globeimposter | 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2025, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
Size 50KB
Sample251101-13ch8ags6b
SHA256 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7
MD5 32a3e8753d7d8aee340e74906aad24ed
SHA1 7c47817efce809af0d25d179d673f7dc9b413248
SHA512 5691c1f5ea1a8ec217d9be8683eb082cfe67e8908090a41cae630d33f3a8f392d39cee01887028c7d281951cc57255954f7949fd57c1e746838736db229e141b
SSDEEP 768:t7vuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5CN:tveytM3alnawrRIwxVSHMweio3MN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery globeimposter persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Public\Pictures\HOW_TO_BACK_FILES.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. DO NOT TRY TO DO SOMETHING WITH YOUR FILES BY YOURSELF YOU WILL BRAKE YOUR DATA !!! ONLY WE ARE CAN HELP YOU! CONTACT US: [email protected] [email protected] ATTENTION !!! THIS IS YOUR PERSONAL ID WICH YOU HAVE TO SEND IN FIRST LETTER: ��B4 B0 60 EF 8F 25 7F C5 76 A2 C6 E8 D2 E5 FE 62 A7 95 29 79 53 E5 90 A6 E8 63 76 CB ED C9 FD 9F 43 D6 E5 20 50 15 AD AE 93 EA 42 D2 93 BA 6C 56 3C 10 19 D5 A9 27 E4 80 CE DB FA 83 33 4F 7B 22 A2 97 0D 6C E8 31 28 AC D5 2C C8 C4 DB B4 06 20 C1 EE 74 DF E2 39 A0 10 AC D3 83 AF 1B 04 7F 68 D2 77 A0 23 16 41 D1 DF A9 A0 C6 81 F5 26 86 26 7F A6 0E 8D 7E 40 D7 1A A8 0A 77 B3 CF DD 99 9E A6 D7 DC C9 E6 C1 61 C5 D4 9A E4 0E 3B 3E 68 18 30 A1 9E 5A 52 1F A3 6D 01 F5 4D A3 7E AD C2 E5 A4 30 6F E1 FF D7 E7 6C 76 09 21 83 02 DF ED 64 C9 36 77 ED 57 70 EC D6 DE FE D6 72 E4 E9 F6 47 E5 DC 6C 7D 15 47 A7 9B AA 56 67 E1 A2 1F 30 CD F0 7F 90 06 96 C6 8B 1E 7A AB 2B B7 9E 19 D0 0D E3 88 D8 27 CA 26 96 BD 21 FE E5 A8 CC D8 2C 87 BC B7 BE 3A 6C F7 2A 2F A8 6F 68 FB 82 A2 39 EE ��

Emails

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Globeimposter family
globeimposter
Renames multiple (9017) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Control Panel\International\Geo\Nation	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Control Panel\International\Geo\Nation	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe

Executes dropped EXE 1 IoCs

pid	Process
1092	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe"	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe

Drops desktop.ini file(s) 43 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1919182765-2457925700-1517026611-1000\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Public\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1919182765-2457925700-1517026611-1000\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1919182765-2457925700-1517026611-1000\desktop.ini	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\WideTile.scale-100.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.scale-100.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleWideTile.scale-125.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\HOW_TO_BACK_FILES.txt	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\HOW_TO_BACK_FILES.txt	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\star_3qtr.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\mso30imm.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-100.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-125.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Xaml.resources.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare150x150Logo.scale-200_contrast-black.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsWideTile.scale-200.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-36.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-400.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Fonts\BhaiMDL2.ttf	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview-hover.svg	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_achievements.targetsize-48.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-40_altform-unplated.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppStoreLogo.scale-200.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileSmallSquare.scale-100.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-32_contrast-white.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\ui-strings.js	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ko-kr\ui-strings.js	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-24.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\SmallTile.scale-200.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-100.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-400.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-100.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicudt53_64.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Calendars.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\uninstall.cmd	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-80_altform-unplated_contrast-black.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OSFROAMINGPROXY.DLL	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\HOW_TO_BACK_FILES.txt	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebSockets.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg1a_thumb.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\hxcommintl.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-125.png	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Controls.Ribbon.resources.dll	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 5144	1092	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe	104
PID 1092 wrote to memory of 5144	1092	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe	104
PID 1092 wrote to memory of 5144	1092	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe	104
PID 4528 wrote to memory of 5988	4528	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe	105
PID 4528 wrote to memory of 5988	4528	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe	105
PID 4528 wrote to memory of 5988	4528	JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe	105

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5988

C:\Users\Admin\AppData\Local\JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
C:\Users\Admin\AppData\Local\JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

createpdf.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\createpdf.svg
Size 10KB
SHA256 65d669f6b8dc4f111e3f899ce4e90a1554cfa01502bf501132695e05e3d74080
MD5 8240db6acb271a563ea5d7dec44a5fa3
SHA1 d1d773972429a2a7afecfe6d9733d0f595575ec2
SHA512 f320e84aa9b8ab0c7ffe378a5b518b8b06a1fac50abfcd698e0ff432e460204ec9f2f5885d3438bc46529e9f91e3daa31be4f59d2fc8780e617114dfaae72c99
SSDEEP 192:QMAe++2uXQEiax739YyaKbNpzTjncvlvYNCRSCI3JIi+fBHP+i5Zt+i5Zs:Qw+uvWyvncNvcCRSCiJIi+fBv7J74
MD5 SHA1 SHA512 SSDEEP

Submit Download

s_shared_single_filetype.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_shared_single_filetype.svg
Size 2KB
SHA256 57f9e7efe6b9e23b9ea4ef8f447a615829ba857c5d8eb2ab83c947844288dd6d
MD5 30b50bd9fefbbf2235cadbc1904a4736
SHA1 30d125bd198bab7ca64e41bbd3c628555a9ccaa8
SHA512 059fb0c584d16e08c4eb22f7acd76f3e6d5a3a85179b8d32554f4819d1587ad0a1082c0f450fe809db4f21014afb3a15d252da9d8dbecb41d63e2bd05e7c5113
MD5 SHA1 SHA512

Submit Download

s_delete_18.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_delete_18.svg
Size 3KB
SHA256 c5c1b21b38bb30624f739228089a6f2e84fcd56bf02eb0e06d2061b3d3f41204
MD5 7c5b43fac5f03a7318d63008cd7014f1
SHA1 08a20a5e8bfcac08e2c432476c6dea601a15480e
SHA512 3510e77fb312b86297ee589d5fc7a750d1543422114181a0ff9c6547818023ecd5d203691b283f5102f0fc0641c812873ff3f0e3adba33a32542e622b47e4764
MD5 SHA1 SHA512

Submit Download

s_removeme-default_18.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_removeme-default_18.svg
Size 2KB
SHA256 059a3d0edce9fdd9ebe3e50bfbb4c4856e11815d3a20c097c4358bd27bddbced
MD5 592446fc8f72178c540f6e92aa7ecb2b
SHA1 86221ec662e15ce847a7ec3d2f44034d3c9c5bad
SHA512 4d1bbd2f223ab2ca387648511de22ee85e69ceb39e9fee4abf861a500f6ea3156d0d25d199479e3c09797922b539ffa7596c3a674707b58a3db445aa18800018
MD5 SHA1 SHA512

Submit Download

s_uinline_warning.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_uinline_warning.svg
Size 2KB
SHA256 dd024503823859aa7d2c4b03917e9ac6fc76e0700b41ca111d195e878a7c4385
MD5 195bf5c664f74ff7ff6decdd3e2c830a
SHA1 9dd99f284334579b6e569f07b5bd74da0fcec0de
SHA512 3ff7e8400fc3fc3fbaef213e96efa4bf503cf4345d9d9ffff776c81b1a5d29ae4e09453fe042094aa71262609f34099b35dc6d8a7e93bdb3132cd6eee0dfe5ff
MD5 SHA1 SHA512

Submit Download

s_gridview.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview.svg
Size 2KB
SHA256 a3c045e6016e4aa84684aa82381b17724fd1156c1f503c17d8b17319e58b953d
MD5 7c511bfd5fbd2d1591eacc3f54ae3e9a
SHA1 d93951a32f6565104bfaa329d5b40503829a9649
SHA512 0c030b9ff46985cb6e820b61bb013c6c4a96398810143358461db0ad87f6e267fb0cd61cc6f49e9326a0bcba5c2e5158a9d4dafc9f7200a89c0fb4663ca37819
MD5 SHA1 SHA512

Submit Download

arrow-left.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-left.gif
Size 1KB
SHA256 8cba83e925557188c1f80f9789e74a2a22cc3981f268232c8246f7b693387240
MD5 040d68eff1dd9d50348deca11a1a6725
SHA1 44d23f7aad0ab7a71f4e39ef45aa7e1862e0ffda
SHA512 629551f4f1daea54b778a63fa14735d05a366d1c93b8d09985b490c84fc7e1896dfa2ac8ca33122fcca56176c87a1bb03db45cc340200fac5e50ab2fefc9c60b
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png
Size 2KB
SHA256 77d99b229a7078d43ed56a8c025f4253186034c9105f28c90b5cc39319298f95
MD5 7316c10fd49c34a4864c024965c4b924
SHA1 450cb4f2cc431e6fee30164ffcc4c7768fcba203
SHA512 5a4d548173b54b83dea180ea858d10549e5976942abb538a91ef196499f0ba991184b4f93ba9d59330489ae93f0dbf557b77844b55b986b9a22d868b7bdfe5e5
MD5 SHA1 SHA512

Submit Download

ui-strings.js

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\ui-strings.js
Size 3KB
SHA256 8f2e7b3cb794f69825c0c350723eeb7ef94059f015a9fd4ce9d467365f754e07
MD5 e7ac9096ab87108f2668c5bbd0096999
SHA1 859bf0838dd0d8a662a707af34c0f3dd8c178c94
SHA512 4742b6b1a6014dc0940071577cdb161d55a968c85fcf52204177c1b18cf9f7837c22c6e7d6f48b06ef8e310c0124ead8d82aaf581e54e371bbf40ff9765e700c
MD5 SHA1 SHA512

Submit Download

ui-strings.js

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ui-strings.js
Size 15KB
SHA256 119861ea2ec349eabab138b4046ef92d12f49228e9d85e10190f6976f6cc6d01
MD5 059b0ec552b40cdd2729a4bddb651b13
SHA1 61334420eb89355fe433fe6ab92e278c191476c3
SHA512 32f41e738fa993c58a8915fab8abc72d24bd1114113c4c8c1d4e29a157f11d4cdca54138dc01a3ac3f112e8ed8e364f60c102353c0ba9a8986564dfa41c3d572
SSDEEP 384:fEu3gSNl6rO/rzjQDI33drgtkLdjNwoxWCxUpZlmmwjQ/E7IcCUfi7Fu7uVy7k:cM76GwEumdjNlx5NIcCU67F7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ca-es\ui-strings.js
Size 2KB
SHA256 b98c4ab6acc00d139eb4eb9c2e6b07f858137e5afd9abd2f9f77842d14b212f3
MD5 bfbb063ac286072acc91a58888b171d7
SHA1 b20083c8e4eec886057a59a63a06214751d950ab
SHA512 2368aad885d6870e6599ccbb2587d59a258939e78fcd32f56e30cd2adc475ad19ada3dbd16d028a78b5be8766c75004e46d0b3e5e91122e59097d4ed99a17a79
MD5 SHA1 SHA512

Submit Download

scan_poster.jpg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\scan_poster.jpg
Size 31KB
SHA256 cfb17c5f8b007d24c681ad78508b2654451b28a2d4258252658b0ecba877afc5
MD5 7bdb29fc5abf65c55378ccb8322b6da4
SHA1 1fda4f2c2b3bd2151e76d49dbb333624fdc40071
SHA512 750bb866d28b1913a72227462e7275c5db1648d285e43a67a2c771e1b99cd213cb5e5ed15dccbb6e3235381877eeb06313ea437f15e54b719f22c2505e46b721
SSDEEP 768:ZI80xzaXq10/G8asOl1uiiuZa+LZiVfkCCk2cQBJOXn2jO1CzP/3:ZuEqo0sOl1kcjZSigXn2j+a3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ui-strings.js

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\ui-strings.js
Size 6KB
SHA256 6bfd1e38c98b6f1ec89900bbc1337d5df4b65e632a85f342151582455395a4ae
MD5 f2a2bb871ab257b58d7592d8e5ba1f0d
SHA1 d40c69512041a0e09a9db450d248e51d7b23c162
SHA512 c66fa02a7ab05f57098b0750e566440da6abe7f4c4ab39034f1db5de1ca44118152d93cef37ca2c4b48c2537b989deeb6a92bad34c8a52c89c0ff637001c8fe8
SSDEEP 192:RVk4ncryqGiOj70Kq2D4h3at89ha/zIG+i5ZT:DDWyVjwKq2Sa+ha7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_ru_135x40.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg
Size 24KB
SHA256 2a649a0eb01b5af4b6ef27a7a40d6d4e671f4db975c9964e66f5b31bc56f6b99
MD5 5d18a289321bdc3f998b4a3f40764773
SHA1 b9857c6327bec7133ef925d92f0526e37c268088
SHA512 f4990e6c32bb169ef6a030943f1c7fae28d2f7aee8acc4674c8fd781edc0956ba4bdde50215844e28c6351b82f1e419f7a9960364349cad094074706b7d1d301
SSDEEP 384:3sZsMnpZy99JddOq00XIWKzsYXQFmZuHjz5+cjBRS/gPk8XzMbACllYAU78:3sZsl7XE04WKYYSHvnjB8/8o
MD5 SHA1 SHA512 SSDEEP

Submit Download

ar_get.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ar_get.svg
Size 11KB
SHA256 b0b87353a389dbc322f27040b9b8bcb917ec0dd8dbdd754ed0e58426303b3c4b
MD5 3f37b1246529d5cecb046d6f1c3ca3ce
SHA1 b13b789979e6ddf550502f088efc8e4e5fd1facf
SHA512 20fcf375eca50ad6cb226b8a401ea5b57ac707830d99927d8e861254067d3b3943f232e824b5996d69a8447e86dcd7464a21931b893d80ed988cc50bc5d1a41b
SSDEEP 192:D7fRqQoRLuP8YYLUsydfTUOFUKEbW0CEJ7Pc9wzOHmkI0o1+i5Zy+i5Zr3:D7ZqQkSPGbvBbWa8ob17O7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Download_on_the_App_Store_Badge_zh_tw_135x40.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg
Size 16KB
SHA256 87b4b5738105cf77fe32a1df75ea7f063d029ec2d9eda685efcd408a9e573bb2
MD5 55ac09af0530b7fda59c5358f302edb7
SHA1 e64cea34f599d998ade982be022e9b3609d66418
SHA512 f8bf541d4ffafb1bf8ee30101cc495e8226ed00d6a2c2954dc04c79dc314a11dbd51cc738b4f90ae7a4cbd42aa80ef40e66435705f7778179c15c0804b58b2c0
SSDEEP 192:8YwwEhXIjfF7BWkEGvSxjLbJrWCS4OlE8YOH9ubQ1jp/L2jhuZ1FVbfjHHozj+i6:tfF1WnGvwqLlE8b9UQv/Laj7vn77a
MD5 SHA1 SHA512 SSDEEP

Submit Download

th_get.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg
Size 17KB
SHA256 fccf4e5fd9fab4fed6f2dbe347c9f8e63b28fca6d13ff69ad61fbef86ce95f77
MD5 1b249e18409e6b9a614c438481662116
SHA1 c9643962ff4bbaa5d1512440190ef23230f77eb2
SHA512 aacd29caf1f812a6a21cd5ef409f73f630f3532a2a7cffcd83ed2eec49ffb5d33a1226d3af483dc631ee652f0578376fc3460ec26c4f6f365354c7f6a12f5672
SSDEEP 384:/dQbv+NnApyNgqWta+U/oCpHZfQcsiVx3PBffqFfx75:/de+NoyLZR7ffBffOz
MD5 SHA1 SHA512 SSDEEP

Submit Download

s_agreement_filetype.svg

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg
Size 3KB
SHA256 1d8b21fa49176c375029aba4cce63fc9f09a19511a190280cb8b89749ed1867a
MD5 cba9470f829b88c2110d75f280b94d47
SHA1 84bd79f1e96f6bb476469881b1f428d63db21013
SHA512 89d29b0598a78bfbb34c27f4beefafdba6d2d5892263a7303d7f7155cbbd96b0abd9ac7a0e1488f01fbe5824e38afce047c9fc17dd18464db0df958859ef711c
MD5 SHA1 SHA512

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Size 4KB
SHA256 5aa744a5eebbb55523f51b9ad26bd348c7e382920d4039271c4942f2fb86f021
MD5 c3c585711a483525b17b6c6cdd6db791
SHA1 f6e1f157a545f628509412be26d4ba067a9abe0b
SHA512 6a52eceba1a2892682b0633fc23d95a195bb8745d3778fc5aaa568400a9e424962c4b152f620887dc58de8bd97b9c90a1bb8f61ecd9e32cfd2879f8603755510
SSDEEP 96:jDkffjDcCBFJw+7440iJZDvTZptGoRkj2GLPmtp+PCEtmLSKlZdf:jonfxBFP4404n6GkjLiYPC+i5Zdf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZY______.PFB

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZY______.PFB
Size 96KB
SHA256 37824b354de44c784bb8b128855f655fce3172e66f075d53284de3f121bc8eb5
MD5 1c4a88331476d1d5b514a0f59515d313
SHA1 0e5d8dd3c1050c5e01c6e0fad63dfd98b8064082
SHA512 45340199324b7f57df539f4ac0f090474b642fe8b5ce866c1ef9f685edf3591d45adcc0dc22fb1f02eff8cb112f25a693c42a6a314fb09aea5d47c0faf522185
SSDEEP 3072:r9JWA0fZSFS8odpprRjW+nvvRj8JbFjDL5GEYhD:J6h2dodpiG9OFz4EYD
MD5 SHA1 SHA512 SSDEEP

Submit Download

HomeBusiness2019R_Trial-ul-oob.xrm-ms

Path C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms
Size 13KB
SHA256 be77702dd411c29a584d4367a5005771fd6923571ca8e2c4b4e9595a0e5f5687
MD5 70078aaf03bdd0d319ddb22b0738fd63
SHA1 6de22966d834dc8c6c275dba41c1aee7f2b9cd1c
SHA512 4467c000b29442c2f0c172cedd20bfdbf8cb1805c74e747bf672afb5a0b49b9f80af2d693b1b4c2dbea8e66d85c836824830e3a81da56f84648dfa93ca718307
SSDEEP 192:ySiMIOLYNw93DQr7h3kr6zWX6EhDrtlh++13oL/LjsNaUm9cCLm9k3+i5Zudw+ia:ySiCEAoGOzWX75c+13o3Wax7i9k37v7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

EXPTOOWS.DLL

Path C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL
Size 24KB
SHA256 0176641dbcedbf17801b6b9a0de02865899d5f3ec0ab33471215e8f48a8cbed8
MD5 3c431834a83b76f07530abaf5fc662a0
SHA1 ee2fc0e26f86c0db0eae76cf933bbd278bfe0c2f
SHA512 5514f28a23d795babbbe0a0c26786096e9790dfa52febe5dc76509046451bbc64f80fc3a80f91dad3ef902c8974c2149e8bf17f2b03754c408d5d24551b98959
SSDEEP 384:jxtFZp+4hpLgWnpK+PlKi00GftpBjujHRBHkOocdvEEz3BlQCsjMTc7w:9tHI4cqpK+PlKoiYD3FroxQb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ONINTL.DLL

Path C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL
Size 198KB
SHA256 04efdc86b5025c11daf30f1bdc2418623e519e91e06b24da61bccb784f2bb84c
MD5 f0603b1abedac173ad42df774baf4d59
SHA1 eea17150f4b8d7cc23f96079c6c6310f1650dca6
SHA512 c216758c4f5823561adef4003df6534a4c8896d86ecd972696d030c6ed4580483c1cd19c7029d9dfce5f7d06804b1c4d9561f9bb9fb5a4f64dc93a3f1c76c0d5
SSDEEP 3072:Ud/vcfV1XyOgUbYwyUlf92ZOTyyzdwIKH2vi/7Akggxap3YQdbjhww3o:9tdyF+YqsgyGdNwAXgxE3YKhww4
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneNoteLogoSmall.contrast-white_scale-180.png

Path C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png
Size 2KB
SHA256 e214f3bc3a56055e6e1b74f273e8258b0647217e00ed32ecb5c3c574137c2e14
MD5 c63f2e46c3672b8bef1ebe320ae2a30a
SHA1 48f3f26ba7989d7552d6af43c0f17b41f8993641
SHA512 f47e6bfcfc0e5eda17c0c4e7eb7409edca9a4e3e320112c8329361d907a44f308cac795f5beb1b0d32e0adaf7ed7363db753bb3e9a4978aa2d25c08946a2e356
MD5 SHA1 SHA512

Submit Download

prnSendToOneNote_win7.cat

Path C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat
Size 11KB
SHA256 6e0f7ff166e4c17da05e7ae4877aa9ddcb1cd2ca5db3d7c4a1b631568ef1f057
MD5 02af1c312391f20d23b29b8d801b9ea9
SHA1 19bceeec17a971d8e5bde5abcce68f68630ff71c
SHA512 76a7aa563a9b7311b78b431b7b3fe2b1d08944c4e9cd2780ec54f62fa7db6a94de74a02dbb73c15017b0bbf929cecdad7782b20bb14d29d97334efab87bbe3fa
SSDEEP 192:0U2GY37S/GZo1iMQc8PkwHcyQNMx8cjvyTGLUiNSU/weLsjSItgVR6+i5ZqRg+iN:spIh1fysMcyQmxFv+GLUyS9eQjJtgK7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

PGLBL010.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML
Size 215KB
SHA256 aa0a97013a8c26e8efa40c714e1de236f221288960244d04cb55da4a815bdb93
MD5 3167a420bf86cf5e7508f150b5342b31
SHA1 e4a36188f38bfcf99e770142879b844fc0784a84
SHA512 33efdf42f26298d218aea390611dd2786143fc07c5fc66ca787faa465ecce6c73dd48dbb7b8fad0ac8fdab33d81e681076028f192f8e9ab5d7b24efac82dcbda
SSDEEP 3072:XG+iwHF0+g8gSZ2lgTjNvMNm7dP+OZ3SbHoQzVw+:XowHkHcjNvMNGJ+OZSbH/x7
MD5 SHA1 SHA512 SSDEEP

Submit Download

PGLBL105.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML
Size 142KB
SHA256 7418dd8586dae0bd3a46cafd330626b8aa47199ccba4f7dcab66f66e56e617e4
MD5 9ab5cb80b7f8b517a6b9dff14e283f96
SHA1 86136569a904d741a23691d0e1263080f5291907
SHA512 087b248a462cda5a441a9835c505d96f99826ce4acd85e4f095fe8351118a3ab88d2ae7956fb2b7391db0fedded35b3fd6b554b739263a3f0b19cf4417bf9213
SSDEEP 1536:pNS4I9tp+sZjd7uowmG6k4o6JOIGDmGUjSMb51bRCvko:pNS4IjXdbGcxgpDmGVMrbRCP
MD5 SHA1 SHA512 SSDEEP

Submit Download

PGMN105.XML

Path C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML
Size 4KB
SHA256 3352e5a08f6cf4d11ba4b1a5543fe9e5a4908964d6b1bb442518af2d283efdbc
MD5 7d16ff1710c772ff5f152700a1a6cc19
SHA1 743c23ac729e9106a847ddc67cbbbe96a578a86b
SHA512 439ef8115b7e0ffbe41dce77847feba14fe42dd03b1e34b72b1323b0b93872935622a6f9d9859c90afcabb2cec74609aa7a526fd24a6c8aadc33f66e32964fbf
SSDEEP 96:Vt0eQptXtA6OsrA2+DuvtrHQVnwh+foSipacP+4jEtmLSKlZu:I3ptXtvOss2oulrweYwSIa2+i5Zu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Office.Runtime.js

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js
Size 300KB
SHA256 d599804ac483d6921d7c5215a81fd86bb4245275c73b08403928083ba84c4f26
MD5 144b39a60d3c659538c0bcce4f826427
SHA1 38e084d6b5b2df9619eda795a060f085d01d6c87
SHA512 4bf3fe2416bf98afcc573d341e6b2d37f4b5cf246cfc0732e0bedf6aea1153b35faa8bbede71fb175f3b5b15d4584315ccd068f56cabd57151650500ef5a45f3
SSDEEP 6144:NHkEptr+FUE6zvjATuCaN+LpC7eiTQF3E3F:NHPtr+FU3zUTm+Lg7eDEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

lpklegal.txt

Path C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt
Size 865KB
SHA256 4d43e1beceb5225d2ce0f086099f7eed84fd243b6d9ffa548c3bc0eeb8bc36d6
MD5 7ed4153ec9b6f2d4c90934256cecaeed
SHA1 62fc98446be558e42b29ccea9bdd770bbb32b5d0
SHA512 5a724b78e77e018e85cbf98d2248297018e43e8e1ad79fd9a47e171743078178cdd7041c81c6118e935faf56ceb78c0b50321e2b32dcd99b99a56c9d796bb8aa
SSDEEP 12288:ovAahznOE4SHGHypOmQkbUYaNgQ6QFRNeLCa+X:ovAgzOE4LHypOmGNgQJn0Li
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Size 2KB
SHA256 fbb1cbfc43ce954e1f5d564093a7a25c90a91f57eb525d0c29e608bb88562649
MD5 a6910b285551efc59d3a12d9511d1cc6
SHA1 70764dd943b47168e81bd6291eb8df0352d9bc4d
SHA512 8342e769d43d51905846e9bf8c43dd45acbdc83c11922b9dc3db8c3eea2e69cd36b33b386f5f7b5f56d01b9b52d10feaf229b6c9b27af198292326884a829979
MD5 SHA1 SHA512

Submit Download

[email protected]

Path C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]
Size 2KB
SHA256 0bc92f206531f08a9dbf92ee4c0e0650ddcc65fca8ada89826c752ff38a97e71
MD5 abb4993d09642d6e129678386f11f415
SHA1 de251e8a76047d41c49821f035c81b3703bb69b1
SHA512 b9f84ea5810291d7b54562bb155bdd0ea298b92f74e7e1814ed28f6f921047a1017d83b329c40aef2707ac3f092af3810cc830c93b1a43bdad80f71ee68c82a9
MD5 SHA1 SHA512

Submit Download

BRADHITC.TTF

Path C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BRADHITC.TTF
Size 104KB
SHA256 b1c158b016e6e208c70defbf4962bf4c86188d04b405d84faa4632c88880268d
MD5 32d1b79980ee5938de89aba638ea2398
SHA1 17987d4b0f41ec385e8dcf0afeed34116419f02b
SHA512 c1ef1e32784c50517ecaade9612a2e87f7ad9c532c251a2d30d3dc222e06adfdb21ec1a91a14d1338b05041f16d653de1d9037b2692dbecea59d3013b302c9f2
SSDEEP 3072:rJEwjyDYZhlOFX7u2J6rOPbIPwv+++w3kaZWX:r2wjM+2FrjJ6Ot10aYX
MD5 SHA1 SHA512 SSDEEP

Submit Download

GADUGI.TTF

Path C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGI.TTF
Size 207KB
SHA256 5517de2785ec42feb8a93d0561fa918ba4f09ab09f4c2ecbef42374cddccda8a
MD5 c86f793404fb57e7673a416dde8abcec
SHA1 8407b9f02dea1e7c436047cd3a3ad8064aff798c
SHA512 b4ce112fec099b4c9f5579d4abb3758a79ada4c1fecd75b4ef3b656d5d85524500c7a6287466f8d9743272cad24362528c359469cdb48b387b11f2eddfb7143c
SSDEEP 3072:3yPY+iQcwWqGuFQsS+Rm7KblY9fvhxWVVE6YwKwGntC/U+tEjI5tKkJ5FoT:CQtqtQjb7IMpoEwLHEk5bpa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sybase.xsl

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl
Size 32KB
SHA256 b6911c87fe3d5d5cefc193216745b3075a94a09c0ad72e27fff0c78e27cc9dc9
MD5 0b162860ca7b81ce4389b09a1733159d
SHA1 e82ba4cb07397b406a1bd278813905d44c288f9c
SHA512 1d009de19d010ab82e120293c3892d74c52665a2d894ff9adf6e484c458b5d4bb5b66ff78afa587fcee69c5f4450ff592a1395a68fb0a52a7e7f6d6fe828afcf
SSDEEP 768:7ztVvRuiMs0wVNNKPfEPBKgs6IcYzafruWJOKgibHJz:75Ms0wVNNKPfEPBKgFPiCVOsJz
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppSharingHookController.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe
Size 46KB
SHA256 573a799675132a8b4558563fd8df5725ee599cb261c8507afb7b78d18874071a
MD5 788af02f8dd03e1872578c277c38321f
SHA1 aaf65db6c3be111516ba73c217e901016e484d0f
SHA512 f242abedf643392c48120a5073326fe9c80d8a896eaf6a654ba5841d7f5aaf1b1ef4fed0b0f2d0a17f8cd83c9eff4450b31a11030bada4ae442a7f2498495de8
SSDEEP 768:NcaoMa0BEz1idwVzHywQderMiAazSAH6IN/74LUCUvTKTkc+rPL8ia:cMa0Sz1idmHgUrtAazSu6C8LUCULKTkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCR110.DLL

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\MSVCR110.DLL
Size 948KB
SHA256 03bf93f77a9d130db42f0143ee0db7f93879ccff16d2edc1ccf7b690b1b7839e
MD5 1feb6e852600f53bc082d3c0dfde9bc4
SHA1 328e7753d8a48b629a6db00ce32b02c0160c7b4c
SHA512 2011ec38e2cb09a78b36fe9595d3ef1900605a03a0b02ffa4233264ec143f11fa6795a7579fb8be711c52b5f7f8539227057572a405da616ed1d46f92e9df768
SSDEEP 12288:U1m48aot8PDIyBTV7J+1rmQeIESV5fukjAu7haXVWNRO2Pllo/HL1ZgjL9iD72x:U1m4StUDNzQmQeIES/hbIWNRposLo2x
MD5 SHA1 SHA512 SSDEEP

Submit Download

ONLNTCOMLIB.DLL

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONLNTCOMLIB.DLL
Size 90KB
SHA256 a8f86d15a2135cefe7bae13b1af92f8307d1d13cea22b5169a1a79f54ee6f8b3
MD5 a38193aab73a0e99f97df1ca0c6cf152
SHA1 a17a0e5d24835b7d6ae9db5f20a14ef40972ed55
SHA512 983b6f40b0053348d0df7848aea8cc3341bf1c438cc72928dc2e0ca74cbe84dd9de33877d74e10a4e5faa52ec428becc2cae6055a6604f794d8f25e725757efb
SSDEEP 1536:yqZbHrz36oWuxlAGJSs1b/0q/Ym1vZSTWIAmwUewPe4Y1Z+XstGArf7lHqdnIcYH:ysbL76gxv4sNXLSTWnmHpPi+XbArf7G2
MD5 SHA1 SHA512 SSDEEP

Submit Download

dcf.x-none.msi.16.x-none.vreg.dat

Path C:\Program Files\Microsoft Office\root\vreg\dcf.x-none.msi.16.x-none.vreg.dat
Size 257KB
SHA256 aa471b4cbbbf851592fb64ce142a562117e3b7c468c4c3a14ba438fd8bee9bd8
MD5 1c5e3b93d5fab7688fd0cf68c1494a18
SHA1 59d168f20fe72ff464d2c45091eeb1abb2f7b73c
SHA512 2770c69b08b46786c0097d434d826f7fbf90ede2809bcfdbec144d8c6dae0269b27ce6b343b3d6e1b5fa9fc5a55473c065790d46ab02d2be245e32ea6624fc49
SSDEEP 3072:F21Us0SFQ8+CsE/x+B22EScLGUXT2chsHucadY1ydUX:tIQ8+Ch4qLHHsHN1y4
MD5 SHA1 SHA512 SSDEEP

Submit Download

throttle_store.dat

Path C:\Program Files\MsEdgeCrashpad\throttle_store.dat
Size 1KB
SHA256 2f18ee45452ceb67566923665bead117b1eedab81c53e94411e1a67c6094d857
MD5 226c5f7ff35b7c3dd166f969810dbcfd
SHA1 af49275915355c89c17c1de0687c060773f88b32
SHA512 f6c1cfbcdfa0f0400335bec524c7a90a2d98b0ce7109d600cda5c50145ee758852ff16983d536f58d9cab8bacc877d878dbc1dc47e5dbee0c582cdbd7455b5bd
MD5 SHA1 SHA512

Submit Download

vimeo.luac

Path C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac
Size 5KB
SHA256 d960c94c9e3be7cf974152a722dc040a29b535ebff2eccf3321352b0637cbbf5
MD5 4bafbbc94f5afb821225427db0079174
SHA1 d574f68c8227b6e85fb6422f0f78023a9d0576ab
SHA512 cef9e26ae174ad7206036d2c1bd76c318412e38f5bb8541041bdfb271d97f2dc043b3de8b59f6dc4754c5eeb236e4f666942cc64d389e55729de0975cd969a9e
SSDEEP 96:FP1ugiOstgLKT3JqgmOq6kh7iEE2XETq5m9KWH/nJYZWks6QC3EI4tG6YjlEtmLQ:/ugiNtdMf6MeuXE8m9dnJ9IZB8Zkl+iQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libfilesystem_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
Size 70KB
SHA256 3a1dafd98f0f26e2ebcb659ee19ff12930cf9fac598da9fc68c5196fcbacfb17
MD5 e8c2e8fbf02e952cc987e7c441532776
SHA1 058adf52a20806209bc432c41490fbda9f46d8cb
SHA512 7aa1a684b95380f3211e805180075cf3ae4bae578a6a95bddde9af83d6524f33e98730377d4bc28f03e308728262e0fa8c95b2440a5c1bf4145aa387fe267588
SSDEEP 1536:BDQARPTrZ0rfwlcIZW0aBE7QG9gKPUJTy0UBVWnxy/f663xP:BDQQ/atIZlpQG9yIVXHZ3xP
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgain_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll
Size 41KB
SHA256 bf89874dc796dafcf7263a7cdfbdf743016490cf09e2695768e88de23fcfdda0
MD5 46cfb67ba87879c7171abf349bb75d5f
SHA1 f2758739be1511dae99970e88246c5d52bac33d6
SHA512 704ffb8cb8051320332242631e2c33d4e194e085c2d02dd65d1344bb32a101d3795306f69f4439704325fc2708f0e448fff7d6f09d0f727290e7a3a6ea8abb4a
SSDEEP 768:0sdT6YaaVdiFp03dQ5lyThENAMxPekJ9PbdCarczo:0cAaVCp04xGk7rYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstereo_widen_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll
Size 45KB
SHA256 2865413b007609ffc4114f39349632c1991e2d0b9e66d9f8657a9cd5b029a1eb
MD5 28ce08d9c9b9086e9af20a4f15215e5c
SHA1 862fc68ffebad40adcc9131bb8f069ac6c9801d1
SHA512 15e6acf0bd9c0ad1fd32efb9833264b30df947768b8d9d3ae0ee8ba0570e6d95c8f46de042e8569eda4b0a861d9c8a21c79b73821e501a35698fd250cb031c94
SSDEEP 768:cqfPaAWgNJgrFcXQmDGAENAUJL1w8WTKOCpAMxwJ:c0P7grFcXCLW8Wcx6
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstl_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll
Size 47KB
SHA256 998fc714c9e52f796ae683292dbe4db7e41838c58e86bfdcbad145b15d76e38f
MD5 dfcc60cf9361f932107e3d648e724b84
SHA1 f5b7d7a306407e43a34b8d1def841e7bf3e2b1cf
SHA512 729cc9b9f5a0dbfa7a303945d2ffc006ecc9fba7d8ba67d5367bb65a0925d65acc3fbfdbeb33a71e87db4052b67099deba934f5392d2d59a1b4aaf955d23dfc8
SSDEEP 768:3ZyzHPxFAYmhUaBzXIpBhDpMduXro0BDG0ODGoBwaWE+FKOiGENAMxLi:Jgp+YMBLUB0duXrzKTwaRbOiXxLi
MD5 SHA1 SHA512 SSDEEP

Submit Download

libpva_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll
Size 48KB
SHA256 3b74a8d154d11dea483eb8dd9c0c3eb08d90b7cd63b5028c12c26c6893c292b7
MD5 57f6d2b2b18e09b598e6aeee7197eef9
SHA1 90020506657775a73cdf9e9cefa70c36c578a949
SHA512 487cd6517521fbd29f432687d8341848df040a726a95c31b0909063fbb731de9b22b5c1ed69db9a53ab7e85e6a4dbafca2ee15c23290818d5f5463bc261b7603
SSDEEP 768:mb/dM04sH8E5gw50GQ2QoVMBmDGNz8oNI49HQENAMxWXy:mbdM04gn5tt6NZHVxWXy
MD5 SHA1 SHA512 SSDEEP

Submit Download

libfile_logger_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll
Size 67KB
SHA256 bd3159f18e3f6d5d801fef02ee087accd3935cf20827282ef6dd1aae64048282
MD5 cdbebb06f0f9c2f3f168dbde96ae3790
SHA1 a478363d3907e8bccd86f4b4f2db7a3b9804e299
SHA512 7bfc64f1f74030c0ae3e6c177c968bf274e989c15589fe2b4eeb4cb5801f397f22e75b383d5f53f5ae672f1d33b0cf97e01046be39629b6148feed9930e34f4a
SSDEEP 768:rc6fkgG5+cE52cWEHGhhPNQG4V87WG7lRp6Kun0xVyq8aD7TymGLjt5hbmDGAEN9:ANgG5rED0hPNGV87WGN6DkVb8xLjtbLd
MD5 SHA1 SHA512 SSDEEP

Submit Download

libi420_yuy2_sse2_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll
Size 59KB
SHA256 d634432ca21bd14b4313881935ff8923ad550677c919ab028d987aea1e611e60
MD5 35b58168a3b4868c3d3fdfa89cae6c4d
SHA1 6c1ca3022cc75831cc412030ae40ece65eba13a0
SHA512 25c5e8380b4884fa7a5e2ce9415ba4faeccb12e50b8894117d8e5e5ee70b2471da40e8a287db90733d741ca552212f7e06cda0e140ad974f54e8ef7c0dd4bb2e
SSDEEP 1536:mbn0T0k3DQF089xAQl+iocZJcgzSx50NGHgHDZxZ:mQYk3nAAk+E3zEAjx
MD5 SHA1 SHA512 SSDEEP

Submit Download

libi422_yuy2_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll
Size 56KB
SHA256 b98bfb5e123b0a9d3491429009846b120b7891d3036aeab7477272c5b11db73d
MD5 9da657f509560138fedaf1ebc0322089
SHA1 b70faf9a4b00dfb185d0003d09f2cab61fb3c323
SHA512 64ec7610c8f99fc76d8b7c9223e64122103013613beeb6a790553f9184c6928d96e9f971e3c1b022b22d0ca0f616214dd9fc5c7e38c8e2bcba4d8de799b34d6d
SSDEEP 1536:D66bNqtIYx3RIz25Bxme6FwHSxCHh7HRGv:+6NqfKygUHh8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgradient_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll
Size 61KB
SHA256 66cc00837f453107af3b71814abb5f57b08ece1626b9cdbe7e0943aa74f379a7
MD5 dfc1b1bc9109b6de5893a4b12f554d18
SHA1 6f0982220e76518a22dcac74d2d7c17674065b94
SHA512 be0b6408fb2b259e66d2cbf5f0d9edf28f41ab44cd5e0d9a19cd36b0d0c08f44ce781d373dbc8b0a031e3dad59dcc7a58fae13dd777e165d94354f6e330cf231
SSDEEP 1536:1scyXFplLdX4cetHyLQyI0xHEezUslOtP3fW5xXDN:15aFnSHtIVE7ZPvWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwave_plugin.dll

Path C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll
Size 44KB
SHA256 32fac18a5dc21c676174df7088acd2a011bc6dd26d4268d07d85e6dd2258c964
MD5 e936906742291ddd6740cb40d4a942d4
SHA1 380699aa786f4800e5337b100c89be6a816bc211
SHA512 4c37f05811a0be74d9d660dc5ed74611721da716d597e529369ee4c7d1cb08be8e57ef85e0616f6fc981591b1fc37016aeafa074392778e0ecce2733964ed827
SSDEEP 768:IhgvMaOmB7U7GO05tm/YvqQDGAENAMxDHcZi5Bo1nkf9YrxL:IiUaJi7GBjuxTNmk1YrxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe

Path C:\Users\Admin\AppData\Local\JaffaCakes118_32a3e8753d7d8aee340e74906aad24ed.exe
Size 50KB
SHA256 43e67197f48076d3c2f72de7d44d474dda0e6260a913e41fd6d4e9d1509f31c7
MD5 32a3e8753d7d8aee340e74906aad24ed
SHA1 7c47817efce809af0d25d179d673f7dc9b413248
SHA512 5691c1f5ea1a8ec217d9be8683eb082cfe67e8908090a41cae630d33f3a8f392d39cee01887028c7d281951cc57255954f7949fd57c1e746838736db229e141b
SSDEEP 768:t7vuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5CN:tveytM3alnawrRIwxVSHMweio3MN
MD5 SHA1 SHA512 SSDEEP

Submit Download

D04200C11BF95A67571F3ABF82691C2AA376DE6F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3wiiokog.default-release\cache2\entries\D04200C11BF95A67571F3ABF82691C2AA376DE6F
Size 11KB
SHA256 c4c37f3438e513b7357d4a142b005cf790f253b7dd3f228a240e7e1ee85623d7
MD5 f98bc58d1fdd890854fe4bd43acae1e7
SHA1 c29fb850c3929ccd3d96b29880c6cd4680002274
SHA512 5fe3ae0cb80cb3444d463af8b6ae00490ef59472cc8b27d6e8f6710c0d8f827d890472d6763571ed80051a6e93e50bce9c9ab4787fded7c02b714cab338536c3
SSDEEP 192:Ns+SMI4P4T245ls8BiZd5kXL98HrhmB0XwbE8qahwo8vKCKvhOSHZ/Rhp0In+TMK:Nu9Scls3ZdW9WtmBdpnmoPNhOS5/RcIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

9511e5e0a9d328dc1aceabc9e9eef27035aa872d65a5e2a1f519204e75e017e6

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Assets\9511e5e0a9d328dc1aceabc9e9eef27035aa872d65a5e2a1f519204e75e017e6
Size 11KB
SHA256 9b9756523b9ac6d6217d5abb4d305a7d4dc8c662d4a0ef814731b0b07f12d154
MD5 e452cda9e4bbd6d37a195787ab115360
SHA1 ee11221028737248e6741c56f50406864ffd18ab
SHA512 754cd6e14979a1b7e8498c02d4e1bb648eb4995c82e657c4fd1d8c0d653991926c2843e1f4c0132d4419d923f0e817773fa8fbfe403ef996aeb4ae7649dabd27
SSDEEP 192:YyL3Wc10O0X+9ACKv1T+YEM4CMKrD141RKgrJ+MgvdQa2W+i5Zpw+i5ZB:Y7c1j0X+9++YNMhKgrF2dQa2W7tw7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

0.2.filtertrie.intermediate.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{856bc4b4-34f5-474b-b92a-e85b8b6f2acd}\0.2.filtertrie.intermediate.txt
Size 1KB
SHA256 37e7b01e87c1d53c8aeef902812cfdf47f37061875326ac753e4fa5c5c079134
MD5 219a5beac2a73cfa853b915a5b5f1090
SHA1 c3a642bc3a9bd9884ee9668d9d83a4115995b38f
SHA512 8a51e60f3b0402e7e33fadba19b803419ac1687e8fa47476b34dc7d39f6cac1201d7deb2a9eedbc230edd397b941bd7ce2b31e7674677c06031939b312eeef07
MD5 SHA1 SHA512

Submit Download

dd_vcredistUI31B6.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI31B6.txt
Size 13KB
SHA256 5d0f2718004620a0d581594d3b4e69bab6904981f4082352758e975739ad827c
MD5 0f1ff5ecbffd2f19a52de6e4fc986457
SHA1 b78fb2ae637f3f1f2b6861ea9236e6220827b392
SHA512 69c30f497d5974de10cef7c9a8b08d9dd1ea5446bcbbc19cf79ab25662b2ad05c2e84a01934f256917bcee3b7529d94c2fed4b882e55b5fe467e943ae03c4fae
SSDEEP 192:bt3LEZqF9G+kAs+yXtpkG1emXTVJo1x6ahm/kd/e0Ze32I/Y/QjCnG2GQXonxPuO:bC8sXXAxkVJyRo/EnY24WWqPNV77p7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

times.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0ki26h7r.Admin\times.json
Size 1KB
SHA256 aa19ff6248a95b2b3c08c9f586e6eb2d9958661593d0f0a8ebc8752155ace7fb
MD5 0c9cf216a5382d2fe10b3b7e6ae1e1c1
SHA1 bf49103b1995ceebecb4bacdc2a579b4591c2a09
SHA512 10f44dd88461a94f288751de1824c749538509407c01ad1d068f0cbf045e8be88ae39a5b2a3a60d07ef90ec757b5522b423d84dd555f371e57f625b01514e2ce
MD5 SHA1 SHA512

Submit Download

SendSync.ttc

Path C:\Users\Admin\AppData\Roaming\SendSync.ttc
Size 234KB
SHA256 85d8738af310c59f4f24ed37e59b299cac923d625d546796c4e5046c758968c3
MD5 22320bfcc89561bbde0a1c29cf0dac67
SHA1 93ad58d557df1b7ee34ef591e0f159d483bf3946
SHA512 eebfd0f327f6799ed42d21729c7ea09b613dc9a899c81b5ed650ba327b2056803562b0a3cea5dd70f87b9ec8872652c2f1c38f727b8c0927f50ecf9f2ed7a267
SSDEEP 6144:PGpITFeAQo9glGjQQYx5eiYxziRJA6GF2h0qrnh:PGbNoalGjQ7x4xziRKvCV
MD5 SHA1 SHA512 SSDEEP

Submit Download

HideSend.odt

Path C:\Users\Admin\Desktop\HideSend.odt
Size 251KB
SHA256 ed637de15ffbf6fb3b95d81aba0dd6f2b9c8a8ddbc78d8f58759fad49f72daa6
MD5 e00a2d2fcf8ebfa6a634b556282b6554
SHA1 9a8f661d76859fbdc1dc24d9680bf621452c06fc
SHA512 c29e71796ece39b003b548986520381560f3867eaf5478e61cb75fe841415899360f1866e54e0d4e9435e12cb5474140595750ed9633a286b5ff89af14efbbe3
SSDEEP 6144:5PIadcRbT3u5q3vaw6pdaZBclPgCX86JFyLuit5R5rNxR:GmcRHu5q3+YBeoCX8uFoVLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

PushExport.csv

Path C:\Users\Admin\Documents\PushExport.csv
Size 1.6MB
SHA256 028be7b63f83b7865ba97ec4be6b10c6ff0d83592d4aa6e97aee7bcf621c0fbb
MD5 4b8ca707cb9df4adf992c9ea255c524f
SHA1 48d2bbd72eb1c73c6e8261697ea7c6ce173f5ce2
SHA512 c9fa408fc07cf3f9566c4ace8472818760247b7644b902153533bfd81eac2519e9072b25cce8dd9d252d448cb447f1aa54aecef57b2a512aba04aac78faf7663
SSDEEP 49152:Bsfv+Xk76hsUlPXJE3ADBNmUXPu0p0yggrzhctEUk9XDWw:s8vlBtDBY2P1h5rWtETyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

RequestTrace.xlsx

Path C:\Users\Admin\Downloads\RequestTrace.xlsx
Size 376KB
SHA256 4cde870638f811dcab2ad60d23228f10b2a406dc21be238e827b46be0622e3a6
MD5 7f37a09558b0df1025cbe02c6645260b
SHA1 84cbca815f788d2275f4b1cd170d08bf7f780ed3
SHA512 97f47fd509816b14f7fd7fa86159a8053ab967b4e7e7c39f02e92a752a345862f3317cda61c38456be32c861dfcc8cc2b6d12c564f0aa606923cec8570260051
SSDEEP 6144:KHz0g8dM6woO5qHCAKCibGtUJJyVBgjYcUeskOUPsSz4xytnBcQ9Ke+tbmT72xn4:mz+dM6MYHLiKZVBgjYc1sRU0SMwR6Qmw
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompressClose.tif

Path C:\Users\Admin\Pictures\CompressClose.tif
Size 766KB
SHA256 9a323c613d63e4eb7b501b2327a04f9408f13e6111298008bb7379f8d25faa4b
MD5 313173bcf07c1cacfd1690c7f130bb42
SHA1 b58e50c4a21d2c52194ede918fcb007e51fd088e
SHA512 36637fd329fd801fe2b37f264a31ce451a30efc10ed4be30c1a44bbedbf2e6823ed251211fa068ff6eea9bee175820a9c943a02867226446aa8b18b6487a2283
SSDEEP 12288:GuVGras3BCECq604DzkwYIFzHFk/se/9nnwUaajZSUDnL7rUWwY227EWSOCTkIoG:CasCEh63zkwYIFzH60q9nxaajZSUDnPO
MD5 SHA1 SHA512 SSDEEP

Submit Download

A1965A0B3E0B2DD766735BAA06C5E8F419AB070A92408411BDB0DC1FFB69D8FC

Path C:\Users\Public\A1965A0B3E0B2DD766735BAA06C5E8F419AB070A92408411BDB0DC1FFB69D8FC
Size 1KB
SHA256 577f96cfcaf0257ebaf683dbcebf0c0ae109ceba8e4486260edc4b34d5fa265e
MD5 bbe78730e9bf935fef3512e2b2bf6c8c
SHA1 988ecb6f364e760f8525a299ff9a030d4e3fe8b2
SHA512 1bde3315474196c2be9c474a8484e78c5df87856108f7096f2afa067995905ab43b05fc22e62244423a57366adb53b0baf0327b3bd37e42f313c23ad7f2a544a
MD5 SHA1 SHA512

Submit Download

HOW_TO_BACK_FILES.txt

Path C:\Users\Public\Pictures\HOW_TO_BACK_FILES.txt
Size 1KB
SHA256 a4d42dbe83b4605eb58050311d7c03fe3fb0d3a06a71360dc3fcfb152fe27a43
MD5 d507488c8d0bcafb4b49de38fd699e7a
SHA1 e0f098a6f8651b73d1abbe5b6412785c06cbfc2c
SHA512 76e54a099214312394817499c5d0c226ef469d479057a567e1585ba67c8b1ca6fdbf9ae732a2eb0037c98d1b2b35465d454874deaae60489fd5f9f13dbc37065
MD5 SHA1 SHA512

Submit Download

memory/1092-3326-0x0000000000400000-0x000000000040D600-memory.dmp

Download

memory/4528-2546-0x0000000000400000-0x000000000040D600-memory.dmp

Download

memory/4528-0-0x0000000000400000-0x000000000040D600-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads