Analysis
- max time kernel
150s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe
- Size 2.3MB
- Sample260919-2f3mkacc43
- SHA256 8ed3b3fc33c27558b1e8f1786cf35f91a4cfbbb5749d12c770165f13012db5bb
- MD5 2d85517fe8e836a650ea14fa031527c2
- SHA1 e0746d606bf8fa6d742f813e012949346aca056a
- SHA512 b5ac0564e3ed24aee90eb7d963bafdc0e2fa9236cb3a2f3cb0bcc59e77ed8e5b1e1bb89a619b04c00a627f271bda6288840718827d2bd3055f2a3237c410250e
- SSDEEP 49152:vIv6CD3uUlKkwXA5R7mJ0N1KbozS+iyUZTwb+v8oai93PblttrJH9Hib:vIv6CivkwQ5R7miPiXPfai93DvVrib
- TLSH T1B0B5337023944C26D55409F429D8AF28CE27CD7F8A84879B0B85FBAEADF1E538E35057
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Drivers\npf.sys jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\SysWOW64\Drivers\npf.sys jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe - Executes dropped EXE 1 IoCs
pid Process 2404 sb32mon.exe - Loads dropped DLL 17 IoCs
pid Process 5212 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe 5212 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe 5212 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe 5212 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe 5212 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe 5212 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe 5212 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe 2404 sb32mon.exe 4116 NOTEPAD.EXE 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened (read-only) \??\B: jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened (read-only) \??\D: jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\packet.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Windows\SysWOW64\pthreadVC.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Windows\SysWOW64\wpcap.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\SysWOW64\packet.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\SysWOW64\pthreadVC.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\SysWOW64\wpcap.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\Purchase SpyBuddy Now!.url jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\Readme.txt jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\backdating.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\logclear.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\cp_removal.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\sslogging.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\support.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\xxxxxxxx.yyy jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\aoliehistory.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\timeout.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\Install.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\install-drivers.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\license.txt jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\startup_param.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\whatsnew.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\windowlog.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\logging.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\aoliehistory.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\faq.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\sslogging.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\stealth_tips.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\whatsnew.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\thread.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\contents.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\email-providers.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\logclear.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\printlog.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\purchase.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\ jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\Visit the Official SpyBuddy Website.url jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\getting_started.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\startup_param.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\license.txt jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\email-overview.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\frames.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\pwconfig.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\schedule.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\web_content_filter.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\header.gif jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\keystrokelog.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\logging.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\timeout.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\Install.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\Visit the Official SpyBuddy Website.url jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\contents.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\ jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\email-pop3.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\header.gif jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\uninstal.log jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\clipboardlog.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\disableboot.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\sslog.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\webwatchlog.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\install-drivers.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\clearlogs.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\logexporting.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\windowlog.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\winstart.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\support.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\email-pop3.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\getting_started.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\keyview.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\help\email-providers.htm jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\winsscap.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Windows\vmlmod.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\vmlmod.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\winsscap.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Windows\sysicept.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\sysicept.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\sbtril32.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\sbconfig.dat jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Windows\sbmsncap.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Windows\sbtril32.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Windows\unvise32.exe jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\sbconfig.dat sb32mon.exe File created C:\Windows\sbconfig.dat jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File created C:\Windows\sbhks.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\sbhks.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe File opened for modification C:\Windows\sbmsncap.dll jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sb32mon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe - Modifies registry class 15 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Set value (data) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Set value (data) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Set value (data) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\0 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: 33 2404 sb32mon.exe Token: SeIncBasePriorityPrivilege 2404 sb32mon.exe Token: 33 2404 sb32mon.exe Token: SeIncBasePriorityPrivilege 2404 sb32mon.exe Token: 33 2404 sb32mon.exe Token: SeIncBasePriorityPrivilege 2404 sb32mon.exe Token: 33 2404 sb32mon.exe Token: SeIncBasePriorityPrivilege 2404 sb32mon.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe - Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe 2404 sb32mon.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5212 wrote to memory of 2404 5212 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe 93 PID 5212 wrote to memory of 4116 5212 jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2d85517fe8e836a650ea14fa031527c2.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\sb32mon.exe"C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\sb32mon.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\readme.txt2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4116
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4864
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\Install.dll
- Size 197KB
- SHA256 712174f4b22205dd1ef1b3732df9406f0385aef1ff74a90f290c0eb0cc41ca1b
- MD5 9473ba2824b50cd014fe0552667d1cc1
- SHA1 09530114e31273b06d2e053c9eb22116068a4219
- SHA512 604a80c804b1543c53ff8e07f6a8c152f0ff2dd1d200ce9a94804ef060a4a12fe4f16100d62dbad4cf7bbbb0f8e005bc758888d0b3acd62e2cab35e5d1aa6b1c
- SSDEEP 6144:CaSP/LZYJIEWcPmvzcIfdRVd2MQMpPUz:CaC/FY5ev4gRVdtJa
- TLSH T1F71413D66CC46DBADC5D48734AABF541601786768BF00A82CF9F554ED92B07CCF22392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\Readme.txt
- Size 1KB
- SHA256 c62ddc7e9e1e2f61d234b9f092cd4df456ce3bf180d4ec6bde184f2d8ecda8a2
- MD5 b0c952459d61741f1bbd6d846edc99b7
- SHA1 e80b80a060188cfcb5b0c480d8db46e2cdbebb34
- SHA512 c66a9828e1b8181aa7e3c11c5a61c19660a453c4f1176fe2155ad706d0dfeffcc6a79c699896229e236c1d6b92efae953043d6add12bf44496a4404d30f4e69f
- TLSH T16D21F3EFD25B90E557510530373B098BFB4151F1F2D81D82F019709E0313F2985ED89A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\install-drivers.dll
- Size 520KB
- SHA256 beaa50c9389f7704b2b6d2172ee5d8fd0f56654ef6a8366bc6f73eebeea03ff7
- MD5 7c25925a82654e805500be3b3eaf4472
- SHA1 0590d521d42e99c522ee4ce0ba3195953de8617e
- SHA512 bed9dc0ae9bf159416120cb760db1aa2b7809fe08e9868df8af8e5222d1c48b941bea6ee7c2242ec8595e2f406015a0a54251d3ea4104c04ce763ec50ef0485c
- SSDEEP 6144:Jgzc675QMda36jOxHiFn6nGAU0inMHYE3W/IElBbUvPXBvRBniHgYnZGw9rRlfyi:Jgz0Gz0GKYhAElWvlviHgYZn9rrlmX
- TLSH T17DB49D123B83807FD6A2417915966B365E3B691123F185C79BA1CCA92D232E2F73F347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ExploreAnywhere\SpyBuddy\sb32mon.exe
- Size 673KB
- SHA256 30e2ef3c38fcf9502bb9e58d3cad3c568036cfd6a7cb70b57e72b404aa539f64
- MD5 d0035da38c143a2bb14825a7e871a6f1
- SHA1 2999511c4b849b4dc3179613cc92961fee200cba
- SHA512 ef1e9c2a8c109de16fc58dfd8392da218e12c08c0627cd412faf8a2aca4124943f7434a6feb724f9c657e89144eac23891f4bb9bc929b882cd4cdb66714c05f0
- SSDEEP 12288:1Xou5medTOsBrK6heF3h/tlxA7u6PSWHZ/47yseTRcX+Gz++/My/L7:1foedKsBrKzbbutZ/47ysfu1A
- TLSH T164E4236A7BA906ADC01436B7038A8779964BE2B65487DF634E78700F3BFF35861C604D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\English.vlg
- Size 13KB
- SHA256 ada22eb8e66b404689fabf256e185dd0a9005b7bc7e6c616db27ed7dbec080a5
- MD5 aa00f72bfc4b20e2ef89a6d705c19345
- SHA1 965362d97bc6e19a711d7730ec1a76ff2400508f
- SHA512 458d4da6b853b6561b0777817b77f8b073e6e3c7d63bd4ea99117e06d8dc79d02ccaf17d410ad4d2819fcddd2bfd78b2152ff502c03efb14299320733a19c358
- SSDEEP 192:juireOnvxsFxDV6E6iVe9SVcZTCnfuxoiWR8UC+TdvnNLfPmCTwmOuG:juidE6E6i44VnfJiWRRvnNLfPmCg
- TLSH T1EC52988E5B4643BA2A91029BA28E37C3B6D0C05F127E199141E6B07D639B744C3EF6D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\default.bmp
- Size 18KB
- SHA256 d9d5e28eb445e7986bdef4d409868af205d525f2f0729427dfe3e33a7251b15d
- MD5 f372b11ff99bffed4cd279c0155adede
- SHA1 89cbf60925076e9a14fd48b13790422b43a5b989
- SHA512 e902f0d7ff0e2af64ce3e8ae6d704ec21b04b35ac3f25a9acd53938b3b66fbaa02b25e816202f165e2d7339b62d2cd6fe9f764d64eefd5b24d1a108cb4b2679f
- SSDEEP 48:gqPrH9b8On073Nbk4HvZ/vzjv6UqZf48jYrwtPE4aODu1jqngAz7l3jdK:gqDHeR3uYh/vmfVjY2PEXg7l3xK
- TLSH T1F382681B2149361926ED6A225629AFECC411DE4B017C99FDD43BF73742B096ACE3740F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\jpeg.dll
- Size 104KB
- SHA256 c83e2f98b9182073002b24c731f9fe0512bc4a3b468181c677d20fc465218232
- MD5 0da8449291b80aac6c6f7e356d14ba36
- SHA1 421456596c690b69d262dcb5e96f474c3c92ab14
- SHA512 4e99332b791a7629d8541fce0e3d56d3452168abbbe5e56e38d79edb440bf1e12ca2d73d2f79d78a5c2ba282ab3ff84103691153fe26da670e9a9a28f75713ac
- SSDEEP 1536:+ouMgB/g8nm5mAifWSyUtdKTgopIZ/sh5iTjHoDVK:+ouMgBIe7hp/oi/HoDVK
- TLSH T148A3B03176A04071D0E70276165AAF2EDFBE23620AEE5ED3877869501F309B1FE37586
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 5KB
- SHA256 ee4bca94e87b82d769705114bb762159c1416b065aa52eeb617952fd2cf08561
- MD5 0286eec61c6e5e1a863ce2397cdbfad7
- SHA1 655a655162be68dc169f9aca31b80c083bcec26c
- SHA512 7cac0132b1053db36050a980c88184bf7b8418e752277d76b1ba1ce864b1250eb416f29c8bb8e960837e92b4f04fcb19d17a537c27abd0b255d46bc046974ba5
- SSDEEP 48:wyKy5UysylyMyyyGmeKMKneLSInyQMynyO2yoXyosryopyo1yoqyKyMykbyklRy9:TkePKneLSIgz6pdupx0coyaNHzAw
- TLSH T183B1D5EA7429CAD0730B78453B4F4D0035D1FD1A79DD3C76A98876AB88A3F22B06D571
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 5KB
- SHA256 2f286d6e0fe74f47a28c48c8b456b950c09dcf068174c0e9fa76bdbcd50c4fee
- MD5 621e1c1b476785f3dbaefae1479f27e7
- SHA1 b1b1fdd127ffc5d1af7db0c50bc7eb64307650e2
- SHA512 1067d3ff9d8a8af8cf725e05d9b5d48e5970b62c665b8ba6954a293e2b240527f4ced984c66692beea3feb9dff36a8391241fa00c61f8aa42e88253f4ee0f47a
- SSDEEP 48:wyKy5UyzylyMyyyGmeKMKneLSInyQMynyO2yoXyosryopyo1yoqyKyMykbyklRy8:TrePKneLSIgz6pdupx0coyaXHzAG3w
- TLSH T13EB127EA7429CAD0730B78453B4F8D0035D1FD1A79DD3C76A988766B88A3F21B06D571
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 5KB
- SHA256 0771d0f2c8826b98b8f61c0ad11111f3f0f6a7989f753d59ca9dedaebb6c56cf
- MD5 3c0540f8599d78e98550ef647d18b795
- SHA1 03659e9e45aad6ff15c7b79582e618edfd0253bb
- SHA512 f81f97c2351d4df9485bc6a4cba157dc787a1326fe295ebb4d9d8cddbd3a6150d2dfee60c2aaea14dd2ee8b6dc1cfec47cc1ab59f18f8ecbbcc6542166fabeca
- SSDEEP 48:wyKy5UymlylyMyyyGmeKMKneLSInyQMynyO2yoXyosryopyo1yoqyKyMykbyklRm:TgePKneLSIgz6pdupx0coyaRHzAw
- TLSH T160B116EA7429CAD0730B78453B4F4D0036D1FD1A75DD3C76A98876AB88A3F22B06D571
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 116B
- SHA256 1a9de17717128dac3f5a1df55dbe456b9ebbb252ed9d29c23a81cef6e9b45116
- MD5 41382bf06cf821c6ffd0be9098814b0b
- SHA1 d8496dc008b36dd4701645e6f2f83b8dd33bd3e6
- SHA512 f0a3709fafd9a878b819b15db7e625af0b56f452b2e231910a92a541655fbd4146f9e20a4fdcc8bf48cbebb6b12c2e7440d3273a4063898f5250acaba6e06796
- TLSH T140B012B1981BCAC03207F94E334C0D001214AC0575EE18B9F688770748D3D70709C571
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 473B
- SHA256 6eb915b238289437837837a95a37c17c13c24ab482884e1a4f8614742fb966e1
- MD5 522927f24bf433bdd6747850a16599aa
- SHA1 a560eb3d1204c84526b9e999aea21be03be07790
- SHA512 3cc135597cc1cf1e70451651732c1c642dd2ba02a941e4ff6b58407a3ff02df0e3846bba054cfa506989c4e3d1974fc7522a4e61c65e9d1aa5a6fa67561297cc
- TLSH T183F037AA642ACE90770B789D774E48043185AD2579DD29A9F18C77D744A3D20B09C571
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 5KB
- SHA256 c3f62584c3ece1f98467260c317e1be105e5ab547833c312b2d7607b68d5d200
- MD5 a2f4b14a78a5cb9a10e97030ce6ac6f2
- SHA1 ae22d4446181adc595fb156b433acd7fce36e6bf
- SHA512 782d8523ab03631ef5ecae0aa086e7026f1ba27c175ae62fbac6d711759716154e423552dfded84e31641f3a5184b6140db55851862ede9938483c492980cf3a
- SSDEEP 96:TzePKneLSIgz6pdupx0coyaBHzAUzAwG3w:Ogz6pdupx0unA
- TLSH T107B136F67429C690B30F78453B4F9D0035D1BD1A79CE3C76A988B66B48A3E21F06D672
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 3KB
- SHA256 fbdde582be1d0e6cc2ee391bfc68e77a98d83573f85c0a83b0ec29ce53276f1f
- MD5 b1dc53d726f24d34936c4b15ca02af0b
- SHA1 4cad59859aaa7f8eeda868811b2ecc889c4fe134
- SHA512 8a2455c9a399599e174a76b08f3cfa668adee4b7bf94029d68e7b396783bcaee1acb104342c17a2922c0e99530d420d8ef9b23a7f40d1a5133622e77b1a31670
- TLSH T1E581C2EAB429C6D0730B78453B4F4D0035D1AD2A79DD3C76B988B6AB84A3F31B06D571
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 5KB
- SHA256 dbdf0a52bcc1d6cc4b0712f136869e3eeb6a6fc889cdd3fd36733742c981d3b9
- MD5 a6de6a8252b83ff005b330c1f7a47ae4
- SHA1 cc8e8cf181fe3a1d661c949854d01e5fe89e322e
- SHA512 673202e76291cf247ddc564db440270a887fe48f7beff2f035d6fb8f9ffd50fa88b23459b40c4edeb8b9b076dde90ce02b2daf8438fa2482a52eb6cd49dffbba
- SSDEEP 96:TTePKneLSIgz6pdupx0coyaBHzAUzAwG3w:egz6pdupx0unA
- TLSH T147B136F67429C690B30F78453B4F9D0035D1BD1A79CE3C76A988B66B48A3E21F06D672
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 4KB
- SHA256 8de060ecfa4223626cdea63e97ad43d7cdf454bf5b162b2b815be3c56e68b174
- MD5 6436a5567e7784cd9b7530aad29b5710
- SHA1 e63648f77a8b62c4de1b58fa74b36e3f7e3783c6
- SHA512 b821a23840959d0b85309c29c368bb5e42bb3429e92943f1f2df7da00fd2cf0f0f2ecd4ae60019bf1d684089a6a6144b5ae786c3e62bb179820424365d9bf8d8
- SSDEEP 48:wyKy5UyaylyMyyyGmeKMKneLSInyQMynyO2yoXyosryopyo1yoqyKyMykbyklRyD:TeePKneLSIgz6pdupx0coyafHzAw
- TLSH T121B1C4EA7429CAD0730B78453B4F4D0035D1FD1A79DE3C76A988B6AB88A3F21B06D571
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\rollback.log
- Size 5KB
- SHA256 3ff1f3987fcf7a12be3240cb3b869dc14ae4cd54e951e9e35559dbf3a37b1481
- MD5 816597f4c7959f6402ad742c6ca1f48f
- SHA1 268a602c01927878e263a5270b9b9547de441276
- SHA512 583b29d597e01c890a2e02d27ad20258c9e354762600f7d450630d9f89901ac2a41cfa207111650ad1c9dc78d7eebb124e59a4069d4226c6fb72f1065a0a160c
- SSDEEP 48:wyKy5UyhylyMyyyGmeKMKneLSInyQMynyO2yoXyosryopyo1yoqyKyMykbyklRyn:T1ePKneLSIgz6pdupx0coyaXHzAw
- TLSH T1D3B1E5EA7429CAD0730B78453B4F4D0035D1FD1A79DD3C76A98876AB88A3F22B06D571
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\sidebar.gif
- Size 16KB
- SHA256 2950a4fefb20476b7b90a8af62c39f780f3e3e89c0a69803237a40d68e33b7ef
- MD5 d5085ac9ee5fb12b19922b674b8af239
- SHA1 68f04d4a173de403deab747e77e628f3591295e3
- SHA512 b023999f4582a2140661e4ace3171df27b1479b4c2fecb6d04e3d32baac52d26bae22f433307ce3952e551bf61839229e8fc6c3dff5db960ce08ade0b3f636ce
- SSDEEP 384:RxbALw/jHSJbIsQ82NhNs6nrVJtumoKWypICzTB6OIJUA+2qBVcUct1KcW:HL4IsQ8sh5nrVLulyzICCKVti1Kn
- TLSH T18672C00199BE8136104D3C3C5C2486B8F7E976C1DB68D8D4E0A9797AE6832DFB365C31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 5KB
- SHA256 13d01b545fcb7e77c5dbe26abcfa1f9b7dd8695e019363a9072f244543ab21f2
- MD5 0343fedca81bc38a68a793f779eb4f87
- SHA1 b1ffbb062be455b8d64dff69028bfae895b72da2
- SHA512 627d9e62fc190516c7cac9a0d166b31dcc12082d1591adb8d8cccbf323a1b23545cc62f1801c830296ebbc723d56954184da0899411b81b320a804a7c5fee56a
- SSDEEP 96:xwX9HLwLgpkBe98IuHZE7pWbBM3N0apm65p/uALsu18idiA:ZewZE7pWbBM90g1
- TLSH T10EC12FE2B439C6C1731778453B4F9D013280D86AB5DD3CB6B588B76B48A3E72B06D572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 5KB
- SHA256 4f47e7aa6a29d90e9488ffc5d97078e5a522401dc187f1a519850fa5465d6242
- MD5 2ea1f172a7530f7a1d235cc6e9c84e70
- SHA1 48f8cb4fa528110d596a54bef440f8b96619c543
- SHA512 1de15febe5bec5776bb2e331708ee062df96c061d04ce37e1b648f6bd092b3a832cd9cb124111210a42d01d379f9bb9a8cfab46337f1a399d399b28584c9a634
- SSDEEP 96:xwX9HLFLgpkBe98IuHZE7pWbBM3N0apf65p/uALsu18iPiA:4ewZE7pWbBM90rL
- TLSH T1BFC1DAE2B439C6C1731778453B4F9D023280D86AB5DD3CB6B588B76B48A3E72B06D572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 5KB
- SHA256 b2dbd73dc7c9bcabad742bfe2701a92a5e6ac2384b983fcd39ba73693d031308
- MD5 5acd4c81fe18418eac7a5561612fe726
- SHA1 f99b5a652cff1d1dd362d3c15a04060ad80d5968
- SHA512 8e495b1248370d17e179cbf5e63a69d3c7eacf951b3294fb5ac2682ff941e5035069e7346feca5fc34a5adfb3e0a67233702296e96dc3afdf6af6337cfaa5494
- SSDEEP 96:xwX9HL1LgpkBe98IuHZE7pWbBM3N0apK65p/uALsu18idDA:cewZE7pWbBM90IC
- TLSH T1E8C11CE2B439C6C1731778453B4F9D063280D86AB5DD3CB6B488B76B48A3E72B06D572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 5KB
- SHA256 2beec6c6dd75d9e27a706470229d10fa6ca56f1f97db48c76218dce66a425fad
- MD5 fa819c62f5a1c7895606979b48556404
- SHA1 9cded3a4efc96aebb6efcbaa8030d0f796c58c35
- SHA512 2503d7a09ab605b64553f3a87fafcf9b423bf61509f8aefb7228de48a22cd49e3cc8a281a093e0579a03fee63bc4690fc2c0e745017b6c2cfbb24cfddf1709a0
- SSDEEP 96:xwX9HLeLgpkBe98IuHZE7pWbBM3N0apr65p/uALsu18iA:zewZE7pWbBM90Rs
- TLSH T12EC1FBE2B439C6C1731778453B4F9D063280E86A75DD3C76B488B76B88A3E72B06D572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 5KB
- SHA256 70a9be98fa8eeb4dc07475a41be90cb4e262f9edd82aaefb3c7c84247b95b1bc
- MD5 6210de09ac6be58f72cec5a8a51f8580
- SHA1 73a679e9797af9eb0325abe065185e8fe5d114b7
- SHA512 9484bb518041ace7e9c4cfff7d8beb8c5becc654338fc781c3a6d7d84b7f11d98e62c4eebbae56c8db5bd3bb22b481eebc9f81b0ae3f176bf6ffbbe560da9c1e
- SSDEEP 96:xwX9HL1LgpkBe98IuHZE7pWbBM3N0apK65p/uALsu18iA:cewZE7pWbBM90Is
- TLSH T174C1FBE2B439C6C1731778453B4F9D063280E86A75DD3C76B488B76B88A3E72B06D572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 5KB
- SHA256 2b4abf530f6d8b58ca88c83ae333201b02055dd2deed4a2592dbb0895b404969
- MD5 46e753719fc64e93060016ea242fa8d6
- SHA1 c15ffb32788392e2f942c0fc62f9646dd43b5cf7
- SHA512 d25bfe21b51b17e1a862cad910834949123b6615c8ca403d3e74bb5dc02a6de36da05e6d7ddc2dce47f082f97dc98d79f0eb227d2c9eaa05d4438ea7e907859f
- SSDEEP 96:xwX9HL0LgpkBe98IuHZE7pWbBM3N0ap865p/uALsu18iA:9ewZE7pWbBM90ms
- TLSH T191C10AE2B439C6C0731778453B4F9D053280E86A75D93C76B488B7AB88A3E72B06D572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 293B
- SHA256 1517ebf2bd0c3eedc896d62c904ef9d801f6622b3ee029808589201cea2c6287
- MD5 d22f9d69ee1799018058d2aafd5869c3
- SHA1 057ae46890b1090f6b855673e69d7d1db595d008
- SHA512 6a05d0b7b546d87833f016f1b584b3de8f5ec89fbc005f6d33101ea6b81e1a01368578549ebf06276c4cd4bf6f35ad7fbcbe85741f86e29074fce1f9d87bdf07
- TLSH T184E0C2C2C44E82A229823C993BAE0E842108AA6574D9142DF289B75B58C2D71B2689B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 632B
- SHA256 94352279ee7724da3e8a5b08de388face198a69fc58a3e20d2e36ac052118d2b
- MD5 32894398c9756d39c8d195b271c2eb40
- SHA1 d8938011b4106f3b848e8f5c6cc3f6e1fa6cbab2
- SHA512 31936b609d3fb715ea8352661b767b8f2933be48d768490251fb6afe0e2aaf7cbfc50760a41dc6d28c0571ddf45bb488c2e5e6c6f92034164e3d00b24a8fae4a
- TLSH T14DF028D6D01ECAD173437CAD7B9F0D483104A92678C92869F18DB7AB48C3D30B16C9B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 888B
- SHA256 919c8dff524d09a065b386a6f86a86c4dbf928cae39e5edf4c04bb69b9696250
- MD5 9fab2753dba8f1f3112cab73287f79cd
- SHA1 6bf5008234ce512c379b4e67f308e4b11d988855
- SHA512 eb7dd840c0855400377b96e3d9417c024d2897ffada3679705d5234a0f836468f5a06034081bfdd4ed65374cfcea416227b873e442a3f3c66c855b29a343d08b
- TLSH T13E11E781802AD7D2B25338993B4F4E082244E95675CA692AF18C73AF9843E71F07C5B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 986B
- SHA256 7253e0e108d5b5c1bed331ee4db65d48a19ee85080e6cd27fcfcfd54fec2c959
- MD5 34535ec9a331badcb787ba5164201ec8
- SHA1 ff9d0a9accc0ce9bb09d6508d9748ece0afac123
- SHA512 4f092b8644b5db2c8f104f5ddf736336a55eb0287169686fbbd3adf50ccace49bf5c96303492146e028f4f3f8bcc843d735fb9bd7da323c9727b62763f683413
- TLSH T16F11D6958029D7C2B26338982B5F4E086244E95675CA6E2BF08C73AF9843E71F07C5B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 1KB
- SHA256 9e23d6193601f2f0fef4911c0a2f64b72bf5b2c12c0fca6b58987f3f6a67a3ee
- MD5 7795859a042d95f356713e9033976b48
- SHA1 bfd6fce0161e4b8ee3e6fe028eda55ea4fcf1513
- SHA512 8b70ea249d2ff6618adebfc1028661d1c07db09a0e226246e376002a17ca15311124a8cff0ffd24e24c29dd0c06490869bfc1996c9efc99dce1270598114e138
- TLSH T10511D896802993C2B36338982B5F4E086244E95675CA6E2BF08C73AF9847E71F07C5B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 1KB
- SHA256 b768946cef815ae0c70677da0eb9ebeadf344f6b4fcb90e073053ca54e67e6b8
- MD5 be934ad1339ad159fc005e04d508ead4
- SHA1 57cc11d6ae102919a01acd1ec497c50da521c072
- SHA512 d227441989b2dff5cfae2261ab6512f46fe994606b7ea836da83b73833dd382504fe2b6a61bf7a374bc169a048884bc05cd7f72d69a2b999c2fa45bbbf4e8d2b
- TLSH T14C21C896C0299392F36338582B5F4E087244E95675CA6E2BF08C63AF9847F71F07C5E1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 1KB
- SHA256 e69644719f93eeff508dda2a87a78afa8662e11454701181f8a23952dfc9b9b2
- MD5 3782c0d321863bba4f8ccef60c34ddf9
- SHA1 2a4870dbf2bd4d06394582b8b4cea130d3ff98a2
- SHA512 1125a687592a2f33c9271b29fbf74e55ed1f425116d9b23abef2d8bfb909ba26a22dc89020cdb3c222eebca44d1d2f2a51ad502caf565d0811466fddbafb6653
- TLSH T14021BA9680299382F36338582B5F4E487644E99675CA6E27F08C63AF9847F71F07C5A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 1KB
- SHA256 35721d9f1477cec135877e62d3dc8de4cd649cb56774906ffd79ed67d6e5204b
- MD5 5c0c24c078ceee977951d48321d0a798
- SHA1 040b5c0c395e0bbe8c3d89600d70ecc6b2288e7a
- SHA512 d0471aca36e6d734e20488694213cb8946f3112e2fa6b35f944c01ef4ac22f0654ba5c84a05bd85f084bdde688c55c7ec173fff464d15e8d9e12ff697d09238a
- TLSH T10A21D99680399382E36338582B5F4F487244E99675CAAE27F08C23AF9847F70F17C5A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 1KB
- SHA256 04e93ec17dd345ee41bd57bb18e361cfdbd0fca9ebd02c430a96e13261efaa97
- MD5 3471d3bfb52571fce231646825c455b2
- SHA1 5373c0c0526ade64e69c22a1c892d9888f4afbc7
- SHA512 58ff0cd53ecb3e6682f7d8adecab67f21d2a691d3276fef7bf3009b4c1c8a150a343ff91d273ad060a670347774c53ee93d7a62aad779ddaed810627ef19b30e
- TLSH T18231DB968039A382E36338481B5F4F487644E99675CAAE37F08C23AF9807F70F07C5A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 2KB
- SHA256 8df4416796e826d0cd5680c9e8cc370169e8a72af297049e1a37cf5f7b2265a7
- MD5 589451733cc8649cfdcf98727e343c65
- SHA1 1a1789420f4eec42f71f295469388c5611ea71a3
- SHA512 2fd0ff708927cc32e7d7fd90de41b3e9d0b89410fcc78af13c1d7e163f027d472a546e2e5f9e8d2e4714407273ff53676214ec80d9910b75a7f5d62095e43bba
- TLSH T1C651C3E2A039D3C1B35378483B4F5E057280E85A79C97D76B48C76AB8897F31B06C5B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 1KB
- SHA256 02ade7604cedf7d17b31ae0d91a220951119072de324a2b1c705a8a1a03ac91d
- MD5 64fa650e18c47d8df30fd350a7883c70
- SHA1 980bf08637008d61b42927d71cee7643c1ea8efa
- SHA512 7d5a3d92680ba586e2aa571542e02294cb9a148f7bb1e6a621111a219447d20a89336735a96bbd5507b0df01c1fdc9e0cc1faa323b12d5daa05901dbf0130a37
- TLSH T11231B89690399382E36338482B5F4F487244E99675CA6E77F08C23AF9847F71F17C5A2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 2KB
- SHA256 01f5ae7a16356bf809f4ae38d0830731d8846075676aa78e2e0dedf95afc4d34
- MD5 a798c0ef977bdf0a28141f5de6048d5b
- SHA1 7d512909f2ed189b0a35367d8a5e5a12fdba93d5
- SHA512 02f2bb7dc4a7667a18b979fbe8b8fbc45228e02479cefa1163fef01b5a8065f87fc4a86b4b983d92f3555efdac9ce1325c7ad76b8a5fbaa8755f73c5dc12ec46
- TLSH T15E41C6D2A0399382A35338482B5F5E047280E99675CD7D7BF08C66AB8857F71B06C5B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 2KB
- SHA256 b0af7571f91a6ed04516510d7b6bd21f98a6ad36d24c1f44cf3d256722ef538b
- MD5 5995e1b78d29c07bdbba0eb6d8b4ee71
- SHA1 7bb18ee8bd6f56da0491b6b69a29a4c8b56fc35a
- SHA512 9017d241d38cce7ce4912ba84139f972dc8ba40f65ec25c13edc9e3e0f15ce79171166655b673643dc4f0d783ee94987ae22aaaa0dc277ad8d97c64249e59462
- TLSH T15151C3E2A039D3C1B35378483B4F5E057280E89A79C97D76B48C76AB8893F31B06C5B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 2KB
- SHA256 a6da58b92441a9fea502b9adc0880ccf585798302d8584052b02fe15e032ac7c
- MD5 3fcd6ce3fd23b4f78a44d622c7231448
- SHA1 a1bb749a5749e22e1f80c2640f4c6478c0e44ba8
- SHA512 a021bcfa5d419743083d45cce11f6a1c85b76f72a5be90182ed786605ac67c47d90d99ffdfd42fc893ae177efda7441d251a072d52c739a66b1b825560b69fb4
- TLSH T18851B3E2A429D7C1B35378493B4F5E053280E85A79CD7D76B48CB6AB8893F31B06C5B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 3KB
- SHA256 b0d4a1fc7cea5fa541004a8fbb79a1d4215a2737b933a11e0431f2c2658e02af
- MD5 ac46fed6a8e684fc1f99c416e20ca739
- SHA1 b1ff3f7aa23028cfcf8cfa1bc8067d9fb3f646f1
- SHA512 95147b47b5c874af15f7ab45829c5d3ac77999b92df93953ece54d6169be9b2b1b35b784a7317e4a0e310115b8b42d885535fdff443f17d44b4a7d53e819b0a5
- TLSH T12871B2E2B429C6C1731778493B4F5D053180E85A79DD3D76B488B6AB88A3F31B06D9B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 4KB
- SHA256 eb8eea55ba3a2cb770798a10580456fba60ec19ae2bfa51a77d05fac61e8fe2e
- MD5 fd1fee7ec4e3c91b264c740cc6674035
- SHA1 30f81e8f34ad1432259d1f972b9069aea07a31f3
- SHA512 7b69bd69a106e4962a137d3b581c7467c9dd839b4e57879d0fc6ab9123a462aa84c7cb37b7efd5ff26a6d2a6c4ff08b48567677baf920a7536d22dabe33288e6
- SSDEEP 48:xKylytX9HhVKycyqEyiyOyZgpkBe98IByQ2ryRyOAyoKOyo6yofyopyogyOfyeyo:xwX9HLoLgpkBe98IuHZE7pWbBM3N+
- TLSH T12CA181E2B439C6C1731778453B4F5D063180E85A79D83C76B588B7AB88A3F32B06D9B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 5KB
- SHA256 0fcf0034bb215a456271ab1237e4c0755bad88093efe9d584fd060489d709f8e
- MD5 bd79787cefd7d4a50de93256709c35ec
- SHA1 2041fd9e7309b33026c62323538fc407bf781331
- SHA512 ddce730b85b94741edf028c6fdb1158a50e1c4abec93313ea11f887fde6e9608d525cded340ea21e55abe7da28cabe6a96a6cb67cb1f8d92712bcce13fa317b2
- SSDEEP 96:xwX9HLPLgpkBe98IuHZE7pWbBM3N0aB65p/uALsu18iz8iTniA:+ewZE7pWbBM90bF
- TLSH T1B0C12BF27439C681731778453B4F9D023280D96AB5D93CB6B488B7AB48A3E72B06D572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\uninstal.log
- Size 5KB
- SHA256 156f1004c2b2a5f65bca863c8abf6ef7f1124a8d5d6dcd4d5d899da01645da4e
- MD5 f5c693fb0bcecd070979d0f8e8281860
- SHA1 4ff231f7c443999d26dc07203498b167842d8d66
- SHA512 8368fce9f20497c34c98dce4e2f6c5784c076910f7bd8ba4396fa9a4f74441d9ca9a93a0c646f91508ab3743f46a1f1f5d65cfa47ed15822789169f94e1fcdd4
- SSDEEP 96:xwX9HLwLgpkBe98IuHZE7pWbBM3N0apm65p/uALsu18iA:ZewZE7pWbBM90gs
- TLSH T138C1FCE2B439C6C1731778453B4F9D063280D86A75DD3C76B488B76B88A3E72B06D572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~vis0000\vise32ex.dll
- Size 528KB
- SHA256 ee0d08a2b5888b1e127f11fee8bf91d274e4126d571c62654b97270a11be7c0f
- MD5 54925d8aea245a7be34ec34402b2865b
- SHA1 b16784c092f1198c8ebf76d734faa057a402613b
- SHA512 616170f44457cfc35e3428de427f6fe3e8f3c97400db0f0c0fc70dad23571a5abb8cf988ef46c31bdfcc2f4e62dbda435b5d2f3646a4f934a344fa4127b8b5c6
- SSDEEP 12288:v1w1iAwnJrU5U1+bboir4FJcwvoBPT8ycr+RX:vagKYOpJghD0
- TLSH T192B48E63AB4190B5D19C7AF421EE77366A37DF0A42398AC39374DC753D71250EE2A20E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\packet.dll
- Size 56KB
- SHA256 c8d0c5f70d32814cf9fe5073d81abb77de64f6acdae250a2f679f209e2ba159d
- MD5 5681072e4ad28079124f518c2d3957c4
- SHA1 fd3469155099115c13afc92f9d80269c85d866ac
- SHA512 967d8a7d1256af9df8f94ae83d243c9bd974f25d82665c9db2e4f8260f579a70ad90be7b413e140456973fc65a04eae72bfa0c18a72283f1f213b35837948b5b
- SSDEEP 768:iZCgXnrCFj2u0u6z4w4MMal2kLuYcFksi+o2RE8lWnL9Zn:JgXrCFiu0T4MMal2kLRcCsN3lWnL/n
- TLSH T15D436B12739140B7D4A6157D66BA6B562B3F780907F481CB1FB6568EAA333D0E73A303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\pthreadVC.dll
- Size 52KB
- SHA256 da89f3e544684ab492b245d2d0f6767a72f23ecfb60921b08f6b4a4fb9ba4e01
- MD5 feb5cfc84661e525ff0270c00df3e587
- SHA1 123426de02fdc43773d95bb8499af15b20fe38d1
- SHA512 9b6ebb714e9cb76a874a0987c2a44f985ac7677f3f00e6c862caf4f1379299512b4e3245a4f853778fbc1a93371993f74b873b262376ad99ed2c0f7ff33b2626
- SSDEEP 384:EtzPRJgCZFrpSI5/g2uA3f+uRTz5nOe7TCxfPNEziHg2JQ9dYzxC:EtDtpyiv+SgeGVGiHgYtxC
- TLSH T15033A4466928C2FBC5B728F526AA23FB0D335604131965CFF3A7D460096ADE4E339787
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\wpcap.dll
- Size 204KB
- SHA256 2e42877ab12ed2ae1f454795ca21e9bf0ae5b54ca7320fc897294e37b4cbfe68
- MD5 b4f0a3e818639ece56429238073307c2
- SHA1 c7f542d028a5f67514e8f7d722e4b6c981da6d13
- SHA512 9203d020024cca9ce2e21e6bd759d9adcb3b9d9b0a730d3e711e99df2a74f77ff7d8fd1c4eeea0e5c16c289d63c0e45413186531e0d3582fd5dbceb41a9b9cf7
- SSDEEP 3072:d+vZbiw3hPH1pRmjOY92ymzaRbx/g6B7eL/6dydBbQQaRd:MZGw9rRlfyamg6Vez5
- TLSH T192148D533F53C2BDF762417A05627B364E3A66163763868BABD0DC641C331E29A2F187
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\sbconfig.dat
- Size 2B
- SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
- MD5 81051bcc2cf1bedf378224b0a93e2877
- SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
- SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
- MD5 SHA1 SHA512
- Path C:\Windows\sbhks.dll
- Size 76KB
- SHA256 a88e0b8f872acf1598d6ea3835d703c26435ec8456c940217bfa2feadf19e7ad
- MD5 4ac38328e851950ba418703e80eeaecd
- SHA1 2ea99f1e0cc151dd9e0d44adc5eb826da3ae7b3b
- SHA512 605742174b97e6f4431ff042205d680c2cc645092a5280bc3da6e1dd69af634afc662dfb5516011796042fa868a68dbb09e2f609cd2b7310988cb6c881d607d2
- SSDEEP 1536:PhZmrQ+BRxdopr5A0ha4Yzdwm/O4ZXe1uzsOewJtfLBnvI6MluMLL1:P3Kx1WGwN47FMluMLp
- TLSH T161739D2275D1C0F2C44E987D289D571AA73A74208FF04EC7AF9A17ADBF322D14A36346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\sysicept.dll
- Size 300KB
- SHA256 0c67b4fd83c2fc9f6db8a04bcdba8ee2784ba485b0c848db1045dd950a5714d2
- MD5 8b8f782a610d67a57ea86ea44296b3b8
- SHA1 7ff9c3a6c45948cece5d6d82ae6e4ef3b1866edb
- SHA512 c3e20e979b8fe1dac73c2897cae158ef1b248ccc4e8f2e6e0d32867a5e389ddc5ce8f0fc8867b23c257a813840f1119ca5ea3dbc384ab4506237f26ffdbd4e70
- SSDEEP 6144:DALAs5m27/CxD0t3eLQ8MVtgGy8oFtin:Eks5f7/CxD08QVtgGyNEn
- TLSH T144648D01F5429138F9EF15BA9DFE1A1D52ACB7411754A4C3E3CC1C9E8B6B9E2393224B
- MD5 SHA1 SHA512 SSDEEP TLSH