neshta | ecda3142407a9f09a1293af2856be4bff978a1c8faeb4ab02c5052fddfea5a02

Analysis

max time kernel
140s
max time network
139s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
Size

3.7MB
MD5

bd732f8c32faa0991c349bbc53d7d6b6
SHA1

680f7c93874526a2a6b89f5f24c281af15cc937f
SHA256

ecda3142407a9f09a1293af2856be4bff978a1c8faeb4ab02c5052fddfea5a02
SHA512

3ffa9586f1df18ae16623c23e2397ea236258502ff6c79f3c5946ff862300fed5a073713f1ee2c63598309f0549224fd290d65b3b577b80252105d28b72d6d73
SSDEEP

98304:9IqsAhajXR3EyV19YsMMN1J1UEacaoMQlOo75+367ohH9LEbM3:hPWXRUA1uU1J825lOo1+367OLEG

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 40 IoCs

resource	yara_rule
behavioral1/files/0x0001000000010319-10.dat	family_neshta
behavioral1/files/0x000600000001949e-31.dat	family_neshta
behavioral1/files/0x000100000001064f-47.dat	family_neshta
behavioral1/files/0x000b000000010326-46.dat	family_neshta
behavioral1/files/0x0001000000010317-48.dat	family_neshta
behavioral1/files/0x000100000000f77c-54.dat	family_neshta
behavioral1/files/0x000100000000f7d0-57.dat	family_neshta
behavioral1/files/0x0001000000010b98-69.dat	family_neshta
behavioral1/files/0x0001000000010374-72.dat	family_neshta
behavioral1/files/0x0001000000010c16-74.dat	family_neshta
behavioral1/files/0x0001000000010f33-79.dat	family_neshta
behavioral1/files/0x00010000000118e8-82.dat	family_neshta
behavioral1/files/0x000300000001213f-95.dat	family_neshta
behavioral1/files/0x0003000000012144-101.dat	family_neshta
behavioral1/files/0x0003000000012183-104.dat	family_neshta
behavioral1/files/0x00010000000115fd-116.dat	family_neshta
behavioral1/files/0x0001000000011877-122.dat	family_neshta
behavioral1/files/0x0001000000010f35-124.dat	family_neshta
behavioral1/files/0x0001000000010f98-135.dat	family_neshta
behavioral1/files/0x0001000000010fcd-140.dat	family_neshta
behavioral1/files/0x00010000000118fc-139.dat	family_neshta
behavioral1/files/0x000100000001190b-142.dat	family_neshta
behavioral1/files/0x0001000000011082-145.dat	family_neshta
behavioral1/files/0x0002000000011083-147.dat	family_neshta
behavioral1/files/0x0001000000011a1a-149.dat	family_neshta
behavioral1/files/0x0001000000011b24-153.dat	family_neshta
behavioral1/files/0x0001000000011277-155.dat	family_neshta
behavioral1/files/0x000100000001128b-158.dat	family_neshta
behavioral1/files/0x00030000000120dc-159.dat	family_neshta
behavioral1/files/0x00030000000120e0-164.dat	family_neshta
behavioral1/files/0x0003000000005ab7-167.dat	family_neshta
behavioral1/files/0x000d0000000056d4-174.dat	family_neshta
behavioral1/files/0x0004000000005726-173.dat	family_neshta
behavioral1/files/0x000800000000e702-172.dat	family_neshta
behavioral1/files/0x000b00000000598c-178.dat	family_neshta
behavioral1/files/0x00050000000055de-177.dat	family_neshta
behavioral1/memory/2532-180-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2956-181-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2532-616-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2956-615-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Executes dropped EXE 4 IoCs

pid	Process
2328	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
2864	SetupShim.exe
2956	svchost.com
2772	SETUPF~1.EXE

Loads dropped DLL 10 IoCs

pid	Process
2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
2328	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
2956	svchost.com
2956	svchost.com
2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	svchost.com

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupShim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d1c3ed412b2e0248916fdc98ce31190600000000020000000000106600000001000020000000465512e8cdcf90865cd453d97a1064c665a2b6cb56c6c7bc481d2603cf24ad62000000000e80000000020000200000000c98b155b18e8421c64a142cc46e0b8453271f726d29a663b0d4e6605e76547b90000000397834754d9cdf11580f425eaa8326d86448fb4dd3ed2c3a783224d2ff04b00c6a008e9190dbf38cc836511f8895c4ca75dcc2dde2d1a14924ea5f9e1e4e2c6ae5dfa50eb05bddaea8f1cf2aaf9be34f2b9405f73859653c3d78935a1c97afa493173387afeb9213f0a295cf8536e644431d703a58613e24fd814e45ab67ab8b75bc4b16437b8508b5e36844bdfe0eda40000000c04fee14d8cbadd4fe3ebf9d0fc792424dbb5f4912cbbd93f582f4cfa9c7a1af293f948d30ce9632d44362ee46fe733f76b75859025ba2750662dccd9d53f4a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5659B8D1-B174-11EF-902B-EAA2AC88CDB5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439391736"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d1c3ed412b2e0248916fdc98ce31190600000000020000000000106600000001000020000000268057c4e3e744c31fac9b579d80fdb5f90c821f5828bf88e06f033523d55190000000000e8000000002000020000000c670b4649254b46d4ac46e9dec2536c2da13df8e59f1e90cfe8709ce9c51ba262000000087f3a3f8a8cadfacbb5252196817c95789b852c3ba78e91837e1f729dc98c5d04000000011ff1a490642a6acfacbe01736f1fa921fe6ed4b453465c87f0a320b2032eaddeedfc8df6cc1b29d3f5edd450d0c046c91dfa88d8d53c8709a1421f5482b23b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1041242d8145db01	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2328	2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	29
PID 2532 wrote to memory of 2328	2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	29
PID 2532 wrote to memory of 2328	2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	29
PID 2532 wrote to memory of 2328	2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	29
PID 2532 wrote to memory of 2328	2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	29
PID 2532 wrote to memory of 2328	2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	29
PID 2532 wrote to memory of 2328	2532	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	29
PID 2328 wrote to memory of 2864	2328	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2864	2328	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2864	2328	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2864	2328	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2864	2328	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2864	2328	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	30
PID 2328 wrote to memory of 2864	2328	bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2956	2864	SetupShim.exe	31
PID 2864 wrote to memory of 2956	2864	SetupShim.exe	31
PID 2864 wrote to memory of 2956	2864	SetupShim.exe	31
PID 2864 wrote to memory of 2956	2864	SetupShim.exe	31
PID 2956 wrote to memory of 2772	2956	svchost.com	32
PID 2956 wrote to memory of 2772	2956	svchost.com	32
PID 2956 wrote to memory of 2772	2956	svchost.com	32
PID 2956 wrote to memory of 2772	2956	svchost.com	32
PID 2772 wrote to memory of 2980	2772	SETUPF~1.EXE	33
PID 2772 wrote to memory of 2980	2772	SETUPF~1.EXE	33
PID 2772 wrote to memory of 2980	2772	SETUPF~1.EXE	33
PID 2980 wrote to memory of 2244	2980	iexplore.exe	34
PID 2980 wrote to memory of 2244	2980	iexplore.exe	34
PID 2980 wrote to memory of 2244	2980	iexplore.exe	34
PID 2980 wrote to memory of 2244	2980	iexplore.exe	34

C:\Users\Admin\AppData\Local\Temp\bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\3582-490\bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\PdnSetup\SetupShim.exe
    SetupShim.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\PdnSetup\SETUPF~1.EXE" SetupShim.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\PdnSetup\SETUPF~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\PdnSetup\SETUPF~1.EXE SetupShim.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2772
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.getpaint.net/redirect/pdnexpired.html
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

Filesize
859KB

MD5
02ee6a3424782531461fb2f10713d3c1

SHA1
b581a2c365d93ebb629e8363fd9f69afc673123f

SHA256
ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

SHA512
6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

Filesize
186KB

MD5
58b58875a50a0d8b5e7be7d6ac685164

SHA1
1e0b89c1b2585c76e758e9141b846ed4477b0662

SHA256
2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

SHA512
d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

Filesize
1.1MB

MD5
566ed4f62fdc96f175afedd811fa0370

SHA1
d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

SHA256
e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

SHA512
cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE

Filesize
569KB

MD5
eef2f834c8d65585af63916d23b07c36

SHA1
8cb85449d2cdb21bd6def735e1833c8408b8a9c6

SHA256
3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd

SHA512
2ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe

Filesize
422KB

MD5
0da2d682733a37ac0eff5886129e9192

SHA1
5c7def546e6e3a0fa55df37d7a0f9270ebc6119e

SHA256
ea67f9e673e395dce99a8e4ca5b755c4556ab7031e24f79762d6a59fbc8110fe

SHA512
1a9986d648f2fb77767bd267a0fa6a1a4c24f39a7a064ce3012a9110c9f087a2f367741d1039976d7848b72bece481b8597cb7acdc2ce72d710a17f7121ff2f6

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE

Filesize
588KB

MD5
c275134502929608464f4400dd4971ab

SHA1
107b91a5249425c83700d64aff4b57652039699d

SHA256
ca5263f340cc735ba279532bbd9fe505fcf05d81b52614e05aff31c14d18f831

SHA512
913cadcb575519f924333c80588781caecd6cd5f176dc22ac7391f154ffc3b3f7302d010433c22c96fde3591cac79df3252798e52abf5706517493ef87a7ef7d

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE

Filesize
571KB

MD5
d4fdbb8de6a219f981ffda11aa2b2cc4

SHA1
cca2cffd4cf39277cc56ebd050f313de15aabbf6

SHA256
ba3dc87fca4641e5f5486c4d50c09d087e65264e6c5c885fa6866f6ccb23167b

SHA512
7167e13dbcc8c96114fef5fc7ae19afa31173617db153dd283aa6d8256f6b8c09c8f906f5d418efe9f7f242cdfaef24b93c11c451701c4d56eb48d18de4e88bf

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE

Filesize
157KB

MD5
a24fbb149eddf7a0fe981bd06a4c5051

SHA1
fce5bb381a0c449efad3d01bbd02c78743c45093

SHA256
5d13230eae7cd9b4869145c3280f7208788a8e68c9930a5c9aa3e822684a963d

SHA512
1c73b762c340a8d7ea580985ba034a404c859d814690390a6e0b6786575c219db9ca20880ea20313bb244560e36cf24e4dda90229b3084d770495f4ceedfd5de

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE

Filesize
543KB

MD5
175f7d731cfa31541e21211e8b70a228

SHA1
822ac33bc53eb484d72bf563b90e3a4d227919c1

SHA256
4f80d4b9b5b2c5c3d5a78ee6771a02015d32bcecde995593e959d5ad660ea7ac

SHA512
a27d0dea374ca95405980568ae790f88503a2b0d7bf2481ea1bf396a9797ad16302978c8b7b3a37124fbf5fafd769c0581ae60234c9abef46e29548f3e670c8a

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe

Filesize
205KB

MD5
da31170e6de3cf8bd6cf7346d9ef5235

SHA1
e2c9602f5c7778f9614672884638efd5dd2aee92

SHA256
7737ab500cbbd5d507881d481eef9bd91cf6650bf8d2b41b47b1a8c5f2789858

SHA512
2759d938d6ad963e0bf63481a700f7c503d06011a60bcfc1071b511e38afa87d903deb36f9cbfa0b3fd08f1ecb88d2c0bddf0d3b5f2dea2a0cca1a80471669f3

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE

Filesize
230KB

MD5
e5589ec1e4edb74cc7facdaac2acabfd

SHA1
9b12220318e848ed87bb7604d6f6f5df5dbc6b3f

SHA256
6ce92587a138ec07dac387a294d0bbe8ab629599d1a2868d2afaccea3b245d67

SHA512
f36ab33894681f51b9cec7ea5a738eb081a56bcd7625bdd2f5ef2c084e4beb7378be8f292af3aeae79d9317ba57cc41df89f00aef52e58987bdb2eac3f48171a

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE

Filesize
155KB

MD5
f7c714dbf8e08ca2ed1a2bfb8ca97668

SHA1
cc78bf232157f98b68b8d81327f9f826dabb18ab

SHA256
fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899

SHA512
28bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE

Filesize
207KB

MD5
3b0e91f9bb6c1f38f7b058c91300e582

SHA1
6e2e650941b1a96bb0bb19ff26a5d304bb09df5f

SHA256
57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d

SHA512
a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f

Download Submit
C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE

Filesize
645KB

MD5
b00c357f313ec9514a77608a0199381d

SHA1
9190a7a786b0bd53be06e55f7a7baee612f14666

SHA256
5646465b91fcd21a5e445d9c03bdc19615c48473103d5a3a407144a8a520106d

SHA512
0866ff7c3bf37b9f98b8db7128ca44a5f99ef20c0465558c299276eb205ab207ef5e742076b1d4bef7ea7617e12818b344fc3f6497553cabbb3f667f08c40c69

Download Submit
C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE

Filesize
150KB

MD5
946b2d8f68ca1c24ed6ee4118c78c17b

SHA1
bf60e7c43f7bdab08b6102cf701ae97ad6c09d3f

SHA256
65353203a36f2ddb752ba64468fe30b903fa4f2225db835a6e6f92cf52e53d8d

SHA512
432d592817d0e16fb35bdd0af9a0e7850c889a654f5faee4703d16b64d754e205cad5cb8d17028e6af164a937a950652944558e563b206bc23bc8917c515964c

Download Submit
C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE

Filesize
782KB

MD5
6a122276eed7e6d285b232364b15b5ba

SHA1
83e279488ade830cd15ba6e247f3c550463bfff9

SHA256
2343b8c52bed81ba7056db6804d3f82ec023e9a9a576c24deda3e809e2635c63

SHA512
704fa461fec9d9a2289d4d422247c34b897347c919c0507d46fc7989cab91b5c6961f147f16728848742bb32986541fcba651cf95372186389e87d2497d26f2b

Download Submit
C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE

Filesize
127KB

MD5
154b891ad580307b09612e413a0e65ac

SHA1
fc900c7853261253b6e9f86335ea8d8ad10c1c60

SHA256
8a3598c889dbcb1dca548a6193517ed7becb74c780003203697a2db22222a483

SHA512
39bf032033b445fc5f450abec298ea3f71cadecfeafc624f2eb1f9a1d343a272181a874b46b58bb18168f2f14d498c3b917c3392d4c724fe4e5ae749113c2ad6

Download Submit
C:\PROGRA~2\MICROS~1\Office14\OIS.EXE

Filesize
308KB

MD5
4545e2b5fa4062259d5ddd56ecbbd386

SHA1
c021dc8488a73bd364cb98758559fe7ba1337263

SHA256
318f1f3fbdd1cf17c176cb68b4bc2cf899338186161a16a1adc29426114fb4f8

SHA512
cf07436e0219ca5868e11046f2a497583066a9cf68262e7cca22daad72aded665ac66afea8db76182c172041c45fcef1628ea6852751c4bf97969c9af6cfefa1

Download Submit
C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE

Filesize
1.6MB

MD5
08ee3d1a6a5ed48057783b0771abbbea

SHA1
ebf911c5899f611b490e2792695924df1c69117d

SHA256
3f6decd82b72a5ba1ee224b52d9fbd6486be22a0b855e28eaad47ae92df266f0

SHA512
1711d023c60d4b047d553a654797bc3a2eecd951b310698c1a2c549e136c33f55e0fc1167a4a38f793b7796f7cfc3fb30017935127b147a21da2812eb38faac5

Download Submit
C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE

Filesize
262KB

MD5
2d1b4a44f1f9046d9d28e7e70253b31d

SHA1
6ab152d17c2e8a169956f3a61ea13460d495d55e

SHA256
d1d73220342ff51a1514d2354654c6fcaedc9a963cb3e0a7e5b0858cfc5c5c7d

SHA512
dd8f5e343417a3e131b3362f1aecaf9ce0f8a55c9f90aa3b7e55b6ddb6c5f4e06b3e76a7f4481fa13e2f325ab2490553f6977178acf7c486c7315755c05fc7c3

Download Submit
C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE

Filesize
2.1MB

MD5
6b63036a88f260b7a08da9814cf17ce0

SHA1
cac1bd549343a1c3fcefacc2d588155a00c4467b

SHA256
8f9fb3c2ce132a64e157738feaf82bb512ec03d03fa2da95c26470defeef513d

SHA512
383b8676a85e0f2447536bd15019c23bed15a51d633dafe5ac7bcbea75d8064ef9fd938461eab25df7f3eae3de18b87640e8cc12e95f7b58de1209937d8da284

Download Submit
C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE

Filesize
3.7MB

MD5
525f8201ec895d5d6bb2a7d344efa683

SHA1
a87dae5b06e86025abc91245809bcb81eb9aacf9

SHA256
39a089d363b15c37cca9f747a17e89ad1dbe0bc86ff23466526beaa5e36d6d4b

SHA512
f0a2070f11eb3f0bdf996ada42becc7710aab76e84268e5cdbbd9ecbf13ef5fb85b52b6227711137a9c511f8d731b018530cbf1935f8fcfd61ff2ef6c1348d63

Download Submit
C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE

Filesize
549KB

MD5
61631e66dbe2694a93e5dc936dd273be

SHA1
b1838b8ca92fa5ca89e1108ceb2630a6ecd2b8c2

SHA256
5811b7b694d99c703b4c4bc72d6b7d846d05b2b0f45a7e3e4279cdb6fd81265f

SHA512
323463c267ccdb701d5967198f4f72158056f5a6e889c47bf19d1a670233ab071a5fe8c108430beb67753b77af1c59028007101a8e1266618fe91fa0127b4dcf

Download Submit
C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE

Filesize
606KB

MD5
9b1c9f74ac985eab6f8e5b27441a757b

SHA1
9a2cf7d2518c5f5db405e5bd8d37bf62dcaf34f5

SHA256
2a189b995a7283b503bb5864dd9ca57976b3812a6a34aaf89a7551336c43bc24

SHA512
d72e83aeaf1d34627a6c6aa469821af8a8d464a72c764fbb064484adea509a8c1d3628e2166859286e84daae8ebdf4f800693ce203984a8c313b1f2263e101c4

Download Submit
C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE

Filesize
1.4MB

MD5
5ae9c0c497949584ffa06f028a6605ab

SHA1
eb24dbd3c8952ee20411691326d650f98d24e992

SHA256
07dd9364be7babc5f9a08f0ccd828a9a55137845df1782b147f12943f234ea4e

SHA512
2e99bb500c281c367cc54fa283905b2537905ea4fe8986f676adbb1aaf58460dd2db082bb46a3dbe9dc836fbae3ee8832990839432dd99c74de58cc9b9295788

Download Submit
C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE

Filesize
1.5MB

MD5
93766da984541820057ae0ab3d578928

SHA1
ea19a657c6b1b5eb5accc09c45dcf04f063151c3

SHA256
ad3a9f7beaaea0bc49a7ccba83198cfb2882d462441203684076695b0ef6c514

SHA512
e14c86e13ab79fa9b9eb1a05d69764d522c4acfab7742c200080b215bb3bc31ec7f3dd2abf44cbc996d2e58a0ca1990b18ab055b232b243fe61b5fb018a9b719

Download Submit
C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE

Filesize
308KB

MD5
9a57f8da997449c9ae452cb759028f30

SHA1
e2a4d1930b818cba011c57bc562777202895335e

SHA256
48edc17d837b848081c41db9b277617e07634dfdf2dcf9aa4e08b73db129eff4

SHA512
af95a0dffbac9877c5b67086513cc26a7d0bd5327fffeb02fe5796ac49ab868c72c3ff4def2d333bfd7df5819ec42dd6f28d67888b7cd6d482419cd23e5fd89e

Download Submit
C:\PROGRA~2\MOZILL~1\UNINST~1.EXE

Filesize
141KB

MD5
7e3b8ddfa6bd68ca8f557254c3188aea

SHA1
bafaaaa987c86048b0cf0153e1147e1bbad39b0c

SHA256
8270ecef6079a21f5ae22f1a473e5eb8abac51628367f4acf6466529ba11d7e2

SHA512
675ca07cdb787b3f624eae9707daf519214f8dc4670c524cef5110c9dba197e833cedb051919c757c58a3687e63cf175d1397d8ce69c5995f4eab3b85f6dafbb

Download Submit
C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

Filesize
674KB

MD5
97510a7d9bf0811a6ea89fad85a9f3f3

SHA1
2ac0c49b66a92789be65580a38ae9798237711db

SHA256
c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

SHA512
2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

Download Submit
C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE

Filesize
674KB

MD5
9c10a5ec52c145d340df7eafdb69c478

SHA1
57f3d99e41d123ad5f185fc21454367a7285db42

SHA256
ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

SHA512
2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

Download Submit
C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE

Filesize
495KB

MD5
9597098cfbc45fae685d9480d135ed13

SHA1
84401f03a7942a7e4fcd26e4414b227edd9b0f09

SHA256
45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c

SHA512
16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

Download Submit
C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE

Filesize
485KB

MD5
87f15006aea3b4433e226882a56f188d

SHA1
e3ad6beb8229af62b0824151dbf546c0506d4f65

SHA256
8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

SHA512
b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

Filesize
485KB

MD5
86749cd13537a694795be5d87ef7106d

SHA1
538030845680a8be8219618daee29e368dc1e06c

SHA256
8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

SHA512
7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Filesize
536KB

MD5
3e8de969e12cd5e6292489a12a9834b6

SHA1
285b89585a09ead4affa32ecaaa842bc51d53ad5

SHA256
7a25fc3b1ce0f1d06a84dd344c8f5a6c4604732f7d13a8aaad504c4376b305cf

SHA512
b14a5936181a1d8c0f966d969a049254238bf1eacdb1da952c2dc084d5d6dcd5d611d2d058d4c00d6384c20046deef5e74ea865c0062bb0761a391a1eaf1640e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
738e7140393ddfbf69a6462ddf2a19a9

SHA1
1ddf8d55d29e93626978bc2ea2ce12f61de4fe77

SHA256
f385eb3652f0ba30ed307a71da3f43fbc2dfa60fbf077e8aef5899367125a13f

SHA512
739a2b7df55f4d1b707f304f3d91c7e7a0ba3d34a796646b06087468346a876f7f2b0e4b46703514e3b696370e15453c9a96d57b55357b33e317a9ef19d7ade8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5075008e939fccebd61c94aec5c4483e

SHA1
f63440896a8681d42583cf5d0deb937c3ee35617

SHA256
4a718ad8167832db9bf89795c51c52a28f5827113723d05b803f5163d81c23c7

SHA512
4b1d88949892739f2346f068c1746c5e4deecda4f8a1a2ccf8fcbeb1254fa8b66dbf27f16600946cb9486ddacdeea2672348c2587ae5c949559f7edd2b1f6280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e70dcc69f53fb99f465302866c8ae2f2

SHA1
278a6cbeb5836436c8673815c2c521f389c6233d

SHA256
8fec2b015440995fbe139f56a6661e960f745eb40eb0b0b9464fcfbbd6245fec

SHA512
bfc7735bc1896e8251a16ee754a8ca45c41bbbb0f2ac77a5bfa4d85e874c686ceda0d6280a59e7d6ce4abd13ffcbc4cb6f4b3a40538c6d1ff80e76388981459a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
703c612750a9f6cb3c68bcb11149784a

SHA1
25189d485ce6a6faf7827d13564984424824a998

SHA256
a63761e107c0d4421d76732f31df9d747f647341488625d5d80a1ba66cdf0af6

SHA512
d45563cce7499655edf9f2c7f432634ce915418d4375eaf7602d773cdd943413a84491b62973225314e4e565c53248936130466dd5277130d6cd7e9e47843f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c50ba7586dd7e667f2732fd3827f22aa

SHA1
d4bd4f9f07085f797cf3bee735ab08f935ff5881

SHA256
3c965a943ad1aa032530252a225a747e200d29d8f2934cdb3601f1c08dcca4bd

SHA512
b3005bc028bf8caecdeb7a545c4b046f85593abf72f35a676962ceb8da55d4dbc20d710b18c546cc79604f26b4a18572f66c917b60edcb1d82c4cdb98516b544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bf70c00ccd8a642a1f0c80b79cabdca

SHA1
63215dce3a4ec783cfff4868b8ddbd6974761e6d

SHA256
54b05736a961fb0e3d935d327d5aa45ea7fe8bb78946bc73f10ad47416a365e1

SHA512
afa221cbc00ddcb287c686fd77afa6a4677443a55dae8ec6185de36275b13e6eddac69729d5197dc68764efb0d7edc20366b2c1601e06dd0b78124b6f88747b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56b81b7df121018e70425e311145867e

SHA1
777caa9d293569db733e3bba3af71777df5f16cf

SHA256
f271d7b9084f12f6774ae229ce8d9e65940bb9ae42689e8bbdc421c3be6d93d3

SHA512
832bee92e522cdb599bf68a4aa9b8621289985e81900dd09ada4e35570d7320d90beec6fa7cff8e9344279ba6d2d09d8b52c2f0c650165c7b951b5406e89b933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75b02c144f2024845db57e748387eaa5

SHA1
5a7feba7634e352921a22bb81db20d3e65f34285

SHA256
b77c036a7a4343ab050e8b66e8a4bd524506368b2a45bd546dc9eaf660647ac3

SHA512
6ad882dfd41e9f486144de87e07bf245515ed92b3e1027f62a60fd51460feb4038189a6384aea0f988733e85b4bd645eb917183b51196d55a438f5f016b1eef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a19cd30a4e2f1a8a9f557c769137af7

SHA1
9790c2f4125c57714e4108a06b2bc597b5c34f8e

SHA256
4f31f875de47dd4ec3a4e17cafabacc58c489619c842e05821093c2758225d99

SHA512
df1bd5251a3585d39716d724f4c3aba40e508537405b65d7984e89ff176bea729069d87e74cba2608e00d4ef465265fd53f73b3070248fe449373a8ee60c8a56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd76c28ca723878f3a64a68b5ba171c9

SHA1
957e1f962de7aeb4ec0c4a24311cb98369aff69a

SHA256
32a1ef92b7f52fab01f01d603d64f5612b27bd120027e90bf412f94baba220f5

SHA512
21759f5b7baddc7f054e68234d4ac251d11973ba4dddca3c2beda1fc18faf2b7388249358f21e7d2e29c0cff5980043a90979999ab499b8c756aadd7dd292dc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
751b964a804289f6fd317f5d7a5b4216

SHA1
d1910abebde50bd656206ff4b9a9404b75400b12

SHA256
c43e06a658a6cfb46207b2962dc22c7f0fa37397ce4594086f8b566c2bc34ee8

SHA512
9031abfae7e5b9d54a82be7cf30b8c6a97e428ac2faed41004f31d739671d64b66ae91f75de627432ab2344067522ea176b2be8fc41f3933a793e8bcff9fd620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df26b7d4fdf837866e8f269b456e9522

SHA1
22a67a3ab800d5fe494711dc7709bdd681f48113

SHA256
512211fda5c1ac482c278be8a06a7699441aaedb333d89500d662e19d760f7c7

SHA512
755161b9db76b3bc5a250f78d1f5e56c7631288dacaacb2c02de7fc553fbe8f24af9575c7d20e5f6909bdfa2956234ea035c5a90fa6cd1975c87b3e16caab448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d122bb6504b71ca643886672c7b68991

SHA1
ac3ed4a0246473c47bcc570432710232e61319c5

SHA256
d5bf6a2a819bda48b863ee5b38f887f5ce226463989547302b58d5ff389c1af5

SHA512
31654f72b02892d8dcdc3f2cc878030425958dc398778c58401b87a13435a526543eda45fcf47a38a4a7679490e83b1e225313d4590bdc69d89b9eea9ab97e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8499f4f6cba7f154f5155049985d839f

SHA1
6d990baff7228267e3cc0393e4d4eba05ac0e609

SHA256
77cc8b9879eae1cc521861ae392fe3ed5f2157532551b92a1b44fc8673feda0c

SHA512
0afae14ed4f61f21f98efe467c40c5bf9125aeadacc309805899ceec2ea9842f6062202f0caaac9846643ebb7dee9af536e87aaff2e24db3e6e477db57886d89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90b8d9a8b3ae86188ee0b0eb1c3acc18

SHA1
50e42ba7462079ba3c6ad34eeb437df2558d4dfe

SHA256
da735ae5e5b59c8dcd45997cc6d189eeb21b962c6e6d9ed400e7a8b8d2a67084

SHA512
ec359e5e30b283ed93ee9f3acfafde4f3449dc0a44334e8964a4360f678f6fb3d63c561c6276ec785ae5cc0b4ed123bf6f60555e6acdd185f22c54154414051d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77fdc427fe72b53af86224f8b0b57479

SHA1
0fcfb8957aee2d3ccbaf42f0cb7598d521a17217

SHA256
111a9f3d79aa016ac663270c0cf7a963084c290d73743b5edb818e87ca150020

SHA512
d724dd28336cb7abb4a0f78e1496071df90b5ee82ead7ad1ca7fc7fa44ad282f5fd2647e012918217528874a7b0864e20c5faac0ddf43d80f8af0adc75e57b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33b1bf5d6c35230656a86c24d7e7ba71

SHA1
c1efa005f8016f129964641a8ce3d40764787264

SHA256
0f66f1bfb4cf2ad327f10054ce2c75a79c248090683460bd535bc30d33a3ef12

SHA512
3017acbd6fc9b11c4f19b17b3d8c853190efa6480119ad1e1585bdbd0ff370db8c55ee29df9348b0427f90f2c9c210f0c9c26720a1b335e80c2f5adb025402f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb94e6447c5ad832003cf1402af8edc1

SHA1
6962a5681a17010cc85282281cc105b053666811

SHA256
37f411c2e92c2600e4acca9a14ae07111c8fe884f0c330a1eaec464ddd496528

SHA512
fb006c502d7c355827b0993bf667fbd5bd43ad846894dac1c6a9a95d63cb089299c4425ec63dfdfc532299b44ed630e81f2cdc11ad819b135587f1dd6344750b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c1afc6dd948aa113ff5a2f925daa706

SHA1
3a8ed6fe848f66e867e0128069ec298a6b968ce1

SHA256
1901972e5bbb11168401971f2945fa4f1a79d39e8cb50d1a708d351de9827436

SHA512
637719290b1551a70258cea826a3490017a07af6f384b798172fc6c36d71a13015f1c5219bd9d5611424b7e98a8f0ce64fa888f938bdbf75978323df8c041e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d42eee7ee036b4b04b23890732e1b6d

SHA1
8abcf44c9df3315c0b27eedcf50bd0ea64d7c96f

SHA256
4b8b424a0bae18c015986a5be08792e3768cf184f0d987dbecf34cc72a34c9f9

SHA512
3a2a1a6cc230909d7bfa44a86f957212b7b5132b7c9e0a19b2b689cc2e81987f15f2cb36715516912ecaed20f23438b0d6fa32e4e501d738fd84bcce9a493cdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caa34ab2acf08e1e1844a19027e72400

SHA1
2e7588e527204f3a0b930994d4994abe7271be25

SHA256
9d525aa93d3b35ff24f3e087b0b619b3e3fe60a8f1c772fee1f2d24fd600a404

SHA512
b0133f74844aba7c2b4e20a6025337aae34e021c4648a22b5b7b27c9c9f977da629b21dceeb7b711fcb0d07b207489041da29be8d4681dbe4f705695b62238f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE22.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\PdnSetup\PaintDotNet.Resources.dll

Filesize
552KB

MD5
be359415d2f8e7452a11998d0f950f7a

SHA1
58db4281475dca15824f347294683ca820a83844

SHA256
ab9b3b48417fd7daece8f5452e7234d7743321db22a7b5178f8d1f11f93be274

SHA512
5d61d377d459c1a7d610df5611a7bd31b69a687213892cf916aede964e2b7119ea936c267570ae6b466ca08beeabbdce4677913ce7905f82d80c49a56a43e2b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\PdnSetup\PaintDotNet.Strings.3.PT-BR.resources

Filesize
92KB

MD5
40c8120eeb698c29e5a40e9cb389e01b

SHA1
7b28adccad49c4937643473923c13161750f2036

SHA256
2b2ce3519c95b06aa887d5e449fae5b5f2decdf23fc7d9afb8fd87224950b64f

SHA512
4cc6ec9e28529182529c696c4b43003f60ce2e2a2852c20e0b60990a349890cb319b72f8bd12519b97f17a69ef0a44874292973ca241436a46e06c25883ba4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\PdnSetup\PaintDotNet.Strings.3.resources

Filesize
89KB

MD5
83c5cf4cdfe84dfde372bedce6c4b18f

SHA1
947650502c065787eb3666d02d17e2f925b4b1fe

SHA256
dbc7079c055eb648cbda96d7ddb8ccd10e942025a973542e9ca0f108ce7845c5

SHA512
918c919eb34ee30f99c9d75c8ce5f18d4b4d4ee960b40ac4764d19d68ce815f608344fc668d9a76c55565ce1a68819bc81494a5581f55c301967a870a03b7ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\PdnSetup\PaintDotNet.SystemLayer.dll

Filesize
104KB

MD5
3a35ddd7e645cc72463e65bf069af34c

SHA1
42ea566b749a6c3457fb228a1b99b51e7b47f83a

SHA256
7a044ee7aa10e66e85907e7980299886c759f6bdc99f6fe087b91347bcce741a

SHA512
621f1f120ecb8d794132350458f289ba4417b6b642f8a85c399556c9d888b94810fb6de6c8f869e76a6f185cb3e2533d360a5798223791fa37422c83c6691e18

Download Submit
C:\Users\Admin\AppData\Local\Temp\PdnSetup\SetupFrontEnd.exe

Filesize
64KB

MD5
30ec851e863543f39517bdd57b1b7e45

SHA1
b0be403bb0ad710511bab100700a10e3d9ca4480

SHA256
ccbce0b243818447e3a77e185ba83c18f551ae1d0477f5754902371c1f1086ac

SHA512
53525d00f16ea772a6af86d7c38bfd4b4e5474b018e476de4c47b600ff9b0506b30651e55d04b6d534071bcd48ef21b715fa53ad4d158385c5baa24a4ef0632e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBEC3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\directx.sys

Filesize
72B

MD5
c9d79515bb506e31a426107ee5fa5e32

SHA1
4afde3be27b00dc755dbf77ec6de8ab57f15d9f6

SHA256
7d7c33f649a910db68290bcda66b773c3e17ac9d5eae56397a245bcc37ea8fe1

SHA512
80404ed01270ec0be2074aebace97484ddf61eaa8055e60610c52deeb3bcd2cd3cca977faa313c07fd77c9faf6d368221812095a28200f72f5591590c17722b3

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
eb016acd5b7c3d7a351042922627471b

SHA1
67c10c065ab4a8d1467a5cae7d810cf07d7f89c5

SHA256
f824307212a801f5e311f6af0f5d05830ed3873795d1313c1aa380cf62393d21

SHA512
031d97dafecace124e6d32844df24f1bcb6a736b7211c4d02fec2b5f0e30686e4a764c77964bc38408aa0dd05dd0c1e6a6b58dffe426166c77cac30054cd696e

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\bd732f8c32faa0991c349bbc53d7d6b6_JaffaCakes118.exe

Filesize
3.6MB

MD5
0f8a97136a22f9f04f4ba93fa82a7ed9

SHA1
d98a8a249725462929a9ecca8f418b6e42f20bd6

SHA256
42f7df69816af88366b35a8ea6bf37f72ed0d5147f7452c7f0c51dd4e1dad5c2

SHA512
aed1e2feb8babc2d4314c662c2bf8713ccfc2efe0103d55bf67692ff85ddd0f163357dedfdb2ab49a4564a63b6f5f544421320856961c6082fec91bda6247dd7

Download Submit
\Users\Admin\AppData\Local\Temp\PdnSetup\SetupShim.exe

Filesize
63KB

MD5
0753296ccb4b8341b9a51295125d9c4c

SHA1
cb9513f6058aeb891924d290bfb1488d93f365df

SHA256
e8a262217986c6f2e300c6be56a0b74623ece096f3cfd1ce9f54faef031a139f

SHA512
d215eb376a0dd373f8c20fceea0c298c350a68e7d05f1c15dd3486d955adee6385e5ec2e12fafea4c15d01fa7d1708779c4b5e15de080bacb22fa3330b8dca36

Download Submit
memory/2532-180-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2532-616-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2772-42-0x0000000001F20000-0x0000000001FAE000-memory.dmp

Filesize
568KB

Download
memory/2772-44-0x0000000000420000-0x000000000043E000-memory.dmp

Filesize
120KB

Download
memory/2956-615-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2956-181-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads