eea4b7ee74ba71554fcd9dce0bd9c49d4b85dbb1698361d366cdc8d713aab65c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shockwave_Installer_Slim.exe
Size 5.5MB
Sample260517-2m69bshs7m
SHA256 eea4b7ee74ba71554fcd9dce0bd9c49d4b85dbb1698361d366cdc8d713aab65c
MD5 cef39b33bd51a3ae393a45153f9e247e
SHA1 59a930ca84f36469559e64fd27ca79ba7b6423fa
SHA512 989cb24e4270c0270eb92a41fa60b7869d2ff7786ac08bf9356f185e84e235dbdf9e6ff8547cc2568942487d330a470577d0b56ddaa19722ae032c04ea95348c
SSDEEP 98304:iyQKt0NVAROShruFN6+fsGwkR/2Ce2KbW/lMicMEX6S0MbFlMlnBUIFOfR7lFP8t:KDV+ruGmHB+CKbQ3biFefUiA7lFkt
TLSH
T15E463394FA8DD2ADE96368321020F2D496F9FF11A367514CB20656CA70369E5F92CFCC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3292	SwHelper_1224194.exe
1912	SwDnld.exe
2900	SwDnld.exe

Loads dropped DLL 6 IoCs

pid	Process
2076	Shockwave_Installer_Slim.exe
2076	Shockwave_Installer_Slim.exe
2076	Shockwave_Installer_Slim.exe
2076	Shockwave_Installer_Slim.exe
2076	Shockwave_Installer_Slim.exe
2076	Shockwave_Installer_Slim.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Adobe\Director\M5drvr32.exe	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Director\SWDNLD.EXE	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Director\SwDir_1224194.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\LaunchGoogleChrome.exe	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\SwInit.exe	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\SymCCIS.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\swMSM.msi	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Xtras\Netfile.x32	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Xtras\CBrowser.x32	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\msvcr100.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Control.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\DynaPlayer.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\gtapi.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\uninstaller.exe	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\SwLogo.bmp	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\gcapi_dll.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Xtras\INetURL.x32	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Xtras\Netlingo.x32	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Xtras\autodownload.txt	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Director\M5if32.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Plugin.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Proj.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Xtras\Multiusr.x32	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\adobeshockwavebundle.exe	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\dirapi.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\gi.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\shockwave_Projector_Loader.dcr	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\msvcp100.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1224194.exe	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\SwMenu.dll	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\Xtras\Speech.x32	Shockwave_Installer_Slim.exe
File created	C:\Windows\SysWOW64\Adobe\Shockwave 12\iml32.dll	Shockwave_Installer_Slim.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieuser.exe	SwHelper_1224194.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\InstallTemp\20260519214232800.0\msvcp90.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e583246.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB61886B72BA1D9F4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA5BC9C7419C874E3.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260519214232800.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260519214232800.0	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{612C34C7-5E90-47D8-9B5C-0F717DD82726}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260519214232800.0\msvcm90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260519214232894.0\9.0.30729.1.cat	msiexec.exe
File created	C:\Windows\Installer\{612C34C7-5E90-47D8-9B5C-0F717DD82726}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3350.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260519214232800.0\msvcr90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260519214232800.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\{612C34C7-5E90-47D8-9B5C-0F717DD82726}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260519214232894.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DF35A907B623F142EC.TMP	msiexec.exe
File created	C:\Windows\Installer\e583246.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260519214232894.0\9.0.30729.1.policy	msiexec.exe
File created	C:\Windows\Installer\e58324a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFABE5A5DC30A4B306.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwDnld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shockwave_Installer_Slim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwHelper_1224194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwDnld.exe

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{233C1507-6A77-46A4-9443-F871F945D258}\ComponentID	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}	Shockwave_Installer_Slim.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}\Compatibility Flags = "1024"	Shockwave_Installer_Slim.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68934FDE-CDB1-42CC-A38B-A44B43B0785C}\Policy = "3"	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{233C1507-6A77-46A4-9443-F871F945D258}	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{233C1507-6A77-46A4-9443-F871F945D258}	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{2A202491-F00D-11cf-87CC-0020AFEECF20}\Locale	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave\application/x-director	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68934FDE-CDB1-42CC-A38B-A44B43B0785C}\AppPath = "C:\\Windows\\SysWOW64\\Adobe\\Director"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68934FDE-CDB1-42CC-A38B-A44B43B0785C}\CLSID = "{D21ED08F-6B88-45EC-A71C-6BD453B561D0}"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{233C1507-6A77-46A4-9443-F871F945D258}\Locale	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{233C1507-6A77-46A4-9443-F871F945D258}\Version	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{2A202491-F00D-11cf-87CC-0020AFEECF20}\ComponentID	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{2A202491-F00D-11cf-87CC-0020AFEECF20}\Version	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{39A895E9-93DD-4ffa-A4A3-2C14608B5B61}	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68934FDE-CDB1-42CC-A38B-A44B43B0785C}	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{39A895E9-93DD-4ffa-A4A3-2C14608B5B61}\AppName = "SwHelper_1224194.exe"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{39A895E9-93DD-4ffa-A4A3-2C14608B5B61}\CLSID = "{AF551664-D2DF-4E34-85DE-46320B13A0B4}"	Shockwave_Installer_Slim.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{39A895E9-93DD-4ffa-A4A3-2C14608B5B61}\Policy = "3"	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{2A202491-F00D-11cf-87CC-0020AFEECF20}	Shockwave_Installer_Slim.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Setup\Installed Components\{2A202491-F00D-11cf-87CC-0020AFEECF20}\IsInstalled = "16777216"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}\AlternateCLSID = "{233C1507-6A77-46A4-9443-F871F945D258}"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{39A895E9-93DD-4ffa-A4A3-2C14608B5B61}\AppPath = "C:\\Windows\\SysWOW64\\Adobe\\Shockwave 12"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68934FDE-CDB1-42CC-A38B-A44B43B0785C}\AppName = "SWDNLD.EXE"	Shockwave_Installer_Slim.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C43C21609E58D74B9C5F017D78D7262\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SWCtl.SWCtl.8.5\CLSID	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Swdir.SwInstallerCtl\CLSID	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SWCtl.SWCtl.8.5	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\MiscStatus\ = "0"	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6EF568F4-D437-4466-AA63-A3645136D93E}\1.0\0	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib\Version = "1.0"	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWCtl.SWCtl.12\CLSID\ = "{233C1507-6A77-46A4-9443-F871F945D258}"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{166B1BC8-3F9C-11CF-8075-444553540000}\TypeLib\Version = "1.0"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SwBroker.SwHelper\ = "SwHelper Class"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F3CB77D-D339-49e0-B8E4-FECD6D6F8CB8}\ = "SwHelper Class"	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0103A448-2934-4B3D-A54E-FED761D472E0}\VersionIndependentProgID	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AD42179-1A88-4C3C-932B-C73EB3EA4CA1}\ProxyStubClsid32	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DB2E429-B905-479A-9EFF-F7CBD9FD52DE}\Version\ = "1.0"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0103A448-2934-4B3D-A54E-FED761D472E0}\ProgID\ = "SwHelper.SwHelperAttributes.1"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0103A448-2934-4B3D-A54E-FED761D472E0}\TypeLib\ = "{6EF568F4-D437-4466-AA63-A3645136D93E}"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AD42179-1A88-4C3C-932B-C73EB3EA4CA1}\TypeLib\ = "{6EF568F4-D437-4466-AA63-A3645136D93E}"	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEA4497F-C7DC-44AC-B81C-DFF41AB696B9}\TypeLib	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5167A27A-8594-44F4-86D3-D3946DB2200E}\TypeLib	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1BE04D7-6B93-41BB-BA82-57715AF97013}\TypeLib\ = "{014BE14D-FFF9-4BF4-826F-323BBFB3D975}"	SwDnld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F251AF8D-29B2-4D35-9BA0-FE224C2E85F2}	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	Shockwave_Installer_Slim.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C43C21609E58D74B9C5F017D78D7262\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SwHelper.SwHelperAttributes\CurVer\ = "SwHelper.SwHelperAttributes.1"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9CDE9DF-EC36-4649-8D2A-05FEBDC77167}\TypeLib\Version = "1.0"	SwDnld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B367878-C7C3-4204-ADF5-B9E091E37336}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib\ = "{6EF568F4-D437-4466-AA63-A3645136D93E}"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWCtl.SWCtl.7\CLSID\ = "{166B1BCA-3F9C-11CF-8075-444553540000}"	Shockwave_Installer_Slim.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C43C21609E58D74B9C5F017D78D7262\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1BE04D7-6B93-41BB-BA82-57715AF97013}	SwDnld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{644F7CB5-EE49-44FC-8587-FAA5EC7A2A3E}\TypeLib\ = "{AC4C21AD-9194-416E-9D34-D6C1350F28F6}"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SwHelper.SwHelperAttributes.1\CLSID\ = "{0103A448-2934-4B3D-A54E-FED761D472E0}"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C43C21609E58D74B9C5F017D78D7262\ProductName = "swMSM"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\InprocServer32\ThreadingModel = "Apartment"	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5167A27A-8594-44F4-86D3-D3946DB2200E}	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28310B1B-B757-4b87-9AFA-8E5FAF126156}\VersionIndependentProgID	SwDnld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\MiscStatus\1	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dxr\Content Type = "application/x-director"	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5E7E1E16-EDBF-4F68-85D6-CD8D4CA35A53}	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib\Version = "1.0"	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SWCtl.SWCtl.11	Shockwave_Installer_Slim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F251AF8D-29B2-4D35-9BA0-FE224C2E85F2}	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1BE04D7-6B93-41BB-BA82-57715AF97013}	SwDnld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{083BBEF3-E0FA-42C1-897B-2EFA642F6654}\TypeLib	SwDnld.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C43C21609E58D74B9C5F017D78D7262\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{233C1507-6A77-46A4-9443-F871F945D258}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\Adobe\\Director\\SwDir_1224194.dll, 203"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SwBroker.SwHelper\CLSID\ = "{1F3CB77D-D339-49e0-B8E4-FECD6D6F8CB8}"	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F3CB77D-D339-49e0-B8E4-FECD6D6F8CB8}\TypeLib	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F251AF8D-29B2-4D35-9BA0-FE224C2E85F2}\ = "ISwHelper2"	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\7C43C21609E58D74B9C5F017D78D7262	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\Control	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SWCtl.SWCtl.8.5\ = "Shockwave ActiveX Control"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-director\CLSID = "{233C1507-6A77-46A4-9443-F871F945D258}"	Shockwave_Installer_Slim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5167A27A-8594-44F4-86D3-D3946DB2200E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}	SwHelper_1224194.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Download.SwInstaller.1	SwDnld.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28310B1B-B757-4b87-9AFA-8E5FAF126156}\LocalServer32	SwDnld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6EF568F4-D437-4466-AA63-A3645136D93E}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\Adobe\\Shockwave 12\\SwHelper_1224194.exe"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B367878-C7C3-4204-ADF5-B9E091E37336}\TypeLib\Version = "1.0"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5167A27A-8594-44F4-86D3-D3946DB2200E}\ = "ISwHelper3"	SwHelper_1224194.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Download.SwInstaller\CLSID\ = "{D21ED08F-6B88-45EC-A71C-6BD453B561D0}"	SwDnld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{014BE14D-FFF9-4BF4-826F-323BBFB3D975}\1.0\HELPDIR\ = "C:\\Windows\\SysWOW64\\Adobe\\Director"	SwDnld.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1832	msiexec.exe
1832	msiexec.exe
3292	SwHelper_1224194.exe
3292	SwHelper_1224194.exe
3292	SwHelper_1224194.exe
3292	SwHelper_1224194.exe
3292	SwHelper_1224194.exe
3292	SwHelper_1224194.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3888	msiexec.exe
Token: SeSecurityPrivilege	1832	msiexec.exe
Token: SeCreateTokenPrivilege	3888	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3888	msiexec.exe
Token: SeLockMemoryPrivilege	3888	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3888	msiexec.exe
Token: SeMachineAccountPrivilege	3888	msiexec.exe
Token: SeTcbPrivilege	3888	msiexec.exe
Token: SeSecurityPrivilege	3888	msiexec.exe
Token: SeTakeOwnershipPrivilege	3888	msiexec.exe
Token: SeLoadDriverPrivilege	3888	msiexec.exe
Token: SeSystemProfilePrivilege	3888	msiexec.exe
Token: SeSystemtimePrivilege	3888	msiexec.exe
Token: SeProfSingleProcessPrivilege	3888	msiexec.exe
Token: SeIncBasePriorityPrivilege	3888	msiexec.exe
Token: SeCreatePagefilePrivilege	3888	msiexec.exe
Token: SeCreatePermanentPrivilege	3888	msiexec.exe
Token: SeBackupPrivilege	3888	msiexec.exe
Token: SeRestorePrivilege	3888	msiexec.exe
Token: SeShutdownPrivilege	3888	msiexec.exe
Token: SeDebugPrivilege	3888	msiexec.exe
Token: SeAuditPrivilege	3888	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3888	msiexec.exe
Token: SeChangeNotifyPrivilege	3888	msiexec.exe
Token: SeRemoteShutdownPrivilege	3888	msiexec.exe
Token: SeUndockPrivilege	3888	msiexec.exe
Token: SeSyncAgentPrivilege	3888	msiexec.exe
Token: SeEnableDelegationPrivilege	3888	msiexec.exe
Token: SeManageVolumePrivilege	3888	msiexec.exe
Token: SeImpersonatePrivilege	3888	msiexec.exe
Token: SeCreateGlobalPrivilege	3888	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3888	2076	Shockwave_Installer_Slim.exe	82
PID 2076 wrote to memory of 3292	2076	Shockwave_Installer_Slim.exe	84
PID 2076 wrote to memory of 1912	2076	Shockwave_Installer_Slim.exe	85

C:\Users\Admin\AppData\Local\Temp\Shockwave_Installer_Slim.exe
"C:\Users\Admin\AppData\Local\Temp\Shockwave_Installer_Slim.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\msiexec.exe
  msiexec /i "C:\Windows\SysWOW64\Adobe\Shockwave 12\swMSM.msi" /qn
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1224194.exe
  "C:\Windows\system32\Adobe\Shockwave 12\SwHelper_1224194.exe" /regserver
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe
  C:\Windows\system32\Adobe\Director\SwDnld.exe /regserver
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1912

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe
"C:\Windows\SysWOW64\Adobe\Director\SwDnld.exe" -Embedding
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb2EDD.tmp\System.dll
Size 11KB
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
TLSH
T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWDNLD.EXE

Path C:\Windows\SysWOW64\Adobe\Director\SWDNLD.EXE
Size 149KB
SHA256 97b38e7eec63db75aa0ec641e84e70f8c2c7ecbc7af9ec12db2deb9b99633476
MD5 69a2bf6a67499bfe2bbee488ae40dd1e
SHA1 b84ab91333d9c41f080d324e6366975ca55cdb45
SHA512 085bddb6d1ee0966e2e7cdb0e48182e8dc01fd16579a4e04c2eec44b0f27b90605b2022f0e7832edb1d7c354fc053d66c8e490ebb13f58f1de3253df75cfe2ff
SSDEEP 3072:XDWAlLHBuyigpgqF/ip1zJzmVrROMaCnh7LjKzh0:TWILHBuyial/ip1zJzmqMaaQh0
TLSH
T1C3E36B2137E0D0B2E16717308D64ABA65ABFBE715935924FBB58176E1FB02C09E38317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwDir_1224194.dll

Path C:\Windows\SysWOW64\Adobe\Director\SwDir_1224194.dll
Size 393KB
SHA256 038205161ea49b4223301fdf544ea11bee944b88a6371bfe714c1ab3bf216a98
MD5 2da2c7f8e80776f6e52758bb846e6735
SHA1 282fadf7538ff39185b3bd25ee2f27dba38cba28
SHA512 690ee382e2cd23d11baa82c84cc94baa3106a8bed822a4409df7013f4e84b2893bb09c22d6bea3d93814db78bff96cb488288ec9db7741e8d76785c633df9303
SSDEEP 6144:8F+ZapPf9LzSK4fJicaXZRMdkoLPtJvl4bsh7THiD0msaOV+199sFFQ:8FL19L5MNu8PtJvebsNTCJOV+199GQ
TLSH
T137842891A7E088F5F2B31B786D74AEE519ECBD626E31C24E13D43A4D0EB0780D954B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwHelper_1224194.exe

Path C:\Windows\SysWOW64\Adobe\Shockwave 12\SwHelper_1224194.exe
Size 1.3MB
SHA256 1eacaace1138723e0ac35a0e76cdefee24c851ac2db3ddd2bf59388d54f8231d
MD5 37c6f3416acd853a7e4f126fbd7b810f
SHA1 a7fc077109a3991df3ba4730459f846385c55691
SHA512 3da2cca3d9377d6912e00e4a47287ce220ac48614ce086dd1c91c493650a04e5e18f567268c37971dc9e7e5987b59f74c217690576841180b649b79774d8a221
SSDEEP 24576:fDcJgxBaxvP2ZyaWaS557hzUfOEXTreyyFFJ:QJ2cxIyvaS5LUfzTi9PJ
TLSH
T1B6558C327A69C535E3E31272CE7D766D80ADEE22073151C773D83E5A6A706C32A71683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SymCCIS.dll

Path C:\Windows\SysWOW64\Adobe\Shockwave 12\SymCCIS.dll
Size 165KB
SHA256 57c2e40d50ad5630c6919d0f49c8408c61538ba6ce543cda6f0917eb3d3318b6
MD5 5a204ecc0974f5d496cb4299d49d1125
SHA1 53ca0edd8b14038e7eb51b89b75041d46d2a71fb
SHA512 a7e45db14cececd6acc15e650bdc2d9c5ad5f0983f29cd44ed92b7234c4c6a528ff9730f0cb15f256a9aa760cc884c7fd816c00a49ca88f890bcd77a626c8a6c
SSDEEP 3072:9PNzXa3nLf3rl8CkVeE8fwsoEfNQpisg2TEC2whRas8+KN/sJ9DqldGx:xhEb3mCkVezfwsoEQisg2TEC2whRtMxA
TLSH
T1C0F3129F2F358649DDB0C3348EC7C7BC4EB6E971D3159B8170A643A32E0B6589B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcapi_dll.dll

Path C:\Windows\SysWOW64\Adobe\Shockwave 12\gcapi_dll.dll
Size 213KB
SHA256 99d5638c5cd053a3f82500fb338c76efdd5be4bf8f8ba65dc3006b1474295e36
MD5 d4732a076f47cc93e0435fd2c0664431
SHA1 3daa973b734a5add80ac0495d80434fb14b87156
SHA512 f22a7d6283f6932c13acd7b30f1a2ce2b9866702a5aadbe24ad38eceaa385b616fd4badbe3c7e44dcdd9040f050ace0d8156a7cc2d2f63ce7257887c33b862b9
SSDEEP 3072:KYQfBdmZvgEhHBuz1m/tc86rcQYGbfQdT+Oe7nbo+XyF:1QfBomSq1wc83PUfQdaOW9y
TLSH
T17424AD217190C072E2EB057985A6DBB64A7DB4310768D6CB7BC48EB89F207D3DA36347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gi.dll

Path C:\Windows\SysWOW64\Adobe\Shockwave 12\gi.dll
Size 1.6MB
SHA256 35c9ac4659344a7258d89938cb3f526637c66c43b87e3b7d6e79c6ba454fa62a
MD5 92dbf79478de2debe2eb86da61400721
SHA1 de10533f007fc56aa7e0d3ce044de9bfd5f52fcb
SHA512 2e9d388e578a5396e6785a0d2cf906e60698dccb7c6b06e17dd2ab87592d0e4eb2b8c093b1a80c6d90ebaae900ba525111ad2745cd35f571a2680a66773dae91
SSDEEP 12288:zI0hNNXzys8Qc4cLlTAs9NlbYYYYYYYhYYOYSYLE28/kbWSkJa7dUVgH9b3meL6m:M0LNDlgFvbCE28/kKSAa7dRH9bT
TLSH
T1D2855A1177F0CD25F1F22F386E75A692097BBE116E35E94E3A1C354D2732AC0A968327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gtapi.dll

Path C:\Windows\SysWOW64\Adobe\Shockwave 12\gtapi.dll
Size 72KB
SHA256 41933ca9284f608e86ca5be2f0b21fdc75b7ad36f3b06622d484181c7331a3ad
MD5 93038b1c1dd08024c18f55fbc9bab8fc
SHA1 9fe535d6910c16f92821d26497216d6d57402589
SHA512 b4b9b5e31bc15c9c7161682103594bd8b847de2f4657e667788626c8cb5be4b7e70943ea77a9c713a99ed0aac46f0fd1dad8e4ce2bfd3884afbf0ba1dca648b9
SSDEEP 1536:aqZGD73HWbCj5dDEzRlyWG1kU2VD82xTebgwcPCoCASpQVSACDOosz:aqE7H5SdY+CTASpQVEDb6
TLSH
T19B737C6230D5C073F55A417E9487C2224B6779A0CEF68AD72FD346C98B266E2DB3E305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swMSM.msi

Path C:\Windows\SysWOW64\Adobe\Shockwave 12\swMSM.msi
Size 2.0MB
SHA256 0bb631d810fdd00cafe5da937174a5df79ca4a4daa46a0e714c39a1ed06fec3a
MD5 25b47efbe9dcef40bb9760b6b7846b99
SHA1 0c9bf0fe2fb303f661cb9e422442200974f5ac28
SHA512 0707aa06ecfc5a4b8ac564e3556ccfc458a6a81cf652084be7917331b25c14e2607479212d67d65dd0bfac264cc8fcdda58c3c379ab86ec1bd2f5d309b2770ec
SSDEEP 49152:Otl5YydZG2l55EpnKHBcKRW7Y7nkDbrVbBqNoPk:qYydZGaEpKhFEM7nebrd3
TLSH
T127A51203BA868772C5464272444F97349B78EC698B25066B3764F71D3CF2AA0B3F75CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2076-78-0x0000000074070000-0x00000000740FB000-memory.dmp

Download

memory/2076-94-0x0000000074070000-0x00000000740FB000-memory.dmp

Download

memory/2076-97-0x0000000074070000-0x00000000740FB000-memory.dmp

Download

memory/2076-108-0x0000000074070000-0x00000000740FB000-memory.dmp

Download