e67880d34ceffd7ab0e9028428dbd8431525c9ca03efbd54971b1f23e3af0807

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37135ac9980c76161cb0726319b6967b_JaffaCakes118.exe
Size

2.4MB
MD5

37135ac9980c76161cb0726319b6967b
SHA1

a87324b9d3918e90638d7563bbb83bcc507ec4f9
SHA256

e67880d34ceffd7ab0e9028428dbd8431525c9ca03efbd54971b1f23e3af0807
SHA512

4419e99996a0cfb733ea7fd7c26609de31c4e92e25dc29b1327c80d614120f1d4d31838a4b0f66e88becb0390180e94da4889a44cdfd4f22ff2d57c2a0af39b5
SSDEEP

49152:3l1SW/Z9qQAoe1NZ6xCi4B7ySm+vmSIOQzeMR7zZHFRYptebA5rOYiZnr:iKgo6NZ64i4oSfSKy1H/uebSivZnr

Score

8^/10

adware discovery persistence privilege_escalation stealer

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET1A69.tmp	RUNDLL32.EXE
File created	C:\Windows\system32\DRIVERS\SET1A69.tmp	RUNDLL32.EXE
File opened for modification	C:\Windows\system32\DRIVERS\tbrdrv.sys	RUNDLL32.EXE

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Inbox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Inbox.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
4356	Inbox.exe
1220	Inbox.exe
1728	Inbox.exe
336	Inbox.exe
1408	AGupdate.exe
2184	AGupdate.exe
2268	AGupdate.exe
1488	Inbox.exe

Loads dropped DLL 8 IoCs

pid	Process
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
4060	regsvr32.exe
4060	regsvr32.exe
4384	regsvr32.exe
4384	regsvr32.exe
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\InboxToolbar = "\"C:\\Program Files (x86)\\Inbox Toolbar\\Inbox.exe\" /STARTUP"	Inbox.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\NoExplorer = "1"	regsvr32.exe

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Inbox Toolbar\unins000.msg	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Driver\driver.cab	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_dictionary_br.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_history_br.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Driver\tbrdrv.cat	Inbox.exe
File created	C:\Program Files (x86)\Inbox Toolbar\is-LG5FG.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\setupcfg.ini	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-R589P.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\blue_green.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_search_br.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\uninstall.ini	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Driver\tbrdrv.inf	Inbox.exe
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-8V928.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-D6EUV.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\is-CRNCQ.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-1QM4L.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\setupcfg.ini	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\uninstall.ini	Inbox.exe
File created	C:\Program Files (x86)\Inbox Toolbar\unins000.dat	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\is-HINSN.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\unins000.dat	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_encyclopedia_br.xml	Inbox.exe
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Inbox.ini	Inbox.exe
File created	C:\Program Files (x86)\Inbox Toolbar\is-V4GF5.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-8UAT7.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File created	C:\Program Files (x86)\Inbox Toolbar\is-R60QF.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Driver\tbrdrv.sys	Inbox.exe
File created	C:\Program Files (x86)\Inbox Toolbar\Buttons\is-THJH2.tmp	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
File opened for modification	C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_translator_br.xml	Inbox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AGupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AGupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AGupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inbox.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37135ac9980c76161cb0726319b6967b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\DisplayName = "Inbox Search"	Inbox.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main\	Inbox.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BB3B306B-881E-11EF-A4B7-468C69F2ED48} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{C04B7D22-5AEC-4561-8F49-27F6269208F6}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2408531360"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}\AppName = "Inbox.exe"	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Policy = "3"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Approved Extensions	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1"	Inbox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} = 51667a6c4c1d3b357562fbcbb8c7820485dd6eeb1d1100f3	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppName = "Inbox64.dll"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000028e76085f1f7640a0643881d549bbfc00000000020000000000106600000001000020000000ed6e17d01508b6ac849b6ebd79ce99f78ac13c6b33e16dba17890c0621ac756e000000000e800000000200002000000050a4886f1360bbc8c5340441d5047cc91e5963fd6edf418570578fe2125d0a6d10000000cf157147feb648fa42edf482836994ad400000003d88a4b631903d3acf5046d015345d1cded2ffbc48d68d52a7ee0ecd71c3f6ede56605caf4bed9f7adde350130a982d3ec8a43e191e95d2e64d863cdfc3bd00b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppName = "Inbox64.dll"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Policy = "3"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\SearchScopes\	Inbox.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31136811"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\IESettingSync	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}\AppName = "Inbox.exe"	Inbox.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} = 00	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Policy = "3"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\FaviconURLFallback = "http://www2.inbox.com/favicon.ico"	Inbox.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}	Inbox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\URLSearchHooks	Inbox.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ShowSearchSuggestions = "1"	Inbox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{C04B7D22-5AEC-4561-8F49-27F6269208F6}.ico"	Inbox.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main	Inbox.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435450078"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2408531360"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}\AppPath = "C:\\Program Files (x86)\\Inbox Toolbar"	Inbox.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\IEWatsonEnabled = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppPath = "C:\\Program Files (x86)\\Inbox Toolbar"	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{D3D233D5-9F6D-436C-B6C7-E63F77503B30} = 51667a6c4c1d3b35c529c0cf5ac90a06afcaad7f7616772b	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31136811"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000028e76085f1f7640a0643881d549bbfc0000000002000000000010660000000100002000000095ad065eace6bf772c42bf4bc9929db6b478b386f4a93ded0a2269df5fac0c57000000000e8000000002000020000000d23b56cbaa58d8eeb590c3803c6cac3f7a46dace04858b393fede55b315899c04001000077e80f960bc48111e7115c9f00d4ed6c9e9b83256ff77d325f48ade77116e9a5aee020d1b28547a3c39b97f39f659caff7954ec62a8943699f5fefd00fb167852af5ab8936472f9ea91aa41289f282f4bc9ada56db6cb884d27b7e0ddc826a56b26e2343af2deb7390f8fa905c0e02e0feb75d6ca36846e5d21c6282f251e92b63d282b734ec9fdca648df4ea4ef0f928ddd82e4d37a9f79594b658875f27694a4ddb71179e184c19f9599ad36a2eea212bf203d15669a47a75439d06a317bfb73d18737e8cb2bb8522ee8eaebfa6c13c93a14a787a1cae48edb4588c61ac3ced2c996cd3cf9f6b66ae27be4d554bdc2687c47a237bb52e896a8415282cab6faed4d3909fcd2c1f7da125c7c5d603f9ca60953a154891cd8c4d15f8e674c402f5fcc816e78b92b5b6a7a0fc17fe628e57dc036da4c76db56663b1e6a135750a4400000004cac315558dcef92ee7b3a551459f0e7728bc2de5c5a0eb6d51494c908631641103ced222e9330efec6d1fcb87218bfff31214b0c18e2f480868de11e92e349c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Approved Extensions	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\AppName = "Inbox.dll"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IEWatsonEnabled = "0"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30796a902b1cdb01	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}	Inbox.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.inbox.com/homepage.aspx?tbid=80389&iwk=846&lng=en"	Inbox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7C55C60-F5B5-40A3-A2E9-EC00E1FE08F3}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.JSServer2\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.Toolbar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Implemented Categories\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}\TypeLib\ = "{CBEF8724-D080-4737-88DA-111EEC6651AA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E56FAFA-1B09-480E-B653-4B23918DC58A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\ = "&Inbox Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.JSServer2\Clsid\ = "{C7C55C60-F5B5-40A3-A2E9-EC00E1FE08F3}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}\ = "IJSServer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E56FAFA-1B09-480E-B653-4B23918DC58A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{042DA63B-0933-403D-9395-B49307691690}\Implemented Categories\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\inbox\ = "inbox"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FAE973C-3FE3-44BF-81F0-ADB0D42CE851}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7C55C60-F5B5-40A3-A2E9-EC00E1FE08F3}\InprocServer32\ = "C:\\PROGRA~2\\INBOXT~1\\Inbox.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.JSServer\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Inbox Toolbar\\"	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.JSServer2\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.JSServer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7C55C60-F5B5-40A3-A2E9-EC00E1FE08F3}\InprocServer32\ = "C:\\Program Files (x86)\\Inbox Toolbar\\Inbox64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}\InprocServer32\ = "C:\\PROGRA~2\\INBOXT~1\\Inbox64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}\1.0\ = "Inbox"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}\TypeLib	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\ProgID\ = "Inbox.IBX404"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7C55C60-F5B5-40A3-A2E9-EC00E1FE08F3}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\InprocServer32\ = "C:\\Program Files (x86)\\Inbox Toolbar\\Inbox.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.IBX404\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.JSServer2	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.Toolbar\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7C55C60-F5B5-40A3-A2E9-EC00E1FE08F3}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FAE973C-3FE3-44BF-81F0-ADB0D42CE851}\TypeLib\Version = "1.0"	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FAE973C-3FE3-44BF-81F0-ADB0D42CE851}	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CBEF8724-D080-4737-88DA-111EEC6651AA}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\ = "Inbox Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.Toolbar\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.Toolbar\Clsid\ = "{D7E97865-918F-41E4-9CD0-25AB1C574CE8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7C55C60-F5B5-40A3-A2E9-EC00E1FE08F3}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\ = "&Inbox Toolbar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}\1.0\0\win32\ = "C:\\Program Files (x86)\\Inbox Toolbar\\Inbox.exe"	Inbox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Inbox.JSServer\Clsid\ = "{042DA63B-0933-403D-9395-B49307691690}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{042DA63B-0933-403D-9395-B49307691690}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{615E8AA1-6BB8-4A3D-A1CC-373194DB612C}\1.0\FLAGS	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612AD33D-9824-4E87-8396-92374E91C4BB}\LocalServer32	Inbox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7C55C60-F5B5-40A3-A2E9-EC00E1FE08F3}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E56FAFA-1B09-480E-B653-4B23918DC58A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}\ProgID	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
336	Inbox.exe
336	Inbox.exe
2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
336	Inbox.exe
1496	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
336	Inbox.exe
336	Inbox.exe
336	Inbox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1496	iexplore.exe
1496	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2760	2152	37135ac9980c76161cb0726319b6967b_JaffaCakes118.exe	84
PID 2152 wrote to memory of 2760	2152	37135ac9980c76161cb0726319b6967b_JaffaCakes118.exe	84
PID 2152 wrote to memory of 2760	2152	37135ac9980c76161cb0726319b6967b_JaffaCakes118.exe	84
PID 2760 wrote to memory of 4356	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	87
PID 2760 wrote to memory of 4356	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	87
PID 2760 wrote to memory of 4356	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	87
PID 2760 wrote to memory of 1220	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	88
PID 2760 wrote to memory of 1220	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	88
PID 2760 wrote to memory of 1220	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	88
PID 2760 wrote to memory of 4060	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	89
PID 2760 wrote to memory of 4060	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	89
PID 2760 wrote to memory of 4060	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	89
PID 2760 wrote to memory of 4384	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	90
PID 2760 wrote to memory of 4384	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	90
PID 2760 wrote to memory of 1728	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	93
PID 2760 wrote to memory of 1728	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	93
PID 2760 wrote to memory of 1728	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	93
PID 1728 wrote to memory of 3368	1728	Inbox.exe	94
PID 1728 wrote to memory of 3368	1728	Inbox.exe	94
PID 3368 wrote to memory of 2268	3368	RUNDLL32.EXE	96
PID 3368 wrote to memory of 2268	3368	RUNDLL32.EXE	96
PID 2268 wrote to memory of 2500	2268	runonce.exe	97
PID 2268 wrote to memory of 2500	2268	runonce.exe	97
PID 1728 wrote to memory of 336	1728	Inbox.exe	99
PID 1728 wrote to memory of 336	1728	Inbox.exe	99
PID 1728 wrote to memory of 336	1728	Inbox.exe	99
PID 2760 wrote to memory of 1408	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	102
PID 2760 wrote to memory of 1408	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	102
PID 2760 wrote to memory of 1408	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	102
PID 2760 wrote to memory of 2184	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	103
PID 2760 wrote to memory of 2184	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	103
PID 2760 wrote to memory of 2184	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	103
PID 2760 wrote to memory of 2268	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	104
PID 2760 wrote to memory of 2268	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	104
PID 2760 wrote to memory of 2268	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	104
PID 2760 wrote to memory of 1488	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	105
PID 2760 wrote to memory of 1488	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	105
PID 2760 wrote to memory of 1488	2760	37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp	105
PID 1488 wrote to memory of 1496	1488	Inbox.exe	106
PID 1488 wrote to memory of 1496	1488	Inbox.exe	106
PID 1496 wrote to memory of 2116	1496	iexplore.exe	107
PID 1496 wrote to memory of 2116	1496	iexplore.exe	107
PID 1496 wrote to memory of 2116	1496	iexplore.exe	107

C:\Users\Admin\AppData\Local\Temp\37135ac9980c76161cb0726319b6967b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37135ac9980c76161cb0726319b6967b_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\is-PC0DF.tmp\37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PC0DF.tmp\37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp" /SL5="$6021A,1824239,70144,C:\Users\Admin\AppData\Local\Temp\37135ac9980c76161cb0726319b6967b_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
    "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /regserver
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:4356
- - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
    "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /install
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:1220
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Inbox Toolbar\Inbox.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:4060
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Inbox Toolbar\Inbox64.dll"
    3⤵
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:4384
- - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
    "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /afterinstall
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\system32\RUNDLL32.EXE
      "C:\Windows\sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\PROGRA~2\INBOXT~1\Driver\tbrdrv.inf
      4⤵
      Drops file in Drivers directory
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3368
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:2268
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:2500
  - - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
      "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /TRAY 0
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:336
- - C:\Users\Admin\AppData\Local\Temp\is-Q9IBI.tmp\AGupdate.exe
    "C:\Users\Admin\AppData\Local\Temp\is-Q9IBI.tmp\AGupdate.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\is-Q9IBI.tmp\AGupdate.exe
    "C:\Users\Admin\AppData\Local\Temp\is-Q9IBI.tmp\AGupdate.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\is-Q9IBI.tmp\AGupdate.exe
    "C:\Users\Admin\AppData\Local\Temp\is-Q9IBI.tmp\AGupdate.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2268
- - C:\Program Files (x86)\Inbox Toolbar\Inbox.exe
    "C:\Program Files (x86)\Inbox Toolbar\Inbox.exe" /postinstall
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -noframemerging "http://toolbar.inbox.com/lp/inst.aspx?tname=Translators&c=4&tbid=80389&iwk=846&addons=1&addonlist=&afa=3&lng=en"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1496
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1496 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Inbox Toolbar\Buttons\blue_green.xml

Filesize
52KB

MD5
73ae8ec141d41888f4f4efc96e3158aa

SHA1
ed00518da7d76b725af71e493026e1645f33a9f9

SHA256
3b18558a9b1f02bc5724b37c128389804f89a6aee5f9b9b484e94d0548057110

SHA512
95adef46aef2529a9f33050a88dde6a8217e88f4ae6246ffc2f9fbdf985bd1bef1b505561a8bf10ddef376ecb340e632994be127f5a7b36f60bc0b4642cd0108

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_dictionary_br.xml

Filesize
5KB

MD5
a68075fa8f8c2312da27ddcc6e70a9de

SHA1
d11fbfaaa9450991ec9e8b70ebb7051de4ba239d

SHA256
bef21899bffe2bcaa0df4fc33906139b04cb7a02c97dc46e7c71b76cc0ccb3f1

SHA512
1cccca0ccb85311a783fbb19b38a78b3efd164df8e05d38f3e45d2baf279435f9db41da9bd29cf672b586d1d1b5aa3e0ad721b13d9a0a52381cd63bfa7176320

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_encyclopedia_br.xml

Filesize
5KB

MD5
d48b7a2bf23cad2e3c86e5336c6f03fe

SHA1
d5b1d477851bffd24ee65e60166985c08bf960c2

SHA256
80ce55abf5a8f9c92e65279e456844bccba09141b7b0e22b8c51288766f8f854

SHA512
0cffe8464b6022c5d803b405dfcb21b21ccba5a93401c71875ba2dbd7ffd0e51e1c56afe32fe95bab243edf3a6bbdb166374bb75531ecd73f3c1f63f1f79b40b

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_history_br.xml

Filesize
4KB

MD5
255d2cd2ffbf0e0dcd5a7555d293ddc5

SHA1
b19d386ca76b35fba2597ca8baa962e5986440a2

SHA256
132e6e7c5b3b12bdecfbf82eced716d4a0342e2ff21727cd5190af3d159c74b6

SHA512
80c898b1b119fbbe9861a8a385f50dd74acdaef182ad7b39379c1273fc787306d7cf02107e303cc5dd0253b41a1d7d8140420025fd88be698bdbdbf24dbe2e65

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_search_br.xml

Filesize
4KB

MD5
0b68802d3253068df66f23dfe7b93e0a

SHA1
be2e8050748d75eb95a7bc8257982f81ee8a2b2b

SHA256
8b0707feece3adff817442357f5c5a6aab64a3d91de8362dfa0e95ab194330b2

SHA512
51ebff472aef81b9808c32d1bb1db3153d5e7d1fa46ab5bb36c75171fbda952d0acf36aea3daf4d80d671739e5a0fd94ca301004f0de434443116139af2f0943

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Buttons\reference_translator_br.xml

Filesize
5KB

MD5
1c9297aa0ea4b67845686a49c8b486ef

SHA1
aa42a24a47ebecac0afeebdcfbd89a8e8b727e87

SHA256
b63d238162d4b21bf557a1c1597a4f948d27b5414b8a984c0aa5539648478dbe

SHA512
8c8ba090ddfdaf49268b34b7ddac9bbeacd699f521d2897f17539f2aa8e16927dfcdb2613c546d972b6da9c23a72edc153bc0c11c13dc577c09938752707c122

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Driver\tbrdrv.cat

Filesize
7KB

MD5
dacf44f0b690f4c0053d31535fef87f2

SHA1
d2318c6c771a4adddd507c2fa6aa7d81ebc7aca6

SHA256
9175d7ad0f699049214a066e3b7672036a64354fbd88b002fb34f1d8c583d334

SHA512
60c7e1f3fa5c5515907b4e2702b0ffc1f32129fc92c75653ab7591745d78f7fa59b0a6c505b21cedb36151d4ca4a0fa1b90f09f8d267f7c9bd91a9605a87b7ce

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Driver\tbrdrv.inf

Filesize
1KB

MD5
c84b4baaa44b8989b2e76b42c1ab5301

SHA1
36ee3212aec954e82fd73c914717c7ad32cfc367

SHA256
94ecff1e1ce8d5d5ef349769ee4236d230a7f58dfbd0a7d32ebf84c2b41fcec8

SHA512
230bab43937d5ec8600882b2ca6249b07fc580fea5b1c8817ede28fae6566bc78fb8f2088dc4dea0997e217c94659063dc3d2adff0405944b427d325ebe373a7

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Driver\tbrdrv.sys

Filesize
35KB

MD5
e7c0aac166d688ab41dff2f17e420a3a

SHA1
00b70a50af14b497cebd100344fafbd3a564fd5b

SHA256
babb144ed6471079b6922914646a110f9fe5588ca3d94deeeda584c484e4ed26

SHA512
fe539d89e28204b1d09607e9f0450ae619ff71efdfccb4597641a27cb3234fce1a2061e273bd8490c9bf15d19871aa93c1bf98c909b6c252549c40915d62721e

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox.dll

Filesize
1014KB

MD5
d673907569a04e0b0475f3040cf566e2

SHA1
b592a76de20a34d4df1d2a00e8f77dcc85b411db

SHA256
4da6045ad6a2cc08bfd06f1b0b72609c4bbb3e07807eb3d2b4599cbe024165fe

SHA512
897b531b67f92498980d72a1764ef43384db7d3e8076927624eec4144eb625416f34a17fb5c759620e20820969951033e3d7eba45ae81bf9d6e917eaa6b05f27

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox.exe

Filesize
2.3MB

MD5
b9a8c8345079aae42ecf0ad2177975f7

SHA1
2137855a12bd99604fe8fcd30e90c83ee245aa29

SHA256
cd40b98ef96ce492251eb58e30a3524f276b63998475c21599a3b7f1981405fc

SHA512
68408a3e91c8720ffe3fe3ac0767491b140e1fae902adee4e26a96dc3e5fd9ee3e0c293fc4fe2ed316414397a938b0602580dc422b5d43cc29b9ed655a7a5d57

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox.ini

Filesize
2KB

MD5
cbf23a1a0eb1d5a4db96f0800c1b560e

SHA1
72ba79961741cc9e153402e940ab6f974bd7c469

SHA256
a6fb7be17ffca80e4492434fc6920264099036dff9486747e4e79d9c0f8df769

SHA512
c9e91e080672ec5cca69f81647d310d1187e095c6023579e40d667a4c4b0930b84e617ef58891a758e7bf46216190ec5443d54717a1a14f3318540983d97216d

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox.ini

Filesize
2KB

MD5
0ea75496d9716ba269f47b723c4dbea7

SHA1
157e6ac6d9d71b8431c43c06d0619916ed57b45a

SHA256
17b2dbc3d4e531b902792d93480c64e01a960e174ba88809c83627cef3e2cdda

SHA512
c9c90a275b372a6454e890893e70844879bd8a22c5873bf16a115e1fb1b951297f341b4b1791e477e12ac17ec8ba915396b36a1e0fc240d92c25d13fccf8983a

Download Submit
C:\Program Files (x86)\Inbox Toolbar\Inbox64.dll

Filesize
1.5MB

MD5
2c9596e97c9e11b7a30a75aa464dc70e

SHA1
60effa4eac84edd2260b2af5edbd1743156da6d7

SHA256
ab314891b78efca4c154a13aa0f91a8d4c6fcdac8431d45ae56bd116456cb7e4

SHA512
7ffd01f425c25619243a21a2fb498035d11fa8096f20e837aeb548c5144d67af0b2fe5cefebf5a16f17698304162079be7ac793cbcbad0e0718e61b0f70c5445

Download Submit
C:\Program Files (x86)\Inbox Toolbar\unins000.exe

Filesize
1.2MB

MD5
3ae9703c8eb945c3559c6ddd38515503

SHA1
50c6ac0bcf326e51b8e173dbf111bbd74301a97c

SHA256
24de43663274da426020181911894c3f4831396def816e6627805e0956679bd5

SHA512
743678ebd23576537fb779c299526df6da91b1e6aca0725d3b9520e129d5d4ac6add5d98b0c7aeb48b10b9fa78d0312bece6b1120b9c3c7f792a3f96af5538d2

Download Submit
C:\Program Files (x86)\Inbox Toolbar\uninstall.ini

Filesize
69B

MD5
b0a2c594aa960b5e39a805ae9434254e

SHA1
2880dc4cd6aaaf1b8cb07a68ef8664c394110605

SHA256
2e68f509ba0c91a667a15f44a651886346ec144857000980eef7215121bcd19e

SHA512
fa929e22b72950f9e719a11006aad7b32981eacf6f3d9735b13f038b2d1b1f7b91f285bb9e0eda68108ab40e5fba4c5bcb93e2ddbbaa3167c45fd6d33f81c4a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
29B

MD5
3ae883e8a3e0272e3b0844d35a05fd87

SHA1
45b5ad9ea39c60ee61d6ad5776b82975c27191c5

SHA256
c37f72f8519621289d97d31889959c508ecd8ee7a18dd04462fcce53b74719c1

SHA512
5dbcd8f6ed1891f9099723934f46955f90d9219dc07ba468ab1cd286f9b96154365f4ada2515639a8f0710b98fa01451d01e02482ba334905d9443782eb2ed0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
69B

MD5
e23c9bb9a2b0e9a5e473e337b7cd1211

SHA1
e4cf721154cc673d1ccf8c70e096eabd43eea95b

SHA256
7e86478f34c893a3dfb8ab3d70d943f3aa3ba955fb7576c29151b3104bee2dc8

SHA512
7a79c7c7fa26bd7806b1dfc87bba2d48ecd88dbad378b5e287215a00211869d2510dfdb98e23b8adb15180ba12508d0fbffd7e0410d958dfd6516ea373f47b6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
118B

MD5
cced020bcfe56eb4552d244fb22680d1

SHA1
00373304b55925b5b51e408cc092401247150361

SHA256
b6e7f13e66e9b8f9779669a8fd5d67227296a1db827e50e30e4004d125997d35

SHA512
3f50d85f83e8e95bdc5fc6a11f19a12429ef6f40845d5f1d3824a69b6f27a917dac976356e97094f79806d2371b0322d2e2771c4d23017115f705ab663283417

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
173B

MD5
5faacb516fb379645a8372089c3e096e

SHA1
08d68877b43e15a665647ed21e19b1b68edf01fe

SHA256
c219f258012b0062b121106806bbc9a76f7181ee010d78dd653cb31d617c9f8d

SHA512
bdc2c2c5f5f231a13f6a87b1ddff8268246acc6b7d350cc6aa1e9bb0bbdd8897b11c80ea4f834fd79a413afc11a25aeb819f6a878fb8d15e46689ccbdf8fdfd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
210B

MD5
eadce83ba668526ec0be856e6a87a66b

SHA1
71efe151955f3d9c9d4bfe345f731f4cdb4b5984

SHA256
49a7e176bc390df214707637beafe016b3521e686a28d1ded25375a8f2ae239d

SHA512
86b33e55a6928313caf6c2d8a257c0f5d636eab9315d9147e5d60ac50a4c184ff37128a879aa1a59ae2c76e1829403f4f7ec5d8ca23ed63027914bc1a726d66b

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\config.ini

Filesize
244B

MD5
6484b339688153153af10a18415bdf75

SHA1
9e91bf63d9576d909364df15a0a9975a485d720d

SHA256
0ba06d36f7b9f1e4879294b62aeeab19fdd767ff6ad4298c9ea927fcc319f315

SHA512
ab99dbbdad6ebf8e98890f92920ffdd41c6f1badcc7499b41b031e55ed63c30134c03b6108bd33bf6cd055106c9bc1ad42ffe8822ff99d5acd2ea0e8965008aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Inbox Toolbar\translate.ini

Filesize
93KB

MD5
6aa650efb4605f4bb39bdcfd8a2198ba

SHA1
da12240ffb9984e3f3d8e93a859bc8d768a242a4

SHA256
8729058fc0a109bfaf82d84abdc954805cd46ed499ff235d5181ff3facdaf2cf

SHA512
6893a2f796546c859c1a9ab2a8c1960f2606fe779a07bbe3cf3c0ebdb9579defa87c3b1d4dbb7e4934839a0cd5062255fb6d019bee11cf57e09b0cf350ce2819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9DCB39497F031D5F29924F3E93AAF1F2

Filesize
504B

MD5
c261f088c5573be6e94aac12f4d462f6

SHA1
2033f897205fab3e0a94575d99f502aa5c01be26

SHA256
d3103942363a1a233af2443eb616aa829c2ab79ad2a9b02cd041c9760d710f62

SHA512
b7dd0ca46c2233f414bd7db5a5a8c799baae5b86d2bfd56b2a086e894c805c1a326238f7a2234d7b685050162f524e48015e152fed01069f9d186ea004f03306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B624848E7D0C04204BF0E664FB37FBEA

Filesize
504B

MD5
3989b20b8e2353b2ca0be103a2b8e796

SHA1
7839ab725e2113718cab29a3ca578b376610db1a

SHA256
5e5cabce6e49b1e35cc969a719cd148bb9ad65381ff2bb5fc73e462424f7a369

SHA512
bd7028a307fc751da0f7cb1daed5ada034bdc147f83cb16fc2b4b671ed7e552efead4e7af883867f1373226af3889a4098d1fd94109f33ee946b7df04beeb4b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
3a303ac1e5adadba7e0eefdc68a7791f

SHA1
7f8c9affcccf4639414ebc7bac7ffb3731561418

SHA256
039f880de2f0bd5b79059a9aaf2a696661f422f0f0092a096e6cb637097bca6d

SHA512
0a3fae346d956ac12e29bd1d26ae4e23a4b737d695e8d1f4719a3d5893a8796d026893319284364367483136eefb7ab772f96446bf305b0b994a6e42966a7598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9DCB39497F031D5F29924F3E93AAF1F2

Filesize
546B

MD5
69dc5e3d46d926ea7e70077c21324f19

SHA1
18d0c9504c85fb96e559d867a6aff38ac696d806

SHA256
7c8061d63e3c20e8608cb7bf4b4d07af2e87e010c78b6ad63f1d8da44b39eebb

SHA512
28104f782fe930351409eb447aaff11532f0f16c93f8aa9e2cf678f9ed4e2854081ac216afa3bae6c354e68bfc857a1a29d77a75a5c3ef7b1253327cefbab52e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B624848E7D0C04204BF0E664FB37FBEA

Filesize
550B

MD5
52f6851ba429df5b64726b74da1d583d

SHA1
721bab6b0aa0de1d454cc7e95424a79a98f256d0

SHA256
14d3190129ecb665fcaf31fc56549eb09f676a70da0b87b68b81676e6d7a07bc

SHA512
2fdd273422feb2a29e964efa996ad7c64d8114fa5f28fa07799e465b53f1f4007088a687063be338b503e88ed4b1429d9bb5581c6c7a069c2b767034799228ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1dcjxmi\imagestore.dat

Filesize
15KB

MD5
66e62ab9fa303dcef4e59a5e38467ab3

SHA1
8a47c08bf1a9f0de27b360726ed0f87d61694a51

SHA256
88dd84644d1cc0fabda6af6f6106f11b5ef68d173e3d395e43526fee2a1aefa0

SHA512
89bf23601dd874ee850aafdfcef60d1739f45c6f952b80182078a73b30f7513b0a2a2e7d486502ccc07586ffbf7b64de21c8a564d56d28a588ea9f929246491e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPUS7TYC\favicon[1].ico

Filesize
14KB

MD5
de4c71e881f03193bb0884185b51bbdf

SHA1
8f51bb36b81298f9fb57824716539520553b77fe

SHA256
1f8e952702b912ccb4326c9bfd76f4cb49459787a2955924798792c20ed45580

SHA512
cf91b32ff05ce6fab615d727c6a1e25c9f4f08d51af5cadbba74650921333b0f0f3a0444a36c4c4ae77abd3ea54c846c8248af7cc0256c06ca4aabac457eced0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPUS7TYC\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PC0DF.tmp\37135ac9980c76161cb0726319b6967b_JaffaCakes118.tmp

Filesize
1.2MB

MD5
e7106fbf42fbc6d5b08a18ada4f781b4

SHA1
36d4a629f79d772c0b0df8bd2ae2ea09108d239d

SHA256
64e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635

SHA512
adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q9IBI.tmp\AGupdate.exe

Filesize
873KB

MD5
a3ccbbb0735800b89931b73ccb69f9b1

SHA1
53c70f80017eff22ad88a53fdb3ffc518354af59

SHA256
97d0684ab1ecb2f89a3c8e53dc383aede506a1f9367aa283c0b9992a19854d43

SHA512
e4461a7cf5e8b8e655a2985be672af25e44276b018b7b532a665f26c1a44032bbada7e5a071a78827020c3f18d9d5c79bd0f59fe97876b1eb4279ec4094f3704

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q9IBI.tmp\DownLib.dll

Filesize
183KB

MD5
db25dfdd4c1f2b65c68a230881072695

SHA1
94cd6a3438041f0e61b0a1bea7b66461854efe69

SHA256
1b66aaf1e7e3c493dd96af3b7442ea60072f6e93ba45281eacd31a14ca7e7e73

SHA512
db69e4ab2218856e5184d9094e7e39705b83e3efdc15225067205c8faf6e5836145364f1d509192defa3b48864e72b9f8c0f2dc53a7adb2b86c655318b7afc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q9IBI.tmp\setupcfg.ini

Filesize
85B

MD5
2638f094d963afae19371945dc17f41e

SHA1
e45241c0dac7066dd8b4ee784ca0a0a42d7c6923

SHA256
30bbac9d686998429656bbc5dbff5da5bbdbf318934de6ecaa9d114a3dfcc941

SHA512
7acfb95da6033645e5b1c1330580740c584bcc4878547556a78bd16980fe430fda8f2c004487c494d5633fed3e23db03ae523d7c2bc332eed8a08a5c3bcbcb11

Download Submit
memory/336-392-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/336-527-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1220-134-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1408-404-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1488-443-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/1728-315-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/2152-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2152-62-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2152-2-0x0000000000401000-0x000000000040D000-memory.dmp

Filesize
48KB

Download
memory/2152-442-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2184-415-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2268-431-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2760-163-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2760-65-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2760-23-0x0000000003C00000-0x0000000003C37000-memory.dmp

Filesize
220KB

Download
memory/2760-389-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2760-64-0x0000000003C00000-0x0000000003C37000-memory.dmp

Filesize
220KB

Download
memory/2760-417-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2760-419-0x0000000004730000-0x0000000004837000-memory.dmp

Filesize
1.0MB

Download
memory/2760-7-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2760-441-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/2760-145-0x0000000004730000-0x0000000004837000-memory.dmp

Filesize
1.0MB

Download
memory/2760-165-0x0000000004730000-0x0000000004837000-memory.dmp

Filesize
1.0MB

Download
memory/2760-178-0x0000000000400000-0x0000000000536000-memory.dmp

Filesize
1.2MB

Download
memory/4060-137-0x0000000002060000-0x0000000002167000-memory.dmp

Filesize
1.0MB

Download
memory/4356-98-0x0000000000400000-0x0000000000660000-memory.dmp

Filesize
2.4MB

Download
memory/4384-141-0x0000000002060000-0x00000000021EE000-memory.dmp

Filesize
1.6MB

Download