ctblocker | 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe
Size

748KB
MD5

233f3620139e38ec5ae44f2ea73b2122
SHA1

4e582a1411167b7eb59633fe3102c4c1cd19b92f
SHA256

0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303
SHA512

76764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593
SSDEEP

12288:geWzt13drPsKlgTA0Ow/WnX5m9stu1EgpU55jgG4HdRUdWQiHL:gee4KCOznX5R4KgQ5RBC

Score

10^/10

ctblocker ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-kfkizxi.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://jssestaew3e7ao3q.onion.cab or http://jssestaew3e7ao3q.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://jssestaew3e7ao3q.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. 67CLYI7-WMSQVTZ-IXA2UUB-X4WOHZ2-7ZO4HWO-SKGMPDT-AFZOFJL-GEKR3EU 3HFVE35-GZY53SA-AZDUJDF-X3TBBB7-AYGJLXA-3ZYFB5A-ZDBOEJF-WSJCWVC 5UQUUVL-RG55OCL-ONDL5GU-ULUFNIR-6F35MAX-WNJUXVF-IZP5HSO-D7K73BF Follow the instructions on the server.

URLs

http://jssestaew3e7ao3q.onion.cab

http://jssestaew3e7ao3q.tor2web.org

http://jssestaew3e7ao3q.onion/

Extracted

Path

C:\Users\Admin\Documents\!Decrypt-All-Files-kfkizxi.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://jssestaew3e7ao3q.onion.cab or http://jssestaew3e7ao3q.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://jssestaew3e7ao3q.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. 67CLYI7-WMSQVTZ-IXA2UUB-X4WOHZ2-7ZO4HWO-SKGMPDT-AFZOFJL-GEKR3EU 3HFVE35-GZY53SA-AZDUJDF-X3TBBB7-AYGJLXA-3ZYFB5A-ZDBOEJF-WSJCWVC 5UQUUVL-RG55OCL-ONDL5GU-ULUFNIR-6F35YSX-OWJUXVF-IZP5HSO-D7KP4RN Follow the instructions on the server.

URLs

http://jssestaew3e7ao3q.onion.cab

http://jssestaew3e7ao3q.tor2web.org

http://jssestaew3e7ao3q.onion/

Extracted

Path

C:\ProgramData\zlwdkgg.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://jssestaew3e7ao3q.onion.cab or http://jssestaew3e7ao3q.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://jssestaew3e7ao3q.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://jssestaew3e7ao3q.onion.cab

http://jssestaew3e7ao3q.tor2web.org

http://jssestaew3e7ao3q.onion

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 4 IoCs

pid	Process
556	pdfisga.exe
1556	pdfisga.exe
860	pdfisga.exe
1996	pdfisga.exe

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\WatchCheckpoint.RAW.kfkizxi	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\FormatRemove.RAW.kfkizxi	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\OutPublish.CRW.kfkizxi	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\RevokeResolve.RAW.kfkizxi	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\MountClear.RAW.kfkizxi	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\SyncSave.CRW.kfkizxi	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	pdfisga.exe

Loads dropped DLL 3 IoCs

pid	Process
1104	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe
556	pdfisga.exe
860	pdfisga.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-kfkizxi.bmp"	Explorer.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 1832	1104	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe	27
PID 556 set thread context of 1556	556	pdfisga.exe	30
PID 860 set thread context of 1996	860	pdfisga.exe	35

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-kfkizxi.txt	svchost.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-kfkizxi.bmp	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 10 IoCs

installer

resource	yara_rule
behavioral1/files/0x000700000000b2d2-66.dat	nsis_installer_1
behavioral1/files/0x000700000000b2d2-66.dat	nsis_installer_2
behavioral1/files/0x000700000000b2d2-68.dat	nsis_installer_1
behavioral1/files/0x000700000000b2d2-68.dat	nsis_installer_2
behavioral1/files/0x000700000000b2d2-76.dat	nsis_installer_1
behavioral1/files/0x000700000000b2d2-76.dat	nsis_installer_2
behavioral1/files/0x000700000000b2d2-95.dat	nsis_installer_1
behavioral1/files/0x000700000000b2d2-95.dat	nsis_installer_2
behavioral1/files/0x000700000000b2d2-108.dat	nsis_installer_1
behavioral1/files/0x000700000000b2d2-108.dat	nsis_installer_2

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1464	vssadmin.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00640061006500300037006100650034002d0032006100330034002d0031003100650064002d0038003600630036002d003800300036006500360066003600650036003900360033007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{dae07ae4-2a34-11ed-86c6-806e6f6e6963}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{dae07ae4-2a34-11ed-86c6-806e6f6e6963}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{dae07ae4-2a34-11ed-86c6-806e6f6e6963}\MaxCapacity = "15140"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1832	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe
1556	pdfisga.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	pdfisga.exe
Token: SeDebugPrivilege	1556	pdfisga.exe
Token: SeShutdownPrivilege	1360	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	pdfisga.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1996	pdfisga.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1996	pdfisga.exe
1996	pdfisga.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1832	1104	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe	27
PID 1104 wrote to memory of 1832	1104	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe	27
PID 1104 wrote to memory of 1832	1104	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe	27
PID 1104 wrote to memory of 1832	1104	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe	27
PID 1104 wrote to memory of 1832	1104	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe	27
PID 1104 wrote to memory of 1832	1104	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe	27
PID 1104 wrote to memory of 1832	1104	0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe	27
PID 1008 wrote to memory of 556	1008	taskeng.exe	29
PID 1008 wrote to memory of 556	1008	taskeng.exe	29
PID 1008 wrote to memory of 556	1008	taskeng.exe	29
PID 1008 wrote to memory of 556	1008	taskeng.exe	29
PID 556 wrote to memory of 1556	556	pdfisga.exe	30
PID 556 wrote to memory of 1556	556	pdfisga.exe	30
PID 556 wrote to memory of 1556	556	pdfisga.exe	30
PID 556 wrote to memory of 1556	556	pdfisga.exe	30
PID 556 wrote to memory of 1556	556	pdfisga.exe	30
PID 556 wrote to memory of 1556	556	pdfisga.exe	30
PID 556 wrote to memory of 1556	556	pdfisga.exe	30
PID 1556 wrote to memory of 576	1556	pdfisga.exe	25
PID 576 wrote to memory of 1452	576	svchost.exe	31
PID 576 wrote to memory of 1452	576	svchost.exe	31
PID 576 wrote to memory of 1452	576	svchost.exe	31
PID 1556 wrote to memory of 1360	1556	pdfisga.exe	22
PID 1556 wrote to memory of 1464	1556	pdfisga.exe	32
PID 1556 wrote to memory of 1464	1556	pdfisga.exe	32
PID 1556 wrote to memory of 1464	1556	pdfisga.exe	32
PID 1556 wrote to memory of 1464	1556	pdfisga.exe	32
PID 1556 wrote to memory of 860	1556	pdfisga.exe	34
PID 1556 wrote to memory of 860	1556	pdfisga.exe	34
PID 1556 wrote to memory of 860	1556	pdfisga.exe	34
PID 1556 wrote to memory of 860	1556	pdfisga.exe	34
PID 860 wrote to memory of 1996	860	pdfisga.exe	35
PID 860 wrote to memory of 1996	860	pdfisga.exe	35
PID 860 wrote to memory of 1996	860	pdfisga.exe	35
PID 860 wrote to memory of 1996	860	pdfisga.exe	35
PID 860 wrote to memory of 1996	860	pdfisga.exe	35
PID 860 wrote to memory of 1996	860	pdfisga.exe	35
PID 860 wrote to memory of 1996	860	pdfisga.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
PID:1360
- C:\Users\Admin\AppData\Local\Temp\0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe
  "C:\Users\Admin\AppData\Local\Temp\0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe
    "C:\Users\Admin\AppData\Local\Temp\0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:1452

C:\Windows\system32\taskeng.exe
taskeng.exe {B02C6DA4-C3EC-4F54-B3CA-BC335CC07B71} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
  C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
    "C:\Users\Admin\AppData\Local\Temp\pdfisga.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows all
      4⤵
      Interacts with shadow copies
      PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
      "C:\Users\Admin\AppData\Local\Temp\pdfisga.exe" -u
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pdfisga.exe"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\xptppml

Filesize
654B

MD5
f2b839d2e7c7e6c28552ba143781e31e

SHA1
1f22373d1e3f685b61f742b80ec443a1a5bcb4f2

SHA256
2190bbf792d19c26120015209846bb55ec8981c914e27589d0ee09d72dde245c

SHA512
50d907892832c90a5018245055a2a85fc8a0314d9797ab9293f56fdf90ea9cc867610dfc161d8223628bbac42c5178735077a1438a1e6235e3e9b1117b6e52a8

Download Submit
C:\ProgramData\Mozilla\xptppml

Filesize
654B

MD5
f2b839d2e7c7e6c28552ba143781e31e

SHA1
1f22373d1e3f685b61f742b80ec443a1a5bcb4f2

SHA256
2190bbf792d19c26120015209846bb55ec8981c914e27589d0ee09d72dde245c

SHA512
50d907892832c90a5018245055a2a85fc8a0314d9797ab9293f56fdf90ea9cc867610dfc161d8223628bbac42c5178735077a1438a1e6235e3e9b1117b6e52a8

Download Submit
C:\ProgramData\Mozilla\xptppml

Filesize
654B

MD5
6700f3faa0a777b35ffb526ad2a08df3

SHA1
bd8758cb0cc7e42b649144fe226b3351d985a66b

SHA256
43ab79c8a4590e616ba7d0b91e7a337570ba4274888b3c4b67f5da3554542fec

SHA512
032ebe42e2a8fa21d2ce6f610d3190cfc8e53bdd2f81adad633335cec01d9f57989e307b68bbbd62446a878118515ef39b03799252f76ecd59af30fa09cf4f9e

Download Submit
C:\ProgramData\Mozilla\xptppml

Filesize
654B

MD5
12fa497b5b1f28ceff0b7a3cf1c050df

SHA1
f2e4cd30e598081a17cc85c6f8ad09c9f9549395

SHA256
53726e071dbacaedf15f2051b4a6c5594f83bd0746196e6c815d0fad59181e73

SHA512
3c659091d2afd8865c5b36e3df3dda0898cc104ec31ecc96a1bd25323edf3410b3dd95911b5e9ceb87085b53b386ef474aa4591540a25b4465014cedc455452b

Download Submit
C:\ProgramData\zlwdkgg.html

Filesize
62KB

MD5
4204c9919b69185cf7ce00770d910213

SHA1
b54093ed8a6758c3ab482504b41c01b6516b6e23

SHA256
c04e3130bab0d880055f8b13accc0ab6e0a0a1e76bc39012ae1669fbb7033a45

SHA512
2c0cddbc8107e1010668ddbea249e125cdf0302f8314869abc52cf5fc8a4370a855928163987baf5c5aa6e94d843baae243051aae3ac7745c569d84a4ae95d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
748KB

MD5
233f3620139e38ec5ae44f2ea73b2122

SHA1
4e582a1411167b7eb59633fe3102c4c1cd19b92f

SHA256
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303

SHA512
76764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
748KB

MD5
233f3620139e38ec5ae44f2ea73b2122

SHA1
4e582a1411167b7eb59633fe3102c4c1cd19b92f

SHA256
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303

SHA512
76764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
748KB

MD5
233f3620139e38ec5ae44f2ea73b2122

SHA1
4e582a1411167b7eb59633fe3102c4c1cd19b92f

SHA256
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303

SHA512
76764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
748KB

MD5
233f3620139e38ec5ae44f2ea73b2122

SHA1
4e582a1411167b7eb59633fe3102c4c1cd19b92f

SHA256
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303

SHA512
76764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
748KB

MD5
233f3620139e38ec5ae44f2ea73b2122

SHA1
4e582a1411167b7eb59633fe3102c4c1cd19b92f

SHA256
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303

SHA512
76764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593

Download Submit
C:\Windows\TEMP\29761277_1375648868.jpg

Filesize
3KB

MD5
a367cc8aa7c0caba4e57a29f382bfc84

SHA1
b54c5310376d79c2fb490bde025dff492d6ff553

SHA256
05a72a235dd1e02e3a5b39a098fd0697749d223eef9e5b6e27ff5a71b10a9a4b

SHA512
11fa1c4c34e988f133325d5225228f4f83527a08e988ee18461b78832c1d712b266d6034a6f2952e429c3b090c200bed739affdd30548ef62e3def5cb306700c

Download Submit
C:\Windows\TEMP\photo.jpg

Filesize
1KB

MD5
62c0d8d5c5cab232e9f2d63ecd211715

SHA1
7c9685b13dd50fbc0c92d64a971a8a04af6d4071

SHA256
f52aba95aee622724eb78d6126a1da557d406f7803ca49d3b01a11c52823eb9f

SHA512
0c21ea341fffdf266e4b19c218d4310bdc651194e1ee8840242c6194c6f77765629f3086116546ac83cf6c986d52f1266989bc029ce56fb3c12d66b6a8087529

Download Submit
C:\Windows\TEMP\re.gif

Filesize
554B

MD5
4319f5f6924314e4503cc8f1893737ee

SHA1
900f44a53190da879aa0b9c70b55efe00c4668d4

SHA256
d4d05ac908a414c628501ccba75dcd86da86c4016cefa5afba1d1ebf3f968871

SHA512
fdc6cb5e01820d1064874e6385af8fcb21e95406718e0d9c540a6ae4044b888f21a8b2296be274187061b5241c1488a74fdf882044915e3fcf034dd8b5beecc8

Download Submit
C:\Windows\TEMP\wheniawasjkaj1kawjdkao1

Filesize
394B

MD5
b366c71b1134563874f37eff550881f7

SHA1
c9b13c424e9f1efb9933f7f20ed52f9376c0567c

SHA256
9e5764ffba00a814ded35480d0c4e74f847fb32e1c457f4d46e2a3f4b6f72af3

SHA512
bc2c702b664479ca4537c8dfcd221be3371a3a914fca36180b3e7190788e17dc3914f307dc8ba1a1a02e8df019bd7fe6f93ef3f2185ce942f6043537483fd1e2

Download Submit
\Users\Admin\AppData\Local\Temp\nso3334.tmp\kiosk.dll

Filesize
66KB

MD5
92ffa507f5b3d9ae074c20894b724629

SHA1
99af0b89d400cfc7bbea381471d01f2599eb55a3

SHA256
5aae1e7c174883e0ebd0220d8d5e897fc5fac10c4f86a1ad009640e24a6ae7c1

SHA512
22192058ec654db53ed026dcbf568489315478c765ab6fd8f74304ca46019f5ce2272fff4bfaaabf8d49fbb02b7511812da40ee8211b60da508a4a980fa3641b

Download Submit
\Windows\Temp\nse9698.tmp\kiosk.dll

Filesize
66KB

MD5
92ffa507f5b3d9ae074c20894b724629

SHA1
99af0b89d400cfc7bbea381471d01f2599eb55a3

SHA256
5aae1e7c174883e0ebd0220d8d5e897fc5fac10c4f86a1ad009640e24a6ae7c1

SHA512
22192058ec654db53ed026dcbf568489315478c765ab6fd8f74304ca46019f5ce2272fff4bfaaabf8d49fbb02b7511812da40ee8211b60da508a4a980fa3641b

Download Submit
\Windows\Temp\nsoE082.tmp\kiosk.dll

Filesize
66KB

MD5
92ffa507f5b3d9ae074c20894b724629

SHA1
99af0b89d400cfc7bbea381471d01f2599eb55a3

SHA256
5aae1e7c174883e0ebd0220d8d5e897fc5fac10c4f86a1ad009640e24a6ae7c1

SHA512
22192058ec654db53ed026dcbf568489315478c765ab6fd8f74304ca46019f5ce2272fff4bfaaabf8d49fbb02b7511812da40ee8211b60da508a4a980fa3641b

Download Submit
memory/576-81-0x0000000000520000-0x0000000000597000-memory.dmp

Filesize
476KB

Download
memory/576-83-0x0000000000520000-0x0000000000597000-memory.dmp

Filesize
476KB

Download
memory/576-87-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1556-80-0x0000000000990000-0x0000000000BDB000-memory.dmp

Filesize
2.3MB

Download
memory/1832-65-0x0000000000400000-0x00000000004A4600-memory.dmp

Filesize
657KB

Download
memory/1832-57-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1832-64-0x00000000006D0000-0x000000000091B000-memory.dmp

Filesize
2.3MB

Download
memory/1832-62-0x00000000004B0000-0x00000000006CA000-memory.dmp

Filesize
2.1MB

Download
memory/1832-56-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1832-59-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1996-112-0x0000000000890000-0x0000000000ADB000-memory.dmp

Filesize
2.3MB

Download