ammyyadmin | 0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e

Analysis

max time kernel
151s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/11/2022, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
Size

854KB
MD5

3238426bf8f438b4abcd3db787ac0258
SHA1

f3cfe3bbbcaae85059cea6645dc6016425025f8f
SHA256

0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e
SHA512

d8b8674962e4f53c59ba408a8ac271b4cec4777d425eee6f8bc21a3aae2e52dc6ed00abf475722442b029c55cccbfafdf1ee4bc21969648398625fbd780e98bf
SSDEEP

12288:CQCs07y2blQDJy++/l21RtSckhwLhZ+Ehgu52yDOve/7Or5:4s07dlQDJyq1RtlkiLhZ+xugyDKP5

Score

10^/10

ammyyadmin flawedammyy evasion persistence rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 6 IoCs

resource	yara_rule
behavioral1/memory/1980-56-0x0000000000400000-0x00000000004B5000-memory.dmp	family_ammyyadmin
behavioral1/memory/1308-78-0x0000000000400000-0x00000000004B5000-memory.dmp	family_ammyyadmin
behavioral1/memory/1980-90-0x0000000000400000-0x00000000004B5000-memory.dmp	family_ammyyadmin
behavioral1/memory/2044-96-0x0000000000400000-0x00000000004B5000-memory.dmp	family_ammyyadmin
behavioral1/memory/1980-99-0x0000000000400000-0x00000000004B5000-memory.dmp	family_ammyyadmin
behavioral1/memory/2044-117-0x0000000000400000-0x00000000004B5000-memory.dmp	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tazebama.dl_

Executes dropped EXE 3 IoCs

pid	Process
1960	tazebama.dl_
1128	tazebama.dl_
468	tazebama.dl_

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe

Loads dropped DLL 9 IoCs

pid	Process
1980	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
1980	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
1980	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
2044	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
2044	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
2044	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\run	tazebama.dl_
Key created	\REGISTRY\MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\run	tazebama.dl_
Key created	\REGISTRY\MACHINE\software\Wow6432Node\Microsoft\Windows\CurrentVersion\run	tazebama.dl_

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\F:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\F:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_

Drops autorun.inf file 1 TTPs 6 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Documents and Settings\SYSTEM\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\SYSTEM\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	tazebama.dl_

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\ET.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\PL.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\SA.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\SK.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.CONFIG	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\README.HTML	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\AR.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\CA.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\DB\README-JDK.HTML	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\INCLUDE\JAWT.H	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\STATIONERY\SHADES OF BLUE.HTM	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\INCLUDE\CLASSFILE_CONSTANTS.H	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\APPROVEGRANT.HTM	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\MR.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\FA.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\LIJ.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\UK.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\STATIONERY\PEACOCK.HTM	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\BN.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\CY.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\PT.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\INCLUDE\JVMTICMLR.H	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\APPROVEGRANT.HTM	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\MS.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\README.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\FY.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\LV.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\THIRDPARTYLICENSEREADME.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\HISTORY.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\HY.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\KAB.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\KY.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\ZH-CN.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\ASSERTTEST.CAB	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\BR.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\SV.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\STATIONERY\STARS.HTM	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\89.0.4389.114\DEFAULT_APPS\DRIVE.CRX	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\HI.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\SI.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\SQ.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\RECEIVELIMIT.CAB	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\KU.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\NN.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\PA-IN.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\EXT.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\KAA.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\ENTERUNBLOCK.CAB	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\TR.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\NE.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\TH.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\GA.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\GU.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\KO.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\NL.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\UG.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\INCLUDE\WIN32\JAWT_MD.H	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\ES.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\FI.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\JRE\BIN\JFXMEDIA.DLL	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\STATIONERY\GREEN BUBBLES.HTM	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\JAVA\JDK1.7.0_80\INCLUDE\WIN32\BRIDGE\ACCESSBRIDGECALLS.H	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\GL.TXT	tazebama.dl_
File opened for modification	C:\PROGRAM FILES\7-ZIP\LANG\HU.TXT	tazebama.dl_

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Shared\OfficeUILanguage = "1033"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 07fb35d46e53cda462ec5c009f08d0e95f56c6874ffe2d19750bb671d546923ea5d65fdd8262a1be5c97636221d9e2a5b46e5788b152e4ac10e9564532b561bf51d0df3f	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	tazebama.dl_
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UISnapshot = 31003000330033000000	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WordMailChangeInstallLanguage = "No"	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\ProjectChangeInstallLanguage = "No"	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\InfoPathChangeInstallLanguage = "No"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\software\Microsoft\Exchange	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\AccessChangeInstallLanguage = "No"	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PublisherChangeInstallLanguage = "No"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\XLChangeInstallLanguage = "No"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources	tazebama.dl_
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UILanguage = "1033"	tazebama.dl_
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\InstallLanguage = "1033"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\software\Microsoft\Exchange	tazebama.dl_
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\HelpFallback = 30003b0031003000330033000000	tazebama.dl_
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\HelpFallback = 30003b0031003000330033000000	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages\1033 = "On"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0	tazebama.dl_
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PreviousInstallLanguage = "1033"	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WebDesignerChangeInstallLanguage = "No"	tazebama.dl_
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\HelpLanguage = "1033"	tazebama.dl_
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UISnapshot = 31003000330033000000	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PPTChangeInstallLanguage = "No"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\Software	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\OutlookChangeInstallLanguage = "No"	tazebama.dl_
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UIFallback = 30003b0031003000330033000000	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office	tazebama.dl_
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WinXPLanguagePatch = "1"	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\LangTuneUp = "OfficeCompleted"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages\1033 = "On"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem	tazebama.dl_
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c105953c705c32341a3b06b	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common	tazebama.dl_
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UIFallback = 30003b0031003000330033000000	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\OneNoteChangeInstallLanguage = "No"	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WordChangeInstallLanguage = "No"	tazebama.dl_
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\SharePointDesignerChangeInstallLanguage = "No"	tazebama.dl_
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	tazebama.dl_
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tazebama.dl_

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1960	tazebama.dl_
1128	tazebama.dl_
468	tazebama.dl_

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2044	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1960	1980	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	28
PID 1980 wrote to memory of 1960	1980	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	28
PID 1980 wrote to memory of 1960	1980	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	28
PID 1980 wrote to memory of 1960	1980	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	28
PID 1308 wrote to memory of 1128	1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	30
PID 1308 wrote to memory of 1128	1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	30
PID 1308 wrote to memory of 1128	1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	30
PID 1308 wrote to memory of 1128	1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	30
PID 1308 wrote to memory of 2044	1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	31
PID 1308 wrote to memory of 2044	1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	31
PID 1308 wrote to memory of 2044	1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	31
PID 1308 wrote to memory of 2044	1308	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	31
PID 2044 wrote to memory of 468	2044	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	32
PID 2044 wrote to memory of 468	2044	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	32
PID 2044 wrote to memory of 468	2044	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	32
PID 2044 wrote to memory of 468	2044	0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe	32

C:\Users\Admin\AppData\Local\Temp\0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
"C:\Users\Admin\AppData\Local\Temp\0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops autorun.inf file
  - Suspicious behavior: EnumeratesProcesses
  PID:1960

C:\Users\Admin\AppData\Local\Temp\0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
"C:\Users\Admin\AppData\Local\Temp\0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe" -service -lunch
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe
  "C:\Users\Admin\AppData\Local\Temp\0b7751b440662fe01cb16aaa74d3d83a149fe2b9a375111f6821e90522b6a55e.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Documents and Settings\tazebama.dl_
    "C:\Documents and Settings\tazebama.dl_"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.taz

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\1.taz

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\Documents and Settings\SYSTEM\Application Data\tazebama\zPharaoh.dat

Filesize
1KB

MD5
33012f061eef220cae164413a3cac1c5

SHA1
a081be86b306c0a010e2f14acce7f6f6cfc194f0

SHA256
f9b6d13f6b7cc2aa4fb8369a691e9b537443c33c3e76b0e025ff5d6fde1eb22b

SHA512
d89d3b189ed46073b644348f8752b36aff3ccb0da11850d08988f477aeec0c1dc7985cf138df092df0885e9d1a6e7575d8d068190aa8573a8b1b89cfb5c64ace

Download Submit
C:\Documents and Settings\hook.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
C:\Documents and Settings\hook.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
C:\Documents and Settings\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
C:\Documents and Settings\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
C:\Documents and Settings\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
C:\PROGRAM FILES\7-ZIP\7-ZIP.CHM

Filesize
105KB

MD5
8b7858eb91aa83f25cca609984ab8843

SHA1
808b5f068d61f694102def898d87368a73b4ef01

SHA256
a9cdc3f846e513e1742748ffc4138b294045f7ca95217c685f4c40a68e661c9e

SHA512
b4e3e3c538aa40328933382b42bf883b1b2e53f1f802be56b367ba69ff6895ad5f25e22fe98fba74a8d9d0e8af38f30d5b6adc4a504d3ee4992da0b3e1e23456

Download Submit
C:\PROGRAM FILES\7-ZIP\HISTORY.TXT

Filesize
47KB

MD5
4ec674831bf8df75efa93cde22b2dd20

SHA1
ca0d8485ac1e84973153065f2f24bb3869544b40

SHA256
673584991efae7ddd7d2342be8f329fb65462c3ca3bf59e296847749d80afd59

SHA512
d4304a3e3b7445051e0124d675b1afaca27f6e6a4e4f1d65beea7f240457b69402ab21a71dcb083254fea1f19ce29d2aac962ad115aa8c0ac6a6b70b8153679a

Download Submit
C:\PROGRAM FILES\APPROVEGRANT.HTM

Filesize
829KB

MD5
dfa4d6b1eef9e3719fbfdb8b33cd4400

SHA1
0a9094288415940ab9fdb52363fdd3ad79b58d82

SHA256
1448884c7b643353337db6ea35448c7ad2cc5fc535946617d5b4be81a1387a85

SHA512
bf3ce626a79acdd57b0eedaedaa0657dd2d503446e41533c719ceaebd1836444c07e27ddc5eb97506a1ecc368d59e6b7735e2e035ffab04a66b1b8b151dbe0e4

Download Submit
C:\PROGRAM FILES\ASSERTTEST.CAB

Filesize
296KB

MD5
c9f31d44a6dd2e0506978e8418d469f1

SHA1
d089cef95363c37b88e3842eaa104b8f534b381a

SHA256
f94add1065e424b934ed4fb6e2cd2de7e0db8ccfb5e4a4ae3a1ef294b1f631c8

SHA512
8bf20d5706302942ae2c5b5a2c2c1f4b3bf44cec8f15114e2bf3bff895ecaec4e5e5c9d9bb202289d308b33eb77c12925cd89e78e4c6b55b32a5131c13d062dc

Download Submit
C:\PROGRAM FILES\ENTERUNBLOCK.CAB

Filesize
436KB

MD5
123340b8a1b49ef50c77eae844b4e397

SHA1
ac8185ed26f8c83475d51fe24fdbbcf1a17c64e3

SHA256
a36374793f4d4b48ab9c75b5bd999aa4698cd18701000101c255f53d72c0385f

SHA512
965774932920d4596af9c168b48662c59944559a525dcb6b711494acde80c98757d965d219c09ba2448d817284100304650cea1cec5449854076d8a33607ddc6

Download Submit
C:\PROGRAM FILES\RECEIVELIMIT.CAB

Filesize
263KB

MD5
8eac7e8deebed595e6fce0df4cb8b328

SHA1
f6751bae9683c127028a4307f46e8aa51dc88a32

SHA256
66d9782ebad6f35f85c9cf3d8ca25ac12428af0ed0fa4bf3c0f17086cfc7b3b6

SHA512
c9db7a4fea7d9547b56b363acfc76087f5c10b4e3f9da738c51043ad558e2ca60b0d0302be722b82f88de0c21572308c6a6e678f3a410858e4221b9d1b13ba17

Download Submit
C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
f171fdcf1d1d6d23bef3176c213dad87

SHA1
cedd611f677abc960ec370ff19c3011ef238c404

SHA256
2f83e5ac0175ba9de3395bfadccb4f66098c0b58ed3ae1dc493771bf8144224e

SHA512
5f8c3730596cb9725e162bc706aee895f5ff2e42b0c1af4534f2b6d8bd52f7ea6a8889f602d1783b80a17d7ee6835cc6c7c89fe5aeec63a078298e94f0750d67

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
e623c6e356383183f981000a14a619dd

SHA1
efdbfaed86f92a5b26eaf9118315aa7bbe7fac65

SHA256
4861302ebd54f07023256ff1b15f9b65b490764c1ac58ff3ec5ad45488ae7c6f

SHA512
dfc30e8bedf3729c79ae29129fb11dd0f9fac16b122a5950332f8581b6ddc34b79cde4f54e9b6909c991b2bdae256ebc74b84edd38f3d207071392cb2a295bd5

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit
C:\Users\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
C:\Users\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
C:\Users\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
C:\VCREDIST2010_X64.LOG-MSI_VC_RED.MSI.TXT

Filesize
362KB

MD5
e2bfd8efc005852fba0a162a947063c5

SHA1
cd499e0ce2ae3bb66651565809657f7f630a6ed8

SHA256
8d8c476ee06e08c49d8cef40155b1440a8b0c8b7991016f40296e540342e28ae

SHA512
47029ef53b0b01ff99391277a6a6564b2a2874390af20a4c7bfe419a14781bb9d38fb69aed2ad9e66931b57500526d1e96488b5fd7fa71f277cc63f58f940d98

Download Submit
C:\VCREDIST2010_X64.LOG.HTML

Filesize
85KB

MD5
1e6a10ddd214f01c27cc661504a93a11

SHA1
45198e8027c8b0a5333bfab309207d1e0bf66313

SHA256
838f2abf65568e04305815a26f76af9c3a723d45d343fca624e7146b2306c62c

SHA512
e498359340c9fbb806f0f48c5f9c745da6e11f9996c1195db90463c483a0da483923e9a6873d129d2ae08df784ef6e5289b22d8aab4e730c4efa9445d08599c4

Download Submit
C:\VCREDIST2010_X86.LOG-MSI_VC_RED.MSI.TXT

Filesize
379KB

MD5
95566fc994cc65a105fc63ad42430551

SHA1
a6cddb9c75ea718d8318aee1f2ffacb39da297dc

SHA256
2aa1f73912b57327d909bcb529a9b469e2df3a424b3bfdd2309266f2e8fa93db

SHA512
e7630ac96617441eebe7ca1e7d97395ea9971c3f8ef0d428715225033dfe05c0e3b3ad407747bf68082dd60318b5410ef00bf665e0c6d8bf0361ced37338de95

Download Submit
C:\VCREDIST2010_X86.LOG.HTML

Filesize
81KB

MD5
bfd04420e0faa096974f8c8c33f46d56

SHA1
6c3b0f8bcb84e6370c7d5e4c43799ed442b3083b

SHA256
95fe8916dd9a12382d9724801d9818613b4c43dd0c2d70f0521577b86e6b01b6

SHA512
63b98f7b093a67e07274ffedba9cac94e03b0f81bfe00596b3c3c999bd7dbca22ea1e5dd043e5e3a4e673ab526159963ebaa8bbd0b64e53220438c22ca797ba5

Download Submit
C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
149KB

MD5
76bfdcbce485e4c44656bcc79b00df00

SHA1
554b6bae2a65600c8e2e405b9bf6a275198a8b1d

SHA256
e64e09c485b60b1697c73b6ff392c62af69fda16d4b2b870aa3df72a905426b6

SHA512
3f6eaf8bcc063653ee797664b1d7584d6908bb0b384fbfef854b8313a5acfbdec851e1dc0f1e7daacf5cf54b58dc446c8ced339d8b18943269f1d5542aea7b59

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
\Users\tazebama.dl_

Filesize
151KB

MD5
539bb6ee5703e1b1ed35b1ad5982eb4b

SHA1
f5d9c455811df9c118b7470bdb50b156405f8882

SHA256
d7bba91b1381dedb38750be5ef43f98d94665b7e1100d54aa695163479e469d7

SHA512
963c69493caad3c9b9eacc3c2894f864a68b7cd8e0660e2e7feb958c671dfff87a955b908c7f0add980e215db043161713c3882121b66d396b3eb0299fda67e4

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
memory/468-97-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/468-107-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1128-98-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1128-118-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1128-93-0x0000000072CB1000-0x0000000072CB3000-memory.dmp

Filesize
8KB

Download
memory/1308-78-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1960-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1980-92-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/1980-91-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/1980-90-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1980-56-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1980-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1980-99-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2044-94-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/2044-96-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2044-117-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download