5a67b43cb4fba7
SHA256 3a0cd378658b6ca19c95025805dabc4072f83917bc66647981aefbc872c25737
SHA512 197ee1f1fcccd00eead1f15b2b7fcd1080af2d0c47e42345d03f27a3530809cfd5813ba96ef9269501c847e0b92d687cbada312dd911bac722cc5928095910ba

C:\Users\Admin\AppData\Local\Temp\nswFB5A.tmp\registry.dll

MD5 1c9523d1c77e5c18d7f1cf3be21c9392
SHA1 f6afd13a7e0585082f64600959c3b31d18e55946
SHA256 d1bd1879f4c1e9a7c3233ba79eb44c93fecb4d3ecdad7b896e4e2e1b14690459
SHA512 52662a37ed0ec9db7a94c245488bf3639e7d2dd76ec28b08415ee93b53489bdf7fc38c1df768033a6a2a2a2571709518e81d66a325f6609d6552442a1aef4c4b

C:\Users\Admin\AppData\Local\Temp\nswFB5A.tmp\nsExec.dll

MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

C:\Users\Admin\AppData\Local\Temp\nswFB5A.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

C:\Users\Admin\AppData\Local\Temp\nswFB5A.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win7-20240708-en

Max time kernel

144s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe"

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\JpgToBmp.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe N/A
N/A N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\uxtheme.dll.tmp C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
File created C:\Windows\SysWOW64\themeui.dll.backup C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
File created C:\Windows\SysWOW64\themeui.dll.tmp C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
File opened for modification C:\Windows\SysWOW64\themeui.dll.tmp C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
File created C:\Windows\SysWOW64\themeui.dll C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
File created C:\Windows\SysWOW64\uxtheme.dll.backup C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
File opened for modification C:\Windows\SysWOW64\uxtheme.dll.backup C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
File opened for modification C:\Windows\SysWOW64\uxtheme.dll.tmp C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
File created C:\Windows\SysWOW64\uxtheme.dll C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Web\\Wallpaper\\angry.bmp" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Inspirat\Separator.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\WhiteCristal\Separator.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Data\About\About.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\34575.bmp C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\5002.bmp C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\Untitled-18.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\Explorer.exe\ICO_MYCOMPUTER.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.ini C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\74.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\iexplore.exe\7.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\190.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\55.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Luminous\Separator.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\ExplorerFrame.dll.txt C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroGrey\bg.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Plugins\Runaway\fx.dll C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1048.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\5034.jpg C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Docklets\Settings.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\LibDocument.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Aero Milk\Aeroglass.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Luminous\Background.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Luminous\Luminous.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1025.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1033.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\1014.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\5024.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\112.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\Explorer.exe\7013.bmp C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Defaults\DefaultSkin\sep.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\UberAPI\exports.def C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\2.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\66.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\explorer.exe C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\IDR_MAINFRAME.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1110.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1045.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\Untitled-3.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Milk1\Background.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\29.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\99.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Icons\186.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1030.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1043.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\3098.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\WhiteCristal\Background.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Plugins\Fly\fx.dll C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\133.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Logs\wmplayer.exe.log C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Languages\1053.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Languages\1025.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\ProtoClay\sep.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Help\English\index.html C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\162.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\Plugins\Break\fx.dll C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\ProtoIron\sep.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroLife\bg.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Brushed\Separator.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Inspirat\Inspirat.png C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\NewFiles\basebrd.dll C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\123.ico C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroGlass\separator.ini C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Media\angry\Windows Hardware Remove.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Information Bar.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Minimize.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Handwriting.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Unavailable.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Battery Low.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Error.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Hardware Fail.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Move.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Logon Sound.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Cross.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Working In Background.ani C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Web\Wallpaper\angry.jpg C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Battery Critical.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Hardware Insert.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Exclamation.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Alternate Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Horizontal Resize.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\Shell\NormalColor\shellstyle.dll C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\Shell\NormalColor\en-US\shellstyle.dll.mui C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\en-US\osituro.msstyles.mui C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Change Theme.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Print complete.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Diagonal Resize 2.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\en-US\ANGRY-BIRDS.msstyles.mui C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Diagonal Resize 1.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Link Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Hardware Insert 2.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Help Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Text Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Vertical Resize.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Web\Wallpaper\angry.bmp C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\JpgToBmp.exe N/A
File created C:\Windows\Media\angry\Windows Balloon.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Feed Discovered.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Start.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Normal Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry\angry.msstyles C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Recycle.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Shutdown.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Navigation Start.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Notify.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Logoff Sound.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Logon.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Ringout.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows User Account Control.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Critical Stop.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Menu Command.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Restore.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Ringin.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\Precision Select.cur C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Cursors\angry\busy.ani C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\resources\Themes\angry.theme C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Pop-up Blocked.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Startup.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
File created C:\Windows\Media\angry\Windows Pop_up Blocked.wav C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\JpgToBmp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\takeown.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\takeown.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\Arrow = "%SYSTEMROOT%\\Cursors\\angry\\Normal Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\Help = "%SYSTEMROOT%\\Cursors\\angry\\Help Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\NWPen = "%SYSTEMROOT%\\Cursors\\angry\\Handwriting.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\SizeAll = "%SYSTEMROOT%\\Cursors\\angry\\Move.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\Wait = "%SYSTEMROOT%\\Cursors\\angry\\Busy.ani" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\No = "%SYSTEMROOT%\\Cursors\\angry\\Unavailable.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\SizeNESW = "%SYSTEMROOT%\\Cursors\\angry\\Diagonal Resize 1.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\Hand = "%SYSTEMROOT%\\Cursors\\angry\\Link Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\SizeNWSE = "%SYSTEMROOT%\\Cursors\\angry\\Diagonal Resize 2.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\UpArrow = "%SYSTEMROOT%\\Cursors\\angry\\Alternate Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\Crosshair = "%SYSTEMROOT%\\Cursors\\angry\\Precision Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\AppStarting = "%SYSTEMROOT%\\Cursors\\angry\\Working In Background.ani" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\SizeWE = "%SYSTEMROOT%\\Cursors\\angry\\Horizontal Resize.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\IBeam = "%SYSTEMROOT%\\Cursors\\angry\\Text Select.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Cursors\SizeNS = "%SYSTEMROOT%\\Cursors\\angry\\Vertical Resize.cur" C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 33 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 34 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 35 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 33 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 34 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 35 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 33 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 34 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A
Token: 35 N/A C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2560 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe
PID 2560 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe
PID 2560 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe
PID 2560 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe
PID 2560 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe
PID 2560 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe
PID 2560 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe
PID 1524 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\takeown.exe
PID 1524 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 1524 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe C:\Windows\SysWOW64\icacls.exe
PID 2560 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 2560 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 2560 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 2560 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 2560 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 2560 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 2560 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe
PID 2560 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 2560 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 2560 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 2560 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 2560 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 2560 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 2560 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe
PID 2560 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe

"C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe" -silent

C:\Windows\SysWOW64\takeown.exe

"C:\Windows\System32\takeown.exe" /f C:\Windows\System32\uxtheme.dll

C:\Windows\SysWOW64\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\uxtheme.dll /grant %username%:F

C:\Windows\SysWOW64\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\uxtheme.dll /grant *S-1-1-0:(F)

C:\Windows\SysWOW64\takeown.exe

"C:\Windows\System32\takeown.exe" /f C:\Windows\System32\themeui.dll

C:\Windows\SysWOW64\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\themeui.dll /grant %username%:F

C:\Windows\SysWOW64\icacls.exe

"C:\Windows\System32\icacls.exe" C:\Windows\System32\themeui.dll /grant *S-1-1-0:(F)

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\basebrd.dll\basebrd.dll.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Windows\Branding\Basebrd\basebrd.dll.xpize" "C:\Windows\Branding\Basebrd\basebrd.dll"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\ExplorerFrame.dll.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Windows\System32\ExplorerFrame.dll.xpize" "C:\Windows\System32\ExplorerFrame.dll"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\imageres.dll\imageres.dll.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Windows\System32\imageres.dll.xpize" "C:\Windows\System32\imageres.dll"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\explorer.exe\explorer.exe.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Windows\explorer.exe.xpize" "C:\Windows\explorer.exe"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\iexplore.exe\iexplore.exe.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Program Files (x86)\Internet Explorer\iexplore.exe.xpize" "C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe" -script "C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\wmplayer.exe\wmplayer.exe.txt"

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Program Files (x86)\Windows Media Player\wmplayer.exe.xpize" "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"

C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\JpgToBmp.exe

C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\JpgToBmp.exe C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\angry.jpg - C:\Windows\Web\Wallpaper\angry.bmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\boot.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Program Files (x86)\Skin Pack\angry\install.cmd" "

C:\Program Files (x86)\Skin Pack\angry\Win7BootUpdaterCmd.exe

Win7BootUpdaterCmd boot.bs7

C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\RIC.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Program Files (x86)\Skin Pack\refresh icon\ric7.cmd" "

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:\Users\Admin\AppData\Local\IconCache.db"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

"C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe" "C:n\AppData\Local\IconCache.db"

Network

Country Destination Domain Proto
US 8.8.8.8:53 installer.filebulldog.com udp
US 54.161.222.85:80 installer.filebulldog.com tcp
US 8.8.8.8:53 www.hugedomains.com udp
US 172.67.70.191:443 www.hugedomains.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.195:80 c.pki.goog tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.117.18:80 crl.microsoft.com tcp
GB 2.19.117.18:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 2.19.169.143:80 www.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\nszAB01.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

\Users\Admin\AppData\Local\Temp\nszAB01.tmp\Banner.dll

MD5 0116a50101c4107a138a588d1e46fca5
SHA1 b781dce23e828cf2b97306661c7dad250a6aaf77
SHA256 ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b
SHA512 55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988

\Users\Admin\AppData\Local\Temp\nszAB01.tmp\inetc.dll

MD5 f02155fa3e59a8fc48a74a236b2bb42e
SHA1 6d76ee8f86fb29f3352c9546250d940f1a476fb8
SHA256 096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999
SHA512 8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399

\Users\Admin\AppData\Local\Temp\nszAB01.tmp\xml.dll

MD5 42df1fbaa87567adf2b4050805a1a545
SHA1 b892a6efbb39b7144248e0c0d79e53da474a9373
SHA256 e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845
SHA512 4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

memory/2560-43-0x0000000002760000-0x0000000002781000-memory.dmp

\Users\Admin\AppData\Local\Temp\nszAB01.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

\Users\Admin\AppData\Local\Temp\nszAB01.tmp\nsExec.dll

MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

\Users\Admin\AppData\Local\Temp\nszAB01.tmp\UXTheme Patcher.exe

MD5 c35efaa15f6f1da888efc247e886389d
SHA1 e3f35519380a564ff62f5ea2fa95fd5bca38bb1a
SHA256 558f6e38c300957234231234c44ccf41217182677e859c9005a51094bdf01794
SHA512 fd3d27271cab60f51929a4e92cccd0ce2edf8c95fd2db6cc957620ff2f7522e644b67862ec7803e6068f5ae75caedad9daae3dafdd4b7f4898c618c8498dca16

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 295bba77e91e7d36accbaf1ade236264
SHA1 04217536c5277432134740fbbe1c0b2a22e70a0d
SHA256 799acdc97099ba43d74301337bc335c05f94d301796ae81632f75f1ef649d17f
SHA512 77f045275fb81d92141862ea52e654a655c0885267c1db52d826b42484ef820405e125a1b55bfa8ceb6bc46b85c649931687402465c2ac847938975878e292f5

C:\Users\Admin\AppData\Local\Temp\Cab1600.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Windows\SysWOW64\uxtheme.dll.tmp

MD5 5791d764ef253b4400b53d15ae6a5c17
SHA1 d197f0ca64552ae0a858582ae94e58aeb2e4a283
SHA256 9771210f4de326d030260c95988f9862e1e93770fb318909adeb3dd7f15882aa
SHA512 96e28598146268fb258da5d0d204103c4056d3b2c56c2584dd631f611ce53e40aa9256146d43b948c29835ab026bbc41d6d275dbf58c1eb3863f52046e01ea21

\Windows\SysWOW64\uxtheme.dll.backup

MD5 43964fa89ccf97ba6be34d69455ac65f
SHA1 391fa4e8020c872311e8a7daf6540687133f9496
SHA256 10e3b89a5470e1bb6f73382135dd2352f5073c1ee8485d7476cfb5122d4aaa2f
SHA512 b87b15bf18b51181971b702a3bec476db263c248f619541d1c8ced30c0d401dfd4b77a5ceb56a0a39e12cf3962b5ac62dbddee7cb5fcdf8d3cf14da898858511

C:\Windows\SysWOW64\themeui.dll.tmp

MD5 1d81652c6689543c4965fb13698400ed
SHA1 9d269c05c7586368946d1755352d52f32ccbd148
SHA256 8d8f9b41d4e26fa65f04fdd18a50926d930b45925a5ae813c0cd72e582c110a8
SHA512 7cc1f5d668c05444eeb0322fabce1a1b0fc3febfecc7c32c255d5989b1d64ebf1535b4b00a340e25788584943f60014bb3f1ff35217de803763365825df5ff06

\Windows\SysWOW64\themeui.dll.backup

MD5 5992a9df57fd5e6960fdcc2db69867f7
SHA1 c5db35169d1ca2db1a8450f49a9aa0a52facdc05
SHA256 9be3a7bedb18ab9399d2b665ee9edc553e63599f51d98a1b43e6aeb0c1e1b166
SHA512 3c118e0d263c85d04bcb0fbd169da859310e5c4f286a215e84b307fcd3944147faa44e24e6c7dfcd0a3ebf0fb09410c421316e18c934ec822d6b74cbab0af34c

\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.exe

MD5 2f92eed4e2061af0961f379e9ded70d6
SHA1 8b58dcd428759d3633a14bcfc62a8cb6deb66de5
SHA256 52cad2ada36a7a4b8d5e653cfe1854d32210ef198561e4cf53ea1c4e5ebbb84f
SHA512 909561ad25f5a4af7360004a6b259bdb70dfad4ced7fe0f39a72ed61f421bc943dce9c7215634ed12284811f36d9a5bae8d1f439412a94bbbd4c24cb4f4962ac

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\basebrd.dll\basebrd.dll.txt

MD5 1a362b7dcdb72a8fd94e6450294b2d67
SHA1 2a246f3e4263bb1080e17c3cc87a66a77f860b65
SHA256 7df9718226c3df5fabc859151e323f1231019085d87862539aa228190c494971
SHA512 156b5bb061b653578986b8b9badb64124fed81ff131325a82cc0139a88ccb5b6e03ee947cdebbae81fef5d39c9d89fcd84f1f4d914967dba16338df5e2af5c19

C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\basebrd.dll

MD5 8188dd3157a5abc5e19069da8950f8ee
SHA1 2de7af5f00ba454b67d8cf32abb1f074928c2641
SHA256 8339cd59ca10e72e0d8cfbdf2eafc666b4a031b9fab99cae4c4078554a220fd7
SHA512 48d556686c12f380ca770e0149bd5c126c8403bced69acb0a47e7170f07bc5f48ae7f751398858ba16b5cba910b81784fdf75a9066cfa22149f4c01c164ca0ce

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\basebrd.dll\120.bmp

MD5 0a5bf200ca0329764f9bcb60a3b3aef9
SHA1 064d06f5c646621db0c7d1140198a113775965a1
SHA256 20bc6163e520ca9bdabe3db730b23497b2ad4fd8b3d4f072daa3219280bea4e8
SHA512 474ed24bd519cbb726811e744230e36e6b8c4fe01387e1516f801191f06715f7d9ee033e3cf65b87d331af6b16475ad92d49cb17a0ee13ba4fee3941a64b7017

memory/2240-149-0x0000000000400000-0x0000000000502000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\MoveEx.exe

MD5 fe1200c71152ec5dabd6d344be3e107c
SHA1 8117734f47727ec915a1c8c31002ccb6f7a96141
SHA256 8d2de2d69cf62cf3206ba785461d33e47e951f7bf14be1a3fa81522149079ddb
SHA512 4b63e9ee57e45854cf9990cebd0ba8ebef0dcb7b141d34744b3d2b3c5f1f440f2a296cee371cc6436f7032a33a1fd2ed3908088251f382caa57ed2d58a317944

\Users\Admin\AppData\Local\Temp\nszAB01.tmp\ExecCmd.dll

MD5 b1d08c24cad3f8f6ccd6b9ebd24d30c0
SHA1 d01549db25d0345c05d3c2eb90b173f937966ce5
SHA256 c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69
SHA512 9cb5735c86cdf8d126268b7b2ec8fafd654d69bdfe5336d54b7d44b5ac8e1174836c487bb4aa40517516a55323bf9f916a96753c8dd2bc9b2d481071c9d9fbf8

C:\Program Files (x86)\Angry Birds Space Skin Pack\NewFiles\basebrd.dll

MD5 1db343e17ffe5e89c0e9b78f309a1aa1
SHA1 0612fd3608a6db36123edf63a59039d85ae6d1bb
SHA256 6aedae4e109a8b6514d4977882bfb2dc28d71e5002c84be0be3fe75e18e8fca2
SHA512 7b3cb1648956c41ae8f60c4ae8baf60122aacc259b090e4b0d24d57b046c199cfeb619336a4d61485a4ae3499e56d00913f517508fa841fed1a679f14c9f53b9

memory/2652-167-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\34582.bmp

MD5 c13fe437d9932aa18bedcea19717088a
SHA1 99c69867a7339acf8041b16493f679a5b39bea27
SHA256 4bb6f0d5f825b7d7c89b48e66cb3f918e433a6b78fc643ddf2315d4edf6a7818
SHA512 c8a01f2aeb6c3a2d3fec555b76672b02c8e3d63e32da43ce6c7806c1e581a8f7c2298cf502bee47c12987ae6d398cd17d324a58dab4a800f31b22c29286616f4

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\ExplorerFrame.dll.txt

MD5 fb244867403b4484d8c02e6d6c97702f
SHA1 4ed79d27ece730a4e783e085849cee7545a49b70
SHA256 9cc3c22fa58cdff447f230016e81769a80398fcb3e43f491a0333d47f40ade6a
SHA512 da3350fe9d71223eb8031138a1b052faa2b713164f37ef764b0eb04f7d88db090d231536b7c51513595760ba7530e37e5b2c09571d8955be25a72e1a81b6e478

C:\Program Files (x86)\Angry Birds Space Skin Pack\Tools\ResHacker.ini

MD5 0b13c978aab9e33e60a76b9aaa8d07d5
SHA1 b1abd95a6759bf14d7b4e011f79fd4244bcf27ba
SHA256 b7b48fd0063413322c8888f1d02bb9cdcf10956db9bc1c13197d8124eea38c4e
SHA512 b2b1ede5f1f562486f1424051bfd7e12f2089bf77167efc4d6633496c88a54157b5e4bee4364c31d37d6d29dcbc72af8e0344b24efcb5ff52ba97feaeb15c4ea

memory/844-226-0x0000000000400000-0x0000000000502000-memory.dmp

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\579.bmp

MD5 c52cc16becf9acc71272203aebb4ddcb
SHA1 a2c2673318bf47c45a4fad4c9c01208f3b6d93ed
SHA256 0878ec0293238e96833cfc449a50ee0655c20ab26d1356e06b67891104273b14
SHA512 1bd16c6f5dabc25478d8ea0cfee1bd7e32dfe6bdf72e09f8ceff7a8a05d87bc5725c7d33b2c33176f316e62807eb2455f84a1717864d139ee128a448ac8a0fce

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\578.bmp

MD5 23264a9510383cce709ec2dd2e2cbe77
SHA1 136fe18e196d5a94bdd5d90024eb3599d36ad6fe
SHA256 5c4053b79095c41d08c3d17fd87326a83642c9f17fab4caeaac09d68d9472dd1
SHA512 74075958d90190497857839adf52fad0f07835e10683b76c75bb1a0db4585c4ca118779e837f729a1f66aaecd2e14066a5e7c7d89d7780166ccbc29075ba146e

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\34581.bmp

MD5 cbba584ab0ee4ada134e672cdc77e8cb
SHA1 04287f8238dfbbe4e6732ab2304907ba99947272
SHA256 8c196e937b3b3296ca95498cc2672c8e979cc2b6e34cef0c01079cb49836ed13
SHA512 8738e86a696af8a067a863f075a918f580519cacaa992446f4692c65aad79301f61f3b910c68318b1f285fbecbadd901bb8e243abd92b8dfecbbfc8738093cb4

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\34562.bmp

MD5 89d8dfeeabedf5ca47b5a77c732318bf
SHA1 edaa35b1ef85fa08159a93dace8021cb23003835
SHA256 451c19118f3610c33a616464a0dc86e5cb3a7a875ca7c21d9a53b50ca3094a3e
SHA512 b9599caab08290582090016ca366dacc63577ac8e263a0bce1809b6de6c414a61c05a4f3be95b11d53ae004c275d737bf5d538b2fb767e6ea49c83e0c4ff3c03

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\34560.bmp

MD5 1781dc4e61283fa07a043009dfb28c53
SHA1 25958f184bd0f823b93945e02bbd417766bd4b02
SHA256 84726fbb487b91487a7ca847be235ee3903e3a3f03c4d6582b0346328a803f70
SHA512 02c953fc6a839cd82c9f45247121d48c2fc504890db5ff199b47173026f754f16c602d880d250a8f74c40e2a0272faaaff2d19f55362f0a93fb793045e8802ca

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\294.bmp

MD5 712544ab85100572c4a4b4da6b16c10c
SHA1 f996d28d167073f36f3a1919e6776ea6aa04b45e
SHA256 8c2bbb8ce516ef49891e5ab149bfbfbea6d5b91c35add7903a105b31b1254b8d
SHA512 b1d50d02cd85475477b806fc229e6d4036b46a72c28875698cf598e0f2a9be32c7e946563e8c6b6b344b821918864afd0ab91941521fa226ac2088e2966e54ec

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\291.bmp

MD5 b7848a09823bbbec45a88835a8590e96
SHA1 ee23f9707594c867bd6bf2c3735cf9283d0f9588
SHA256 814d4f71fbf267152b696e850e57a292e8b34c672e1359a9178364fa15361fdc
SHA512 04e7de2ce0b1c8bc20ce56203fcd6e91394aeaa125453503d6a6c5d6abb6f6620734b38fced75650a18455daae9fae65d9ce204734d32c280cb42f80376ba51e

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\288.bmp

MD5 3439d92b83ca6978f4c8ab0d47f2cee2
SHA1 f0f186530f44f80c57c8e2987c1627f70f8632f7
SHA256 aa867999215ae1fb9847602a55525d42c3f5992accb676c9a8dfcac7d9043a33
SHA512 9f50796db5def192c5e62215e3cd4b3c9d73a3ca962076fd58cbc77a8b1b9466bc171d0c6d850af2a61f82edd926aca62af5cd7deaf2ecf01641d3e456782362

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\281.bmp

MD5 9baf436205a9dfb0ec41c39ec09c1e86
SHA1 b83872dcfc7c798372335d29786bb7948090a270
SHA256 14f1d28950f48752eaaa9ec69a1dc9bdc90be76cb7cdf409ae67f8113a91baa6
SHA512 a4132008c10b18427a1a2c8cf0a4d87f9fc66a9fe7c1980f506c981637f6f708062c4266ef58915e50cd62bb3ec9353521b837ea5ef6d50804045fde331acb2d

C:\Program Files (x86)\Angry Birds Space Skin Pack\Resources\ExplorerFrame.dll\280.bmp

MD5 106e11f3809c0c3c14ee67e9385e2af4
SHA1 5cdbe82878773f6ca950fc5e270c363e3b22f7b7
SHA256 5012f63fcc303890d29ae9a62f0b4d168db76b02f47099b94314f1519e4de9fe
SHA512 d1a049721d3636ab236670cf8e1a78dd6756c02e0a96f83874bd1107497c618786d5c735ea9b7721874292e2ee16c8ca9a119027ab57ccfedf5e32f82e08ad06

C:\Program Files (x86)\Angry Birds Space Skin Pack\Backup\ExplorerFrame.dll

MD5 e2a17bcc08d92f42e08af6ba2f93aba7
SHA1 9802117508c7b0a2d5663d066ec173031eb60786
SHA256 5fc9d47bf4b1094becc0c0ddcd5cd4318dd3e4495d982f8785331616d5b82599
SHA512 f5a7a616b13d3e44402d0fd7b7376d29ebce81795299a39171b80a6cd471d395d86cdd18a75bc6fe0bb316db2d39e73056e1abc9e82d2ff4fafdcfef92704375

memory/1748-230-0x0000000000400000-0x0000000000416000-memory.dmp

memory/2944-372-0x0000000000400000-0x0000000000502000-memory.dmp

memory/1344-376-0x0000000000400000-0x0000000000416000-memory.dmp

memory/2948-390-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2684-394-0x0000000000400000-0x0000000000416000-memory.dmp

memory/1856-404-0x0000000000400000-0x0000000000502000-memory.dmp

memory/1796-408-0x0000000000400000-0x0000000000416000-memory.dmp

memory/2424-418-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2108-422-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nszAB01.tmp\JpgToBmp.exe

MD5 a3e8696c93ad86d6b76a455e9d04582f
SHA1 17368dc01a16b6a67663c1900575aa96f5e170ba
SHA256 cce22a24171bca94741e8e5aed408b8abf33f20a27c6fe8696947285e7e7da70
SHA512 85de5fcdc530c787aae8aa9ef3a0c27f22ac65dd8ca066e71859b417d141cf49d4013fc05b008cd49dad66a90f23efcd8bd37bc7360c6873171e334cbb7ce30c

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroOrange\background.ini

MD5 897b938340df28f4b6644a21e993b5b4
SHA1 2ce7d74e54923fd3c0a9d3b55198c0052e65fb11
SHA256 2f9a65652dcfd86b9a423926171a475d45085ba1447c2a0b553da2c3875043f3
SHA512 9ba3f6635cb2590bda828a88a624083db1c258d5953e82ac13a9134eceb38d8b03f60adb5d2b42479f68f294d400b2422d16784e7bd4c012f996b50eb41f47e6

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\AstroOrange\separator.ini

MD5 d790ef81c98f5e58509753663c555450
SHA1 114b312c07d64f3bb51d58a461a79109751df34d
SHA256 1b5fbb364299f161c9a6ee23d64a611492761c9712e349132915b7717cce77f4
SHA512 460ddca2cd01449cc8312ba08816de256b06bb0c1084a2b7ed57c9afb5e01b6da23e44c4b3f07f7c348cb6a47dc5319cfd3dd83188c3fbbc29d83831920ef5d6

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\Milk1\Separator.ini

MD5 61942857b9195d332e8652f327e1fc9a
SHA1 08bc1313f64cc70a4ab1c17729e04a305d536ea2
SHA256 3209912209357823aa3bc1f6fd45e2bcdaaa6b47bbc60233731601d10acb4ef6
SHA512 22323d771b2bf7f61e4a120a750f9c6125d516e01214d12e952a22046fd0326675f0e671b166ac07e73ea0f48db41dbea9ea5586ae662a5d84fa29b9b9ea5c4c

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\Skins\ProtoSky\background.ini

MD5 af5ae49010e6ca1f108b805fa8b8b098
SHA1 391b94f97e470e6e45ea32b32a1e3b0a7ab4406a
SHA256 fab2d4d53b491671deb18cb13402a2e26208a533eaaced4a326ff3dc8da79d12
SHA512 a91a9d971b42e0cdac954e663abfeea8495c255201ba7f410d39ea057052550bc7cc20778c154712753324b7306dfed6d07750e265131c3b60ba161900dd6315

C:\Program Files (x86)\Angry Birds Space Skin Pack\RocketDock\RocketDock.exe

MD5 7dfccc67990b6de7f30f553a4e4612a4
SHA1 521e9198e3dc1d41fac02eb01fb9f47f6d2a9855
SHA256 9ff98d6fd2539cefc9f42103a7f72388bed6ee590400559b92bc7430228da36a
SHA512 e43038e184a4271633f7925656aa37d14dd67fb606aa18e8e9e18329cf9e71965217bc9687a5e317d0ab97cea40e40f0a72b0cf6d56d5c85cf1e1038e6be30eb

C:\Program Files (x86)\Angry Birds Space Skin Pack\UberIcon\UberIcon.exe

MD5 1f81444a2ac10ffeb46b325a1f916b12
SHA1 d21dc20f7bcdedf85e591a8434b632cdeb268e61
SHA256 648b322ca5eb272dac9ed1df902c6a25988a17f1be0011b47761461b546999db
SHA512 c660cd0a6c29d8a4e462d9aa30baa4f31a94f2ea969d6a60c6424edb63fae1320cc294e17f8d67030dff9bfd160f3f51362bc772200c33ccc0d35e69f6d2d716

C:\Program Files (x86)\Angry Birds Space Skin Pack\SP.exe

MD5 2f260ebb64afda32213668663fd83e70
SHA1 83b221ea59e2c23a9593e71b595241508b7efe17
SHA256 3e2a3388896545f9bea1d556ff6383c67f92404bfd33591988963dfae5fd3e5a
SHA512 87acfdb22a96483ad0ddd990d46d68d01b1b1bf0621b83031fdada219602b0aa91300c362749cd1e13a3ea4ed8f45a3b841c6820f4b446205dbdea39869eef2b

C:\Program Files (x86)\Skin Pack\angry\install.cmd

MD5 04a01b7bb9e5d780194d6729237f5923
SHA1 5a0e5dfebac286abe4cad1d3a99fd6ee99116cd2
SHA256 3a393057c762af5c067ca058924ec5e64921a798aaee2f9bd818d88d50adbdff
SHA512 e24d1dbfd64ec6a0621c3e3fd68d6fedea82603acefc4bc9635bf99278724678f816766d920af66291ab021b37fdeafb94337476e6b8c16a2f5c197943a7b435

memory/1976-900-0x0000000000400000-0x0000000000427000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp

MD5 8708699d2c73bed30a0a08d80f96d6d7
SHA1 684cb9d317146553e8c5269c8afb1539565f4f78
SHA256 a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
SHA512 38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

C:\Program Files (x86)\Skin Pack\refresh icon\ric7.cmd

MD5 747cf038b116aa75f173f8042fdbb7a8
SHA1 d0e6f21765d15661207986db9da2cebd21ef9bd0
SHA256 61ad0a31a74ad1eeb7ed490188a4562c0a1a8ac832bacf467131c2bc0a887dbf
SHA512 87f83dee494a3902db7ea29e2c442927f3391ce0d8021402cdf6d3fe5b42cad9fafcddf762f9fc2eed2cf52d34d5e37c285701fa618292597331ac63d0dd2d40

memory/2844-922-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2196-943-0x0000000000400000-0x0000000000416000-memory.dmp

memory/1952-947-0x0000000000400000-0x0000000000416000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:37

Platform

win10v2004-20241007-en

Max time kernel

90s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4256 wrote to memory of 2432 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4256 wrote to memory of 2432 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4256 wrote to memory of 2432 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecCmd.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2432 -ip 2432

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:39

Platform

win7-20240903-en

Max time kernel

119s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 224

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:39

Platform

win7-20240903-en

Max time kernel

121s

Max time network

124s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 236

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:39

Platform

win7-20240903-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 340 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
PID 340 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
PID 340 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
PID 340 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
PID 340 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
PID 340 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
PID 340 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Processes

C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe

"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\uninst.exe"

C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Angry Birds Space Skin Pack\$PROGRAMFILES\Angry Birds Space Skin Pack\

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

MD5 12341788cbeea061df74e281e568ebde
SHA1 421f17a4a59eede1263bb749ba5a67b43cb4fba7
SHA256 3a0cd378658b6ca19c95025805dabc4072f83917bc66647981aefbc872c25737
SHA512 197ee1f1fcccd00eead1f15b2b7fcd1080af2d0c47e42345d03f27a3530809cfd5813ba96ef9269501c847e0b92d687cbada312dd911bac722cc5928095910ba

\Users\Admin\AppData\Local\Temp\nstC0E1.tmp\registry.dll

MD5 1c9523d1c77e5c18d7f1cf3be21c9392
SHA1 f6afd13a7e0585082f64600959c3b31d18e55946
SHA256 d1bd1879f4c1e9a7c3233ba79eb44c93fecb4d3ecdad7b896e4e2e1b14690459
SHA512 52662a37ed0ec9db7a94c245488bf3639e7d2dd76ec28b08415ee93b53489bdf7fc38c1df768033a6a2a2a2571709518e81d66a325f6609d6552442a1aef4c4b

\Users\Admin\AppData\Local\Temp\nstC0E1.tmp\nsExec.dll

MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

\Users\Admin\AppData\Local\Temp\nstC0E1.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

\Users\Admin\AppData\Local\Temp\nstC0E1.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Analysis: behavioral12

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:37

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe

"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UXTheme Patcher.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 71.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:38

Platform

win7-20240903-en

Max time kernel

118s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 224

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-10-09 06:39

Reported

2024-10-09 17:39

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2880 wrote to memory of 2204 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2880 wrote to memory of 2204 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2880 wrote to memory of 2204 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2204 -ip 2204

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 25.73.42.20.in-addr.arpa udp

Files

N/A