Overview

overview

10

Static

static

3

fa678b54bc...18.exe

windows7-x64

10

fa678b54bc...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    22s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 06:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fa678b54bc6dc42ca74ab104203475fe_JaffaCakes118.exe

  • Size

    951KB

  • MD5

    fa678b54bc6dc42ca74ab104203475fe

  • SHA1

    151df3753808b3d44b5a5255c820c8b928658c1c

  • SHA256

    38e98d7bea3c4297e939f8940dc3c2855caecea427156dbe001ea43d03d4a947

  • SHA512

    e893d49a446900fbfda12b1a2540a478132db22214fa849e3d95b7b6b8be6783a4e116e614fcde7afe731323492963219aec0cbd21797905ecea74af5b142af2

  • SSDEEP

    24576:SUFa7K4Jy/fVtktVGPrfO/WxvaXUTcLHFpSYiVtktVGPrfO/WX:jqMlSyfO/WxyXukHFISyfO/W

Score
10/10
salitybackdoordiscoveryevasionpersistenceprivilege_escalationtrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 4 IoCs
  • Executes dropped EXE 7 IoCs
  • Windows security modification 2 TTPs 14 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 39 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:776
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:780
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:384
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2964
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:3000
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:692
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3412
                  • C:\Users\Admin\AppData\Local\Temp\fa678b54bc6dc42ca74ab104203475fe_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\fa678b54bc6dc42ca74ab104203475fe_JaffaCakes118.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Checks computer location settings
                    • Drops startup file
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:4272
                    • C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
                      "C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
                      3⤵
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious use of SetWindowsHookEx
                      PID:3648
                    • C:\Windows\SysWOW64\net.exe
                      net stop "Windows Firewall/Internet Connection Sharing (ICS)"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2108
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4232
                    • C:\Windows\SysWOW64\net.exe
                      net stop "Automatic Updates"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2040
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "Automatic Updates"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:4616
                    • C:\Windows\SysWOW64\net.exe
                      net stop "Security Center"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4092
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "Security Center"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1732
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh firewall set opmode disable
                      3⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4812
                    • C:\Program Files (x86)\Microsoft Office\OFFICE11\ WINWORD.EXE
                      "C:\Program Files (x86)\Microsoft Office\OFFICE11\ WINWORD.EXE"
                      3⤵
                      • Modifies firewall policy service
                      • UAC bypass
                      • Windows security bypass
                      • Deletes itself
                      • Drops startup file
                      • Executes dropped EXE
                      • Windows security modification
                      • Checks whether UAC is enabled
                      • Enumerates connected drives
                      • Drops file in Program Files directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:2880
                      • C:\Program Files (x86)\Microsoft Office\OFFICE11\ WINWORD.EXE
                        "C:\Program Files (x86)\Microsoft Office\OFFICE11\ WINWORD.EXE"
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:2548
                      • C:\Program Files (x86)\Microsoft Office\OFFICE11\services.exe
                        "C:\Program Files (x86)\Microsoft Office\OFFICE11\services.exe"
                        4⤵
                        • Drops startup file
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1012
                        • C:\Program Files (x86)\Microsoft Office\OFFICE11\ WINWORD.EXE
                          "C:\Program Files (x86)\Microsoft Office\OFFICE11\ WINWORD.EXE"
                          5⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:332
                        • C:\Program Files (x86)\Microsoft Office\OFFICE11\services.exe
                          "C:\Program Files (x86)\Microsoft Office\OFFICE11\services.exe"
                          5⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:1996
                        • C:\Program Files (x86)\Microsoft Office\OFFICE11\smss.exe
                          "C:\Program Files (x86)\Microsoft Office\OFFICE11\smss.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:4820
                        • C:\Windows\SysWOW64\ping.exe
                          ping www.putera.com -t -l 3000
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:840
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            6⤵
                              PID:3528
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.tourism.gov.my -t -l 3000
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2668
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              6⤵
                                PID:3476
                            • C:\Windows\SysWOW64\ping.exe
                              ping www.miti.gov.my -t -l 3000
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:2600
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                6⤵
                                  PID:2808
                              • C:\Windows\SysWOW64\REG.exe
                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                5⤵
                                • Modifies registry key
                                PID:456
                            • C:\Windows\SysWOW64\REG.exe
                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                              4⤵
                              • Modifies registry key
                              PID:3868
                          • C:\Program Files (x86)\Microsoft Office\OFFICE11\services.exe
                            "C:\Program Files (x86)\Microsoft Office\OFFICE11\services.exe"
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:2408
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                        1⤵
                          PID:3560
                        • C:\Windows\system32\DllHost.exe
                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                          1⤵
                            PID:3752
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3844
                            • C:\Windows\System32\RuntimeBroker.exe
                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                              1⤵
                                PID:3912
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4024
                                • C:\Windows\System32\RuntimeBroker.exe
                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                  1⤵
                                    PID:3488
                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                    1⤵
                                      PID:3408
                                    • C:\Windows\System32\RuntimeBroker.exe
                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                      1⤵
                                        PID:2256
                                      • C:\Windows\system32\backgroundTaskHost.exe
                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                        1⤵
                                          PID:4440
                                        • C:\Windows\System32\RuntimeBroker.exe
                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                          1⤵
                                            PID:3224
                                          • C:\Windows\system32\backgroundTaskHost.exe
                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                            1⤵
                                              PID:720
                                            • C:\Windows\system32\sihost.exe
                                              sihost.exe
                                              1⤵
                                                PID:860

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Persistence

                                              Create or Modify System Process

                                              2
                                              T1543

                                              Windows Service

                                              2
                                              T1543.003

                                              Event Triggered Execution

                                              1
                                              T1546

                                              Netsh Helper DLL

                                              1
                                              T1546.007

                                              Privilege Escalation

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Create or Modify System Process

                                              2
                                              T1543

                                              Windows Service

                                              2
                                              T1543.003

                                              Event Triggered Execution

                                              1
                                              T1546

                                              Netsh Helper DLL

                                              1
                                              T1546.007

                                              Defense Evasion

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Impair Defenses

                                              5
                                              T1562

                                              Disable or Modify System Firewall

                                              2
                                              T1562.004

                                              Disable or Modify Tools

                                              3
                                              T1562.001

                                              Modify Registry

                                              6
                                              T1112

                                              Credential Access

                                              Discovery

                                              Peripheral Device Discovery

                                              1
                                              T1120

                                              Query Registry

                                              4
                                              T1012

                                              Remote System Discovery

                                              1
                                              T1018

                                              System Information Discovery

                                              6
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              System Network Configuration Discovery

                                              1
                                              T1016

                                              Internet Connection Discovery

                                              1
                                              T1016.001

                                              Lateral Movement

                                              Collection

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Program Files (x86)\Microsoft Office\OFFICE11\Drvics32.dll
                                                Filesize

                                                808B

                                                MD5

                                                f9144a29af9775feb89b66bc8679dff7

                                                SHA1

                                                86a1246436e2f6c26a7de1a36f7a94cfd6e8202b

                                                SHA256

                                                37dd8b6797dc589dbaebb4c6db3b4f343389caf3c68a298b56a8f4faae1d0284

                                                SHA512

                                                0c13f645591e85bb8ce4e43bde458e0c2ea771382d1738a495c20d21580a22d6b194a7e1c543c3fa395e2e2c9fc27710cccc1af5742037733b8398ee8dcdd74a

                                                Download Submit

                                              • C:\Program Files (x86)\Microsoft Office\OFFICE11\PUB60SP.mrc
                                                Filesize

                                                8KB

                                                MD5

                                                cf07b3218b7a13466a3ab1abd929dc04

                                                SHA1

                                                0357e87e477c6c91af0dae6c7528089112bc4adb

                                                SHA256

                                                0f19bef5cf2a0d134e2a8845caf5f8a57925c57c5bcc70b671fdf2dd71f52990

                                                SHA512

                                                42e79e6bc3a1b183219fd327531402dd16dab72f1b6a4dd5475ffd5c556ee7a5564962a10880551d9bc27f989fd90beae3756349512e383eae9b3bd5b0bd1cbd

                                                Download Submit

                                              • C:\Program Files (x86)\Microsoft Office\OFFICE11\control.ini
                                                Filesize

                                                176B

                                                MD5

                                                fc0e51b62b341213d142b5061fe88606

                                                SHA1

                                                a36c06ee541061a30ae14702c6d422366f1efda3

                                                SHA256

                                                ef820d65689bda87756d2b775f286d992717289bb2e9bb2843903e05a87df3ef

                                                SHA512

                                                5f44293217227a29f8031837ff87d7777cb425fb7b3684e925b349c54084d1a52bc1be6b19678c7dd20ed885c34dcafd063676549cdaaa93f1685d7ae8e9a70f

                                                Download Submit

                                              • C:\Program Files (x86)\Microsoft Office\OFFICE11\hjwgsd.dll
                                                Filesize

                                                18KB

                                                MD5

                                                ed6b628f8fcc9e5b4634047546b78091

                                                SHA1

                                                51d55b389381a84205ce07526b606f353e64a8dc

                                                SHA256

                                                8aaa8cc5cee89de645ddc34bbaa4fe00274c4802ebda7120d1904fec1137fa33

                                                SHA512

                                                ac97820615e26bd51cbc989fcbf3a028f2e5b12658449b4b6692f3cd82b2df08967118ee05aa7fd5063e439d1a0afbb611aa19f11a28d830612512a5438f63c7

                                                Download Submit

                                              • C:\Program Files (x86)\Microsoft Office\OFFICE11\jwiegh.dll
                                                Filesize

                                                267KB

                                                MD5

                                                3814086d561a22ed9005ba4f35c5987c

                                                SHA1

                                                30f3059629c123223208659be7ab45c234aa9434

                                                SHA256

                                                5d918c11a0efcfaaea5981aa4b25520584e33d09e4e940c65078ca0581673387

                                                SHA512

                                                55197cc81b499b35e14aa80f84a44449335fc85f3b2d757dcea2b1b172ceb7cb0ed4805dd1503d2fb1c3e680f4df0a9487e70b0fa270d4c5cb88e3a00370c9cd

                                                Download Submit

                                              • C:\Program Files (x86)\Microsoft Office\OFFICE11\remote.ini
                                                Filesize

                                                20KB

                                                MD5

                                                d982ae777e8e44019b24bc272d84d582

                                                SHA1

                                                a490d6472e8ee57fe7f6046a911dfdf6a5e4ed95

                                                SHA256

                                                b9681ebd6aaa8276d307c2e5243eecfea97e045b9ffd432ad75974fb818cac82

                                                SHA512

                                                25321a7325e330d37323e05a9a045fcd515cacd9555ba413eab1709cd59db92fbcfbb424ed150199720a338e0017331f4e1fbfcaf5763b64280d9ea29bcf06b2

                                                Download Submit

                                              • C:\Program Files (x86)\Microsoft Office\OFFICE11\ruimsbbe.dll
                                                Filesize

                                                2KB

                                                MD5

                                                b023650f83ebe604181f657c0d8a4be1

                                                SHA1

                                                28b808d1fb4e9a6022c8a7de29248fcdb583eea9

                                                SHA256

                                                1b12ded49161bc6bf18bf521fe233be4f41a4107d0c76fa2fa66a8023828fa36

                                                SHA512

                                                8c4b703a19ab8be5c1c7fdafa1380e4c83f99370afae6dd938ef78066458665668ef4076740d151b6ad53eedc94b5934f486090058ead456d474e96fb7efeeff

                                                Download Submit

                                              • C:\Program Files (x86)\Microsoft Office\OFFICE11\smss.exe
                                                Filesize

                                                563KB

                                                MD5

                                                81cfac8335822ba4bea1e50c46adf967

                                                SHA1

                                                ea360da28b5aff7112b6f42404dc2ee2610e640c

                                                SHA256

                                                1829bf1ccae25c61dca8eb1b4fea10c47276157cc619efb6ab8a8804592770a7

                                                SHA512

                                                24dee2758eda2facb07c814737e4f20ea718a4ef42294dfc97a61c1af7b271df5ef0a0d414199ee89c8c496a1063d217173e32bcf4f305c3b41dca1ccf30c738

                                                Download Submit

                                              • C:\Program Files (x86)\Microsoft Office\OFFICE11\yofc.dll
                                                Filesize

                                                2KB

                                                MD5

                                                05e9217895f13d8b004c83d8223957cc

                                                SHA1

                                                5655ea6576dceaff14b7b27f4b347e85f322f9b1

                                                SHA256

                                                0b767361d3dfbaa8ab7748eb0aecb104f394b4473b228e269addaebe95e2a4d6

                                                SHA512

                                                8188c722a25d45a857712be7673a1b9bf43d1f4e64d891004d6b71ba6a20894f0fb833e877230b5cfc833b4d05a0d1a44c930aee6c9fcd3c712e149496482bf8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\TCDE7B1.tmp\iso690.xsl
                                                Filesize

                                                263KB

                                                MD5

                                                ff0e07eff1333cdf9fc2523d323dd654

                                                SHA1

                                                77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

                                                SHA256

                                                3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

                                                SHA512

                                                b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
                                                Filesize

                                                2KB

                                                MD5

                                                6f0feee00d6a081fdd660c1eaeb820ba

                                                SHA1

                                                a252d4db80e516e8101738719c97abafcec865c9

                                                SHA256

                                                a868dbf9b92344188ee2b849fbad6970967d9ec353aaafc7d0b90ba672b4c26a

                                                SHA512

                                                56df97620585a0b7b69722524fc8fc34ace3717008ce95362915223b50413f4623ff75799dc81538dff20d8ac45898b3d922b6101d438b49f984cd3aeb54a725

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.com
                                                Filesize

                                                951KB

                                                MD5

                                                fa678b54bc6dc42ca74ab104203475fe

                                                SHA1

                                                151df3753808b3d44b5a5255c820c8b928658c1c

                                                SHA256

                                                38e98d7bea3c4297e939f8940dc3c2855caecea427156dbe001ea43d03d4a947

                                                SHA512

                                                e893d49a446900fbfda12b1a2540a478132db22214fa849e3d95b7b6b8be6783a4e116e614fcde7afe731323492963219aec0cbd21797905ecea74af5b142af2

                                                Download Submit

                                              • C:\Windows\SYSTEM.INI
                                                Filesize

                                                257B

                                                MD5

                                                839864f0df56511277ab90704bec5bad

                                                SHA1

                                                562f29e2b727cae979842383591191d04383f29f

                                                SHA256

                                                6bade69e097c6ad1ce6e5a524a33c13d1ad51b61ed295b899ace640970f70531

                                                SHA512

                                                0b59d12c820660d896c1a1f482cae60d91b1da358a52f4479e6e393afd5d19d47af8eea07b4116457c1dceb7fcb4b77cc981c1b84f2e32c22d524860fedef35e

                                                Download Submit

                                              • C:\wgcne.pif
                                                Filesize

                                                100KB

                                                MD5

                                                3bc68e3332ebd07f810cdbec74b0b47b

                                                SHA1

                                                6bb7f943d00115e79b2b67fea3b0047222d0a25b

                                                SHA256

                                                88b505696d55775fee9d7cccce22930f8ed68cf24aa5bd32fc5359848e9636d8

                                                SHA512

                                                fe854a4d14650338d9650bc1576f8d3c00151d96d56be0864a77cf2666f97de67bd1a81c5d7a0da357a893ce8d0ced7e4f93b0568393e1b971de10856c156f24

                                                Download Submit

                                              • memory/332-102-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/332-107-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/840-166-0x0000000001340000-0x0000000001341000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1012-88-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/1012-164-0x0000000004290000-0x0000000004291000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1012-150-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/1996-109-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/1996-119-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/2408-141-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/2408-122-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/2548-84-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/2548-90-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/2600-170-0x0000000000850000-0x0000000000851000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2668-168-0x00000000009C0000-0x00000000009C1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2880-160-0x0000000003B30000-0x0000000004BBE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/2880-52-0x0000000000640000-0x0000000000642000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/2880-157-0x0000000003B30000-0x0000000004BBE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/2880-120-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/2880-158-0x0000000003B30000-0x0000000004BBE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/2880-154-0x0000000003B30000-0x0000000004BBE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/2880-153-0x0000000003B30000-0x0000000004BBE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/2880-51-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/2880-162-0x0000000005800000-0x0000000005801000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2880-159-0x0000000003B30000-0x0000000004BBE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/2880-155-0x0000000003B30000-0x0000000004BBE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/2880-151-0x0000000003B30000-0x0000000004BBE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/2880-156-0x0000000003B30000-0x0000000004BBE000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/3648-55-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/3648-60-0x00007FFAF8110000-0x00007FFAF8305000-memory.dmp

                                                Filesize

                                                2.0MB

                                                Download

                                              • memory/3648-54-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/3648-59-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/3648-65-0x00007FFAB6020000-0x00007FFAB6030000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/3648-80-0x00007FFAB6020000-0x00007FFAB6030000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/3648-144-0x00007FFAF8110000-0x00007FFAF8305000-memory.dmp

                                                Filesize

                                                2.0MB

                                                Download

                                              • memory/3648-61-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/3648-62-0x00007FFAF8110000-0x00007FFAF8305000-memory.dmp

                                                Filesize

                                                2.0MB

                                                Download

                                              • memory/3648-63-0x00007FFAF8110000-0x00007FFAF8305000-memory.dmp

                                                Filesize

                                                2.0MB

                                                Download

                                              • memory/3648-53-0x00007FFAB8190000-0x00007FFAB81A0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/3648-58-0x00007FFAF81AD000-0x00007FFAF81AE000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4272-1-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-14-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4272-9-0x00000000007F0000-0x00000000007F2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4272-4-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-127-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-143-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/4272-95-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-64-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-82-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/4272-0-0x0000000000400000-0x000000000050F000-memory.dmp

                                                Filesize

                                                1.1MB

                                                Download

                                              • memory/4272-83-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-15-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-5-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-108-0x0000000004C00000-0x0000000004C02000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4272-47-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-3-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-8-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-13-0x0000000004C00000-0x0000000004C02000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4272-18-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-46-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-12-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-17-0x0000000004C00000-0x0000000004C02000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4272-16-0x0000000004C00000-0x0000000004C02000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/4272-6-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4272-7-0x0000000002DA0000-0x0000000003E2E000-memory.dmp

                                                Filesize

                                                16.6MB

                                                Download

                                              • memory/4820-117-0x0000000000400000-0x00000000005CA000-memory.dmp

                                                Filesize

                                                1.8MB

                                                Download