6ff047af37d02804167d9354fd0d1eb0440d518679337b9d7984b06c765907c5

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
Size 256KB
Sample241012-18mldavame
SHA256 6ff047af37d02804167d9354fd0d1eb0440d518679337b9d7984b06c765907c5
MD5 3c516df25c4656ccc8467daeaa1fa12b
SHA1 3e154d69a33634a2ba7f0f2b811dea4e0bd2a11b
SHA512 5da0aba076a286947df13ba018c41c4e74a535b58fd596dbf340082af62d640414768c32e8dfffab85bad6c1a17db34e38e9383ca38b6efc5e2ea7510c7ddf6f
SSDEEP 6144:CMWnwQaTtvIa5rD1U8x7Am6OoyFoLp1kvWlp2FN6A5B5dyP:LJQatIerRUAA0o8CTlkFN6Az5dyP
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion discovery evasion exploit ransomware upx

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1852	bcdedit.exe
2436	bcdedit.exe

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\tcpipreset	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\system32\drivers\tcpip.copy	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\system32\drivers\tcpipreset	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\system32\drivers\tcpip.copy2	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\system32\drivers\tcpiprefresh1	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\tcpiprefresh1	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\system32\drivers\tcpip.copy	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe

Possible privilege escalation attempt 27 IoCs

exploit

pid	Process
4956	icacls.exe
5076	icacls.exe
2448	icacls.exe
2796	icacls.exe
1712	icacls.exe
2292	icacls.exe
1500	icacls.exe
1128	takeown.exe
2804	icacls.exe
4672	takeown.exe
1076	icacls.exe
3152	takeown.exe
2608	takeown.exe
4104	takeown.exe
3292	icacls.exe
3004	icacls.exe
2500	icacls.exe
1016	icacls.exe
2896	icacls.exe
4440	icacls.exe
1660	takeown.exe
2580	takeown.exe
2248	takeown.exe
3140	takeown.exe
4364	icacls.exe
1776	icacls.exe
4752	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe

Modifies file permissions 1 TTPs 27 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2608	takeown.exe
3140	takeown.exe
1076	icacls.exe
1776	icacls.exe
3004	icacls.exe
4440	icacls.exe
2804	icacls.exe
4364	icacls.exe
1712	icacls.exe
4956	icacls.exe
2448	icacls.exe
2796	icacls.exe
2896	icacls.exe
4104	takeown.exe
4672	takeown.exe
3152	takeown.exe
1016	icacls.exe
4752	icacls.exe
5076	icacls.exe
2292	icacls.exe
1500	icacls.exe
2580	takeown.exe
2248	takeown.exe
2500	icacls.exe
3292	icacls.exe
1660	takeown.exe
1128	takeown.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Drops file in System32 directory 35 IoCs

description	ioc	Process
File created	C:\Windows\System32\de-de\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\en-us\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\es-es\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\it-it\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\uk-ua\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\fr-fr\user32.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\ja-jp\user32.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\en-us\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\es-es\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\fr-fr\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\it-it\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\uk-ua\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\de-de\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\en-us\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\en-us\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\es-es\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\ja-jp\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\es-es\user32.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\it-it\user32.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\fr-fr\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\it-it\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\es-es\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\fr-fr\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\ja-jp\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\uk-ua\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\uk-ua\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\de-de\user32.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\de-de\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\fr-fr\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\ja-jp\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\ja-jp\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\de-de\user32new.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\it-it\user32copy.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\uk-ua\user32.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
File created	C:\Windows\System32\en-us\user32.dll.mui	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4452-0-0x0000000000400000-0x00000000004C8000-memory.dmp	upx
behavioral2/memory/4452-188-0x0000000000400000-0x00000000004C8000-memory.dmp	upx
behavioral2/memory/4452-270-0x0000000000400000-0x00000000004C8000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
3384	msedge.exe
3384	msedge.exe
1616	identity_helper.exe
1616	identity_helper.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4672	takeown.exe
Token: SeTakeOwnershipPrivilege	3140	takeown.exe
Token: SeTakeOwnershipPrivilege	1660	takeown.exe
Token: SeTakeOwnershipPrivilege	1128	takeown.exe
Token: SeTakeOwnershipPrivilege	3152	takeown.exe
Token: SeTakeOwnershipPrivilege	2608	takeown.exe
Token: SeTakeOwnershipPrivilege	2580	takeown.exe
Token: SeTakeOwnershipPrivilege	4104	takeown.exe
Token: SeTakeOwnershipPrivilege	2248	takeown.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 5068	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	86
PID 4452 wrote to memory of 5068	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	86
PID 4452 wrote to memory of 1980	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	88
PID 4452 wrote to memory of 1980	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	88
PID 4452 wrote to memory of 4924	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	90
PID 4452 wrote to memory of 4924	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	90
PID 5068 wrote to memory of 4672	5068	cmd.exe	92
PID 5068 wrote to memory of 4672	5068	cmd.exe	92
PID 4452 wrote to memory of 1724	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	93
PID 4452 wrote to memory of 1724	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	93
PID 4452 wrote to memory of 4908	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	95
PID 4452 wrote to memory of 4908	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	95
PID 4452 wrote to memory of 1996	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	97
PID 4452 wrote to memory of 1996	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	97
PID 1980 wrote to memory of 3140	1980	cmd.exe	98
PID 1980 wrote to memory of 3140	1980	cmd.exe	98
PID 5068 wrote to memory of 1500	5068	cmd.exe	99
PID 5068 wrote to memory of 1500	5068	cmd.exe	99
PID 4924 wrote to memory of 1660	4924	cmd.exe	101
PID 4924 wrote to memory of 1660	4924	cmd.exe	101
PID 4452 wrote to memory of 4132	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	102
PID 4452 wrote to memory of 4132	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	102
PID 1724 wrote to memory of 1128	1724	cmd.exe	104
PID 1724 wrote to memory of 1128	1724	cmd.exe	104
PID 4452 wrote to memory of 2976	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	105
PID 4452 wrote to memory of 2976	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	105
PID 4452 wrote to memory of 2560	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	107
PID 4452 wrote to memory of 2560	4452	3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe	107
PID 1980 wrote to memory of 1076	1980	cmd.exe	109
PID 1980 wrote to memory of 1076	1980	cmd.exe	109
PID 5068 wrote to memory of 3004	5068	cmd.exe	110
PID 5068 wrote to memory of 3004	5068	cmd.exe	110
PID 4908 wrote to memory of 3152	4908	cmd.exe	111
PID 4908 wrote to memory of 3152	4908	cmd.exe	111
PID 1724 wrote to memory of 2448	1724	cmd.exe	112
PID 1724 wrote to memory of 2448	1724	cmd.exe	112
PID 4924 wrote to memory of 2796	4924	cmd.exe	113
PID 4924 wrote to memory of 2796	4924	cmd.exe	113
PID 4132 wrote to memory of 2608	4132	cmd.exe	114
PID 4132 wrote to memory of 2608	4132	cmd.exe	114
PID 2976 wrote to memory of 2580	2976	cmd.exe	115
PID 2976 wrote to memory of 2580	2976	cmd.exe	115
PID 1724 wrote to memory of 2896	1724	cmd.exe	116
PID 1724 wrote to memory of 2896	1724	cmd.exe	116
PID 4908 wrote to memory of 2500	4908	cmd.exe	117
PID 4908 wrote to memory of 2500	4908	cmd.exe	117
PID 2560 wrote to memory of 2248	2560	cmd.exe	118
PID 2560 wrote to memory of 2248	2560	cmd.exe	118
PID 4924 wrote to memory of 4364	4924	cmd.exe	119
PID 4924 wrote to memory of 4364	4924	cmd.exe	119
PID 1996 wrote to memory of 4104	1996	cmd.exe	120
PID 1996 wrote to memory of 4104	1996	cmd.exe	120
PID 1980 wrote to memory of 4440	1980	cmd.exe	121
PID 1980 wrote to memory of 4440	1980	cmd.exe	121
PID 4132 wrote to memory of 1712	4132	cmd.exe	122
PID 4132 wrote to memory of 1712	4132	cmd.exe	122
PID 2976 wrote to memory of 4956	2976	cmd.exe	123
PID 2976 wrote to memory of 4956	2976	cmd.exe	123
PID 4132 wrote to memory of 3292	4132	cmd.exe	124
PID 4132 wrote to memory of 3292	4132	cmd.exe	124
PID 2976 wrote to memory of 1016	2976	cmd.exe	125
PID 2976 wrote to memory of 1016	2976	cmd.exe	125
PID 1996 wrote to memory of 2804	1996	cmd.exe	126
PID 1996 wrote to memory of 2804	1996	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c516df25c4656ccc8467daeaa1fa12b_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\de-de\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\de-de\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1500
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3004
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\en-us\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\en-us\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3140
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1076
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4440
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\es-es\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\es-es\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2796
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4364
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\fr-fr\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\fr-fr\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2448
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2896
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\it-it\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\it-it\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2500
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5076
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\ja-jp\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\ja-jp\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2804
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1776
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\uk-ua\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /grant "":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\uk-ua\user32.dll.mui" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1712
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /grant "":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3292
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\drivers\tcpip.sys" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /grant "Admin":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\drivers\tcpip.sys" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4956
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /grant "Admin":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1016
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\rescache" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /grant "Admin":f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /F "C:\Windows\rescache" /A
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4752
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /grant "Admin":f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2292
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C "C:\Windows\System32\bcdedit.exe" /set TESTSIGNING Off
  2⤵
  PID:4300
- - C:\Windows\System32\bcdedit.exe
    C:\Windows\System32\bcdedit.exe /set TESTSIGNING Off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://half-open.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffe1c1a46f8,0x7ffe1c1a4708,0x7ffe1c1a4718
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,4227601426301146017,11608798164626735252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3320
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C "C:\Windows\System32\bcdedit.exe" /set TESTSIGNING Off
  2⤵
  PID:2204
- - C:\Windows\System32\bcdedit.exe
    C:\Windows\System32\bcdedit.exe /set TESTSIGNING Off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 5c5b4b9ce894cf9cf936def86139e8320c028ff19d3b531f87ce08c89423c30f
MD5 13dae5929a9d4d7006f3dd59f22c2be1
SHA1 2cdda5e4d6ca57b25f1298090d08c7d041ccf4fd
SHA512 d1000ec3f14bb2b4a602812ed9f48525d3098e2e92d6a209600296326c44b2933dcff8bf6c7dd63a6897b4e15f39922f49d5986ba5e594dd2557bfc3b106ad40
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 644B
SHA256 aeb9aa4bb79881090de1a36b23f24b32be3b7d4e1ea68c24dd46d6342b4809ec
MD5 266195668920f8d19225224dda95799d
SHA1 bdf695d5e10464c6f91ef4fd2a9be7277a3b7770
SHA512 4c8a3d058d561c292134600a9e8908f8de657848cf632ab1a850eeccb5dc6724bc78a8005f64f1984b6be3f8693b86ad838e80d55fdc695b1ac5b8abfa31cf0e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 52b4b88275bd56abd6896097965bc1fa83d16e93a9145ba6bd69cd62ca921cd8
MD5 4cfab9f54de1e06e8811c2f0de08baa8
SHA1 ffbb7b5648de5d24a16a36561c47728c9eb9aad8
SHA512 0c8afc5199cee6b48ad250c18d9932f755f8cb3c909c861cb6784941e3dc36ddb20a2061fd942e0ddb673c9150859818b0f5a0f228700b47313a10decf18ccc4
SSDEEP 96:nZkAxm/BQYmqt1aR1SnwpvWMoiVmdeHdwpqUWQyV+VD7ziEwb:nZkxK+wzaGWMXcqrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5c39f3c42842554c86e0274145dd3ff40403d9f3f068976a28ba499ff9f2b416
MD5 f6072f41279369e35a79b1bb9ef138e8
SHA1 c8051479ce92d630a931289cbb32f8844580ad8b
SHA512 a415432a6c0c8972e93a71a71fb32d2e81823e7c3e61ca7021f39727e987d4a5e7e94cd526183fd3ca3bf22f372e79f8bc51649e877573ccb0b4086e56a567c2
SSDEEP 96:nZkAxm/B6mqt1ah1SnwpvWMoiVmdexuV41INV02dDFpqUWQyV+VD7AiEwb:nZkxj+wjaGWMBuV4CNV02Jqrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 80d07c45de2876d367a34a0531e0db8eedf74c6ef438c302fd8d86e8e46ca01f
MD5 7732368371de54fed673ad9b626d876b
SHA1 f8d3cf73fbd781c4baa4cd8a31a1809baaf91959
SHA512 ecd4e76b44a8e993cc0d18200e572e9d61e6a832fa56780218899d49b5e447d18a9244d5e3a613eab606af4fb3f7bef038efe705e06e602da1b34e9d64e3c6a8
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupk2Le2RUEjRHC6+B1Elqou:A9iIxuERzA83h09RZxY/nCbEIou
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\de-DE\user32new.dll.mui
Size 19KB
SHA256 bd2c70e7e8720942b4bc3020929b894bfbe5e9d97082a821272b73f5d480e9b3
MD5 f8d6dd4349b7f240c6cd4d04d21657f7
SHA1 744e7220be770ddce55fc6242fa3c5547725fcd7
SHA512 96f3e427b735a63b49c07e7f14754b996324a58cc15cf99e55c1ba1555dfdbeb7734719b06d4a95c322b3a9bb31c0bb192d78b06981c03ba0678538dd4890f4f
SSDEEP 192:9ujv55W5RdAtugoiZVziM1GBDXies7Y3Wl+Cb:g15sRdAtuviZliMOziFYWl+a
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcpip.sys

Path C:\Windows\System32\drivers\tcpip.sys
Size 2.9MB
SHA256 7c3096abccd98d710b9642c162e424e8cd1d1cb6fc1f8439431bf149ce09c9d2
MD5 313dd64a73ab31797e7263bbc33b91b2
SHA1 540a838d3e6c8cae9280d0241f66a5a6a94359fa
SHA512 72d6d29aa630497f030553711b54fa087b5bc2a5b94c308b4304809392b9a5448f3f0e43e60a9df83c6f6f57e62e6a302ec787118d660bbff192bbb5f576c870
SSDEEP 49152:B0DrrCfs9348IKxhCxJ7AchhLtcVZcupf17C:BCVR+7vruM
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\en-US\user32new.dll.mui
Size 17KB
SHA256 6921a8d82bd3586df770d2854dc9c538f6de996a64c63c29e31b1e84be040f4a
MD5 90b43ec7eb2e379561b0efd0d93342bb
SHA1 efdc5321144229a02e2347ae71ef1e9a869d8d3c
SHA512 5cc5f9045c90e8fd7d0ddbc242ef64df71b10e36c3a6e5d25db8dbc2608aa3ec48b2a6b71686fa4646e40eefec700e0b2c324e8bde7da9239be98f1416a58e4e
SSDEEP 192:onnn9hDQLrbyxrfrJm/Nkeeu9DI3iqscomAnGhWgbWI:onbsbEf9m/+ea3pzomAnGhWgbWI
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\es-ES\user32new.dll.mui
Size 18KB
SHA256 a0fc551bc1fe60ecedc79c387a3311f9879d1f69509e61c6a6e472534d7b4448
MD5 88e058f2f65a9ecfc4023f5d6512bfee
SHA1 c3a86890e1560d33309c0e019d573855028a811b
SHA512 e51ac8a044bd5a0de3eb5128efccaa04ee54c5578c698b00bef3ffd9094e51e550b757916af4e7992407019614fd816dd9d78231b6821813bf3e9b4e217f807d
SSDEEP 192:4ZAEBAkOfCJ1Bfmib1W+BBkHg7R3GVoiCE3aZQM3K3NmW07B:4Z7gfCRBCHg7R3GVoiCE3a6M3aNmW0F
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\fr-FR\user32new.dll.mui
Size 19KB
SHA256 39519ade42cac753b5fd8586786e292ada3c4910041353b31730fa3079801c21
MD5 3996e9a5f0cc85e93aa7ade49a892c5e
SHA1 fa2b4d88bc4b2efb7acd13a83003ec23c44c2664
SHA512 99a84f565c0c730472ebb7940c260460f54b1c88c446c3869ce5e889f4fd14230b40c6267de751d93a3e1882d6ac6cd29a6026591aebb3600caa7b508bd5d414
SSDEEP 384:htYgO4DdWtegWTb1ekI+6DHZToljHpaWA0e:hyfSYWZPda9
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\it-IT\user32new.dll.mui
Size 18KB
SHA256 da174e40ddc8260b809f6331a2d3aa37daa108acd09aef38048432bd1ca283f7
MD5 c99c413b13017aa89431469764aab8cd
SHA1 a556fc89f96414c3d2b262841b207065a5e205c9
SHA512 da93ae0f081900c612c66967c27baf19b2d2054462971887d295b3db3ca5c1e5dbfd92bd258c4acc683b7ea3414466ded4d6ae85464a4eca7e08029fb4c1d615
SSDEEP 192:wXzDoRflpAhQrh0JcB0NSf6ZydcQMYedAKvZp73Hvj3ExVW57c:wXXoRfE4kSMW9KvZp73Hvj3CVW5Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\ja-jp\user32new.dll.mui
Size 13KB
SHA256 9c8c73bd07a703b1561e611e8e0754e3070aca9780069016061986550c3da772
MD5 e69bdd36a3eb328b1af034c72f160495
SHA1 7615ada4ae284c46dd7ae5212e336aef597814ca
SHA512 f6fb9b3936b856548d2a728506898556048e0708be7803b50a12063db39943f9ebb5013a8f670e3e1c2ce1f4865b7cc6470c3b87bc01957b8749305cc4cc2ec8
SSDEEP 192:4jQLB2Y6+A3fJBC79td8HM4mcLbN3HzEkWlbWd:4UP6+A3B879td873HzEkWlbWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

user32new.dll.mui

Path C:\Windows\System32\uk-UA\user32new.dll.mui
Size 18KB
SHA256 4d8dadf1c2659434290a2e304f9e87a1bd7de443ec8c7599d44d6f9e1636e77e
MD5 aa12a3301c30a46acd35972b04c0a71f
SHA1 56a6a8b5f74e1bddb382f70e8fafa84d2313e364
SHA512 cd64db81fcc2129b73c864bc63f987b447b7c1cea3194bd48f9aa34fb905617e72c585885f3dc071063a08b760bb75ef57f0ae2bca261435c567b4ce8e6f80c3
SSDEEP 384:db1wUgAoo4raY83QZr4/Bw/T0pNUnM+lyTp9W0Ki:kDGUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4452-188-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/4452-194-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/4452-0-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/4452-270-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/4452-1-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download