hxxps://github[.]com/BootModulex/PwnBox/blob/main/PwnBox[.]exe

Analysis

max time kernel
87s
max time network
141s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/BootModulex/PwnBox/blob/main/PwnBox.exe

Score

8^/10

agilenet

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

PwnBox.exe

pid process

964 PwnBox.exe
1196
Loads dropped DLL 1 IoCs

Processes:

iexplore.exe

pid process

1976 iexplore.exe

pid	process
964	PwnBox.exe
1196

pid	process
1976	iexplore.exe

Obfuscated with Agile.Net obfuscator 6 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BJWXLGAS\PwnBox[1].exe	agile_net
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe.x7ld9fw.partial	agile_net
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe	agile_net
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe	agile_net
behavioral1/memory/964-706-0x0000000001390000-0x0000000001412000-memory.dmp	agile_net
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 905d7589a646d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "383825861"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000a9aca7ac60881bef72cdfc7fbd7fd6494bbf8ec30f343c04f07261da8456497b000000000e80000000020000200000004946aaa112f8a02c9b254526f5a94cf15ac17db3716acc0bb1e9d40b778ca0af2000000027986ae0bb922a86e407975cac826dfdc5851845ce4479511350fb3b05ed540d40000000c012830cf41ad4d04d563ed19634fe3cc763e444fc9f9f46982661b062d112ba773a9a69b8662b70d273c3e6826c75662c18e6f10135a08d4415ddd7a3eeb737	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000220f15c71c87bb24bda41726dfd5ab5d307da01a3ea91965cd867387006422bc000000000e8000000002000020000000c5bf1803ecc8efa63c240fd246ac5026329e935f1543ec89fe08342814c5a2e590000000f8147da900b791769cc725312ff9f4eeef0780c923b8ae2cd686fbb972ab8a7811a36aec56e2c8481e04a22fe10e7ac62f499fc2b3b8c93c06e668b933894ab07444fdb7e8f1b5cce83dbf592836a17742e5ff60cf5e150e58f3835f0756789fdc8b2c93d3dfbb82f2f344f7c1587e82259ebaa1c16de307e2a842ceffa088c93cc08979bbb2dcdd1bdfbd3b6750581340000000c444a9c7a8e82ae76490f93dfb4f0688ccb0394e82fb7266faa66ad0dac75182c127664a5a195849ef25dbe58f3daf99bd8241205d46ecf74cbd013659e9a22b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB50AB81-B299-11ED-981D-FAEC88B9DA95} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08a6597a646d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PwnBox.exe

pid process

964 PwnBox.exe
964 PwnBox.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PwnBox.exe

description pid process

Token: SeDebugPrivilege 964 PwnBox.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1976 iexplore.exe
1976 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1976 iexplore.exe
1976 iexplore.exe
268 IEXPLORE.EXE
268 IEXPLORE.EXE
268 IEXPLORE.EXE
268 IEXPLORE.EXE

pid	process
964	PwnBox.exe
964	PwnBox.exe

description	pid	process
Token: SeDebugPrivilege	964	PwnBox.exe

pid	process
1976	iexplore.exe
1976	iexplore.exe

pid	process
1976	iexplore.exe
1976	iexplore.exe
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1976 wrote to memory of 268	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 268	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 268	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 268	1976	iexplore.exe	IEXPLORE.EXE
PID 1976 wrote to memory of 964	1976	iexplore.exe	PwnBox.exe
PID 1976 wrote to memory of 964	1976	iexplore.exe	PwnBox.exe
PID 1976 wrote to memory of 964	1976	iexplore.exe	PwnBox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/BootModulex/PwnBox/blob/main/PwnBox.exe
1⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:268

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
471B

MD5
893b3e36bbc573b988ad21eda1216ebe

SHA1
159d4b8ca7aa2db8c822a2908e6b1a9f1c3a198b

SHA256
113099404d4eb5526a1557a7118dc472c64b93024a905d84959226cdfa90667d

SHA512
08689569151abf4f2392664613328eabfe0c3cde11e821a0716708b8b4cd4b2964895b48edb249dc0c2b3701e8c6c95304b86f10bd4ead0b7438fce94e0da491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
34f10d96a48dcc2c76587d53f3863efe

SHA1
0f557a5b3548ca74fa22e057edc039b1f66a0569

SHA256
5fbcd680c4f40bd0a9c846128419bf520abb1ef55c25cbdb9fcefe518a3947b8

SHA512
6e93f6865e79d505132c266a229bd5fc95e84d5f7a04e3c68365b3137a9e9fb42157d8cb39e8556d9363fb6bad744b2f82491b8b3472e4c310045ab5ce96e1eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9d76ab339efc8678e6d993bc4e4be423

SHA1
e796736d682bd37731c8e8a486deef8d9ba5d5f5

SHA256
937835d2ce5093e8bc4319ab03233f8eada9005a89fac133784b6a650a0ab5b3

SHA512
326054023f9558e285742694c4d02d5c23cf5c55e53725d62b106720018a96c9fd016d663a81e0b1b170120ac73a6a7cfac91373b6c3aa91d227dc348c67b7ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0fbab940c836c2d19b303ee6714db039

SHA1
4b4f3f8c94d8dc4a96c443ecafcbaf5b5947e9b3

SHA256
a089db84d9c5e1d8be875a0b6ff2ba92c47184dff54d20f9c4ff4587ecae7a92

SHA512
0292f475a4159518b696a0eb9a074ef3571864295679995f169adc280422f81429ee3145df0ce6f5ea5b1d0cc7dc839c91935636271059547b5928567b3c6904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a3cbaeb7d9433ccdf1ab2818f0bfca50

SHA1
aa2a32c0427226690ab3e501132f6a990b69444b

SHA256
e3a8237723c6579f0b12ee5e99547e74fd3d1d9a195ab652be18ed3b992fa63e

SHA512
2bc284fd0278e1aeac90e5fdf6f9b980af375075edc7c5b567ce1cd88c36bd3f4413e25d12796761d89001debb9b475f2cdf6fba3ca82c3a8a27e4fb1cfd6e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
5b88dbc43422b6d7c0511ceec00b5f7d

SHA1
d9bca9b470e99041e5c47aabe33ef1fd149f961c

SHA256
e36deaaa0f1313d187594b6bc812212630366e19bb9ba8b9cb79f163d47a87f4

SHA512
f565195c0a21ae3b4b022a66f0b05896d36e6525b5276a2bf7d43d07b5e38c2fee6d4ad44ed567e32c963b80bdd0c605e0157148b98d9a7c88e2b6320db59f20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
ba29339e6292b374cff9a793a57dd6c0

SHA1
0abac3a85c986efb97f471d4c3354198469065f5

SHA256
bffead8510c32d88cdf88097420bcf31282d3a29881fa5520676c64f582c1799

SHA512
1eaef0e221465ad7abbdb168bd58a9353dfc9d2e1bd18f4f281edebf8fe53bcc264bca5410d8b21e75761874cb6ef2f56bad7160de459daccc16028fb139f851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
2867475d9d08cea1965a62926f658d45

SHA1
dd362aa08b3013aa275693c6577bc5838ba3670d

SHA256
d58c87bb5b0b8248f369002ce647fd9387b04aeaef94d1dbe68a3ea925eb3fbb

SHA512
65d0d51b7de636db5c574d99ebff6df28c32fae1b7cda77986e3252f268c17a2760c6adb30e14cb5a13da05fad598ef497d124d3e4b99b84a83bc0d46215eeef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8df75aa088eb33ec132c55f466f3e295

SHA1
0bccdb891e6c50e29860ccbb06b13452300dd42f

SHA256
121f673d100724096e2683e6de5307c2d9420a73205709e8899e9c0e7f38a6e2

SHA512
bab4ad71269be40b39197b8e007486ebf204f907c0df8a7c4fb461ec414b01e9454bf2764b53383513a399f4f391470af64aae856fd57ba8128891ec42463029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
710236f856cb21b7a5eabcb407fff945

SHA1
c20165c20c67f566464af8f3c327d2c576456faa

SHA256
efb5b649c3b7b4064edeb1450a53b8b95ea18d927974665acb4b618205b0958c

SHA512
b7595a40c76be16d47b9abc58c809d962d9ccfc54df207fc02f44f5f00f8ff1e4d329c98feb941ec6de5a149ff3ab6f9267a0d9673f2a4979bada0849b09da74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
430B

MD5
c281d594fe239a322c34afb5fdbc309a

SHA1
c963ca9eae6fe73086c7bf4db24beb7e26ed12da

SHA256
f744119561758829805460ca48141a2fcf6b8ceccf705feda63cd449c1a99998

SHA512
2fd950bc367e1a7c25c59577e914152554662454e11156fa16df3a0de7df35d7e0c0b4e95a94af86e9173688939b5a3bc54ad180a40c593a30ded66dfe40490f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\62yy7f8\imagestore.dat
Filesize
5KB

MD5
def28160e8950956c0045d51c98e96c5

SHA1
e6309a28f90e8613aec0b408f90df2242aeb3a60

SHA256
832f05c8528f9edba854f7d0ac121406bcc8d43d924dc7f14c3a0a0e8e3d5786

SHA512
34caea7a0f97650ea089e50576a326e073c0e762c394afc3dce19674176991c80942b18fa2fe37b83c632261b657241ca32f0c0ca87b88da5e27d0dced741735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BJWXLGAS\PwnBox[1].exe
Filesize
497KB

MD5
5df0c3d93724c65654890ef86dd5f7f7

SHA1
41273476acd20a6955131c779bba3207b1d53ca3

SHA256
3a70295ff7bdbae5ff42ab3bf25d2a405d166327b3e6c9d42f233669560c4359

SHA512
5438fe2ccad941056f8da9457bf620368e1b85b5d327ef5206ea114396bf181b6bd04157a11e8345d710a577e367fa91c8500f9d845d3dcc7b6c96984feb43a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BJWXLGAS\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe
Filesize
497KB

MD5
5df0c3d93724c65654890ef86dd5f7f7

SHA1
41273476acd20a6955131c779bba3207b1d53ca3

SHA256
3a70295ff7bdbae5ff42ab3bf25d2a405d166327b3e6c9d42f233669560c4359

SHA512
5438fe2ccad941056f8da9457bf620368e1b85b5d327ef5206ea114396bf181b6bd04157a11e8345d710a577e367fa91c8500f9d845d3dcc7b6c96984feb43a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe.x7ld9fw.partial
Filesize
497KB

MD5
5df0c3d93724c65654890ef86dd5f7f7

SHA1
41273476acd20a6955131c779bba3207b1d53ca3

SHA256
3a70295ff7bdbae5ff42ab3bf25d2a405d166327b3e6c9d42f233669560c4359

SHA512
5438fe2ccad941056f8da9457bf620368e1b85b5d327ef5206ea114396bf181b6bd04157a11e8345d710a577e367fa91c8500f9d845d3dcc7b6c96984feb43a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\favicon[1].png
Filesize
958B

MD5
346e09471362f2907510a31812129cd2

SHA1
323b99430dd424604ae57a19a91f25376e209759

SHA256
74cf90ac2fe6624ab1056cacea11cf7ed4f8bef54bbb0e869638013bba45bc08

SHA512
a62b0fcc02e671d6037725cf67935f8ca1c875f764ce39fed267420935c0b7bad69ab50d3f9f8c628e9b3cff439885ee416989e31ceaa5d32ae596dd7e5fedbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F03.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7EF3.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\P5GEYWW5.txt
Filesize
607B

MD5
552bd3bc0f3745597754abde2db8a86a

SHA1
a5c3197da1b47a3e28186c10ae6d1871524a9612

SHA256
ea93c9e15decc09bbef50554656becdd6baba0322b112220c8dd68904357c9f6

SHA512
2eeb8b8d7cbfbca0fdb82275edc82f5eaa175f4172dc60fe3b224525c8724b61ef5e94425544bdfd78724a3ecff3319722abc78bb95fe9b161c1537a49fe23d9

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe
Filesize
497KB

MD5
5df0c3d93724c65654890ef86dd5f7f7

SHA1
41273476acd20a6955131c779bba3207b1d53ca3

SHA256
3a70295ff7bdbae5ff42ab3bf25d2a405d166327b3e6c9d42f233669560c4359

SHA512
5438fe2ccad941056f8da9457bf620368e1b85b5d327ef5206ea114396bf181b6bd04157a11e8345d710a577e367fa91c8500f9d845d3dcc7b6c96984feb43a9

Download Submit
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UIC7WQYE\PwnBox.exe
Filesize
497KB

MD5
5df0c3d93724c65654890ef86dd5f7f7

SHA1
41273476acd20a6955131c779bba3207b1d53ca3

SHA256
3a70295ff7bdbae5ff42ab3bf25d2a405d166327b3e6c9d42f233669560c4359

SHA512
5438fe2ccad941056f8da9457bf620368e1b85b5d327ef5206ea114396bf181b6bd04157a11e8345d710a577e367fa91c8500f9d845d3dcc7b6c96984feb43a9

Download Submit
memory/268-55-0x0000000002580000-0x0000000002582000-memory.dmp

Filesize
8KB

Download
memory/964-709-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/964-708-0x0000000000A70000-0x0000000000AAE000-memory.dmp

Filesize
248KB

Download
memory/964-707-0x00000000006C0000-0x0000000000718000-memory.dmp

Filesize
352KB

Download
memory/964-711-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/964-712-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/964-713-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/964-706-0x0000000001390000-0x0000000001412000-memory.dmp

Filesize
520KB

Download
memory/1976-54-0x0000000002A80000-0x0000000002A90000-memory.dmp

Filesize
64KB

Download