01f8471b5baa722a8825377ba031baaf19328fb1e01e154d298a3bdbe5f21351

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
Size

652KB
MD5

67b59e779ca2cde9759fdbb3a4f76fd5
SHA1

283d6b3b56462a6f0d0fdb050d2844948d96ecdc
SHA256

01f8471b5baa722a8825377ba031baaf19328fb1e01e154d298a3bdbe5f21351
SHA512

4e2db78905e2f392e5219c729c21dd51e934102d2b21d7a79c4f43340e6c27d73a9a237e394b7bb30a2d4aecda971d92ed3ff91b3c1067339cf7f1df57c18dea
SSDEEP

12288:KIMWh8N44VA55J4NZphtIGSoA4TasL4Qfo2u8lp7d0dR+w653hvR/0055qV1:Kwc4H55J0ZpXae/fo2fl9dqy5ds

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\lshss.exe = "C:\\Users\\Admin\\AppData\\Roaming\\lshss.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\YOUTUBE.exe = "C:\\Users\\Admin\\AppData\\Roaming\\YOUTUBE.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zAPOgK.exe	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2800	lshss.exe

Loads dropped DLL 2 IoCs

pid	Process
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Roaming\\67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe"	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 2800	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	31

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2724	reg.exe
2524	reg.exe
2336	reg.exe
2812	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
Token: 1	2800	lshss.exe
Token: SeCreateTokenPrivilege	2800	lshss.exe
Token: SeAssignPrimaryTokenPrivilege	2800	lshss.exe
Token: SeLockMemoryPrivilege	2800	lshss.exe
Token: SeIncreaseQuotaPrivilege	2800	lshss.exe
Token: SeMachineAccountPrivilege	2800	lshss.exe
Token: SeTcbPrivilege	2800	lshss.exe
Token: SeSecurityPrivilege	2800	lshss.exe
Token: SeTakeOwnershipPrivilege	2800	lshss.exe
Token: SeLoadDriverPrivilege	2800	lshss.exe
Token: SeSystemProfilePrivilege	2800	lshss.exe
Token: SeSystemtimePrivilege	2800	lshss.exe
Token: SeProfSingleProcessPrivilege	2800	lshss.exe
Token: SeIncBasePriorityPrivilege	2800	lshss.exe
Token: SeCreatePagefilePrivilege	2800	lshss.exe
Token: SeCreatePermanentPrivilege	2800	lshss.exe
Token: SeBackupPrivilege	2800	lshss.exe
Token: SeRestorePrivilege	2800	lshss.exe
Token: SeShutdownPrivilege	2800	lshss.exe
Token: SeDebugPrivilege	2800	lshss.exe
Token: SeAuditPrivilege	2800	lshss.exe
Token: SeSystemEnvironmentPrivilege	2800	lshss.exe
Token: SeChangeNotifyPrivilege	2800	lshss.exe
Token: SeRemoteShutdownPrivilege	2800	lshss.exe
Token: SeUndockPrivilege	2800	lshss.exe
Token: SeSyncAgentPrivilege	2800	lshss.exe
Token: SeEnableDelegationPrivilege	2800	lshss.exe
Token: SeManageVolumePrivilege	2800	lshss.exe
Token: SeImpersonatePrivilege	2800	lshss.exe
Token: SeCreateGlobalPrivilege	2800	lshss.exe
Token: 31	2800	lshss.exe
Token: 32	2800	lshss.exe
Token: 33	2800	lshss.exe
Token: 34	2800	lshss.exe
Token: 35	2800	lshss.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2800	lshss.exe
2800	lshss.exe
2800	lshss.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1668	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	28
PID 1628 wrote to memory of 1668	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	28
PID 1628 wrote to memory of 1668	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	28
PID 1628 wrote to memory of 1668	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	28
PID 1668 wrote to memory of 1616	1668	csc.exe	30
PID 1668 wrote to memory of 1616	1668	csc.exe	30
PID 1668 wrote to memory of 1616	1668	csc.exe	30
PID 1668 wrote to memory of 1616	1668	csc.exe	30
PID 1628 wrote to memory of 2800	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2800	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2800	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2800	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2800	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2800	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2800	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	31
PID 1628 wrote to memory of 2800	1628	67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe	31
PID 2800 wrote to memory of 2704	2800	lshss.exe	32
PID 2800 wrote to memory of 2704	2800	lshss.exe	32
PID 2800 wrote to memory of 2704	2800	lshss.exe	32
PID 2800 wrote to memory of 2704	2800	lshss.exe	32
PID 2800 wrote to memory of 2752	2800	lshss.exe	33
PID 2800 wrote to memory of 2752	2800	lshss.exe	33
PID 2800 wrote to memory of 2752	2800	lshss.exe	33
PID 2800 wrote to memory of 2752	2800	lshss.exe	33
PID 2800 wrote to memory of 2688	2800	lshss.exe	35
PID 2800 wrote to memory of 2688	2800	lshss.exe	35
PID 2800 wrote to memory of 2688	2800	lshss.exe	35
PID 2800 wrote to memory of 2688	2800	lshss.exe	35
PID 2800 wrote to memory of 2632	2800	lshss.exe	36
PID 2800 wrote to memory of 2632	2800	lshss.exe	36
PID 2800 wrote to memory of 2632	2800	lshss.exe	36
PID 2800 wrote to memory of 2632	2800	lshss.exe	36
PID 2704 wrote to memory of 2336	2704	cmd.exe	40
PID 2704 wrote to memory of 2336	2704	cmd.exe	40
PID 2704 wrote to memory of 2336	2704	cmd.exe	40
PID 2704 wrote to memory of 2336	2704	cmd.exe	40
PID 2752 wrote to memory of 2812	2752	cmd.exe	41
PID 2752 wrote to memory of 2812	2752	cmd.exe	41
PID 2752 wrote to memory of 2812	2752	cmd.exe	41
PID 2752 wrote to memory of 2812	2752	cmd.exe	41
PID 2688 wrote to memory of 2724	2688	cmd.exe	42
PID 2688 wrote to memory of 2724	2688	cmd.exe	42
PID 2688 wrote to memory of 2724	2688	cmd.exe	42
PID 2688 wrote to memory of 2724	2688	cmd.exe	42
PID 2632 wrote to memory of 2524	2632	cmd.exe	43
PID 2632 wrote to memory of 2524	2632	cmd.exe	43
PID 2632 wrote to memory of 2524	2632	cmd.exe	43
PID 2632 wrote to memory of 2524	2632	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\67b59e779ca2cde9759fdbb3a4f76fd5_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h_whh6sf.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D04.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8D03.tmp"
    3⤵
    PID:1616
- C:\Users\Admin\AppData\Roaming\lshss.exe
  C:\Users\Admin\AppData\Roaming\lshss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lshss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lshss.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lshss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lshss.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\YOUTUBE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\YOUTUBE.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\YOUTUBE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\YOUTUBE.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES8D04.tmp

Filesize
1KB

MD5
4b9d84417664bd13996e58d6627763ff

SHA1
f6fef58b3e42583f6bc8bb076550b96b95575f00

SHA256
17e3123f8c07835678d034a4348c88949a7dbc6652179c2ccdd87d96efd62486

SHA512
e71a35cf06a469e06078ea0ececf2bb20f977254bbf38f62cd7dada41a9dfa8395340d5a3cca15e35ff6e75641544a5b10d416ba784ac60cdc1a63da299d2724

Download Submit
C:\Users\Admin\AppData\Local\Temp\h_whh6sf.dll

Filesize
5KB

MD5
bc5ee7fe8f6c2581f30328c33e2b8958

SHA1
23a3b60f4dbec6d53c66c5ad0895c09b434cd232

SHA256
9f576473fd88d426895318b131fb923c520646325da10be8cb8379669e836c6d

SHA512
29c29eb4de8af6de265ec2ccf70da012dbbec4031ce5bcb556ab872702c71881a4e4b4d17ff72dacc86f6470f9f7703fa6e4d3d5f33d09b935a706be6130e2d4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC8D03.tmp

Filesize
652B

MD5
0504ae1ed304d1343485f574876d3047

SHA1
7d843603934d22b9bbcac21ba87c505a9ffd9695

SHA256
31e20edc2b0fc2088ed116b55226ad9fbcf8d054cec2d36dc60c1e3fbf41cab0

SHA512
4c7696ba430a76ab5b69b181570278f375e950850c5ea8ffdf59d5b2c01323bbd24e9148287d8100b4d8a54133043789ea564bd0728b250d321269653c1ef5a5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\h_whh6sf.0.cs

Filesize
4KB

MD5
7f1f970af88008f4bc9476dd5c0ca6d4

SHA1
214bf03499bbb4694e15680ce1d32f8550dba208

SHA256
6c56768f4d792f55e7f7d42df418ece4c4840a38aa4314fa7d86671e1b3b6eaa

SHA512
d04d3bbd99f58b268b2dfd30d2c1e353d95551a6ada286b7ff2c7fce608daab3e6662ea9a37487732dcda53e05446ccf14dd90b11e049336906d45145890ab9c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\h_whh6sf.cmdline

Filesize
206B

MD5
569ec7ba0a62c1507eabff56fdd1c64d

SHA1
2743b08c6860f2522f4e68991d55292b894d6ba6

SHA256
e8eee4233f30a14e0faef6657a2dad47d073f3203201278ea4d1c4bd013c571a

SHA512
9086f39a397fcfbae1df8d29a0993208ed8445ed3035ed8a9e3722ff3e9a4f58e32815db379073b3cfdd96312e96595f859fad9b9d05219f6d01cef9224c135f

Download Submit
\Users\Admin\AppData\Roaming\lshss.exe

Filesize
16KB

MD5
530f0d4fa63b33fd87407df2aa2f0f9b

SHA1
75b0b9555299e3a2359e76e4c0da330b8ccbbb50

SHA256
2d5db9c5097e230b08caddd3fbeae1f4ef4ad46aacbeb0255a8bcb91e41b30b4

SHA512
4536e2d7d094babb70c4dabf6e03c4c23c7e042a86f64564649538fbc416097bc1b954ad7d6f5b55496a9d0fa03c287d492292231af6dfca93099b23ec9bb245

Download Submit
memory/1628-2-0x0000000074F60000-0x000000007550B000-memory.dmp

Filesize
5.7MB

Download
memory/1628-1-0x0000000074F60000-0x000000007550B000-memory.dmp

Filesize
5.7MB

Download
memory/1628-0-0x0000000074F61000-0x0000000074F62000-memory.dmp

Filesize
4KB

Download
memory/1628-45-0x0000000074F60000-0x000000007550B000-memory.dmp

Filesize
5.7MB

Download
memory/1628-44-0x0000000074F60000-0x000000007550B000-memory.dmp

Filesize
5.7MB

Download
memory/1668-11-0x0000000074F60000-0x000000007550B000-memory.dmp

Filesize
5.7MB

Download
memory/1668-16-0x0000000074F60000-0x000000007550B000-memory.dmp

Filesize
5.7MB

Download
memory/2800-26-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-49-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-25-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-38-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-43-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2800-30-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-46-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-48-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-27-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-50-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-52-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-53-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-54-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-56-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-57-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-58-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2800-61-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download