509acabc2196bd8e98d6480d46f9358f199e55740579145b8a4a6ca8e90d76f0

Analysis

max time kernel
77s
max time network
115s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe
Size

216KB
MD5

b47005de33ed2b076fd32bd2adc39d83
SHA1

ffb0b4450341e2c04d39cb3845e879af2c5961bf
SHA256

509acabc2196bd8e98d6480d46f9358f199e55740579145b8a4a6ca8e90d76f0
SHA512

01bedf9a27e1c777170cd950826a5f4c6b126904bb4f7fac42380d2c823154d4d69bf4472ceb621947601cc5f5fb514307d0f768427fb17783928b035ec8b442
SSDEEP

6144:Q6WEDffYdnsWF3HGtuvNhUmtPxNp7wWer7Wq6yvDE:Q9E7fYdnNXGtAzsWm6yg

Score

10^/10

defense_evasion discovery evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	plugin.exe

Executes dropped EXE 2 IoCs

pid	Process
2720	gdhftrlzi.exe
1264	plugin.exe

Loads dropped DLL 6 IoCs

pid	Process
2932	rundll32.exe
2932	rundll32.exe
2932	rundll32.exe
2932	rundll32.exe
1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe
2720	gdhftrlzi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Module = "%ALLUSERSPROFILE%\\Media\\plugin.exe"	gdhftrlzi.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	plugin.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	plugin.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\ProgramData\Media\plugin.exe:Zone.Identifier	cmd.exe
File created	C:\ProgramData\Media\watcher.exe:Zone.Identifier	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdhftrlzi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{277785E1-5FE6-11EF-B066-DEBA79BDEBEA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData\Media\plugin.exe:Zone.Identifier	cmd.exe
File created	C:\ProgramData\Media\watcher.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe
1264	plugin.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2624	iexplore.exe
2624	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2932	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	29
PID 1692 wrote to memory of 2932	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	29
PID 1692 wrote to memory of 2932	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	29
PID 1692 wrote to memory of 2932	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	29
PID 1692 wrote to memory of 2932	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	29
PID 1692 wrote to memory of 2932	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	29
PID 1692 wrote to memory of 2932	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	29
PID 1692 wrote to memory of 2720	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	31
PID 1692 wrote to memory of 2720	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	31
PID 1692 wrote to memory of 2720	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	31
PID 1692 wrote to memory of 2720	1692	b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe	31
PID 2720 wrote to memory of 2072	2720	gdhftrlzi.exe	32
PID 2720 wrote to memory of 2072	2720	gdhftrlzi.exe	32
PID 2720 wrote to memory of 2072	2720	gdhftrlzi.exe	32
PID 2720 wrote to memory of 2072	2720	gdhftrlzi.exe	32
PID 2720 wrote to memory of 1904	2720	gdhftrlzi.exe	33
PID 2720 wrote to memory of 1904	2720	gdhftrlzi.exe	33
PID 2720 wrote to memory of 1904	2720	gdhftrlzi.exe	33
PID 2720 wrote to memory of 1904	2720	gdhftrlzi.exe	33
PID 2072 wrote to memory of 2624	2072	cmd.exe	37
PID 2072 wrote to memory of 2624	2072	cmd.exe	37
PID 2072 wrote to memory of 2624	2072	cmd.exe	37
PID 2072 wrote to memory of 2624	2072	cmd.exe	37
PID 2720 wrote to memory of 1264	2720	gdhftrlzi.exe	36
PID 2720 wrote to memory of 1264	2720	gdhftrlzi.exe	36
PID 2720 wrote to memory of 1264	2720	gdhftrlzi.exe	36
PID 2720 wrote to memory of 1264	2720	gdhftrlzi.exe	36
PID 2624 wrote to memory of 2820	2624	iexplore.exe	38
PID 2624 wrote to memory of 2820	2624	iexplore.exe	38
PID 2624 wrote to memory of 2820	2624	iexplore.exe	38
PID 2624 wrote to memory of 2820	2624	iexplore.exe	38

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	plugin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	plugin.exe

C:\Users\Admin\AppData\Local\Temp\b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b47005de33ed2b076fd32bd2adc39d83_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ryptgc.dll,Install
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\gdhftrlzi.exe
  C:\Users\Admin\AppData\Local\Temp\gdhftrlzi.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    /c start http://www.tnaflix.com
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.tnaflix.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\ProgramData\Media\rdb.bat
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:1904
- - C:\ProgramData\Media\plugin.exe
    -wait
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - System policy modification
    PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Media\plugin.exe:Zone.Identifier

Filesize
13B

MD5
38de427224a5082a04fe82e2bd4ea9ec

SHA1
7e4a53de1f83762dd2febd39b818e2258bc83bc1

SHA256
12f99f53144294750fe8713d580eda286f4bd95cd9c840db8ab957def8040028

SHA512
ec3f3c324eeaad91ab0efd47b3084493d863f969344fa1ba87ace1974908053d396673b44c33b4dceeef792a74ad9278e06acc27c83459af1153de52f83afcbf

Download Submit
C:\ProgramData\Media\rdb.bat

Filesize
97B

MD5
5303b5018a6cd19200b98d31ab04f25d

SHA1
8285eb92f131111e40d2dc864d3b386dad6b9129

SHA256
464648d492af6bb50cf65ddcbdca3e90d4b224ccc6f4ce3944d439b6c32da524

SHA512
654aed00850f6b7e424a5ec5acad086a51fb54f5f944238979f43fa1aac430661250210fe5f38dcd78e46311adc7e6b282cb5c41bebfe5a7d297afd6db6de21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d2e68e790a51a2be003bad135af522a

SHA1
c5d53bf793f57bbba5569d29e7f3776dd7684012

SHA256
607fde21fb6457d1d203d929b3384509314e2a92c1fd65a90896866a0177a82e

SHA512
2a673b0778ca18468b5377abf79af8849babaf86f0b57bce015e2c1a10b6a69a889c01ee3f3522cef29c1622be37e9946ed67721cccf55b7c834d7a5c2a773dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c813bb718a400a9215652625055e146f

SHA1
36578f82462bd3f279e45d5b05c3480aacdfe613

SHA256
f299d7cc18b54af8cabb1b40cd9474151815cb87240116d708702ee4a505d04c

SHA512
e47348244f4b9e87831a3fd7d46a8fe2b82bdbc03b2013a8c469ab0aa34536010abde65f481cd31463be5e3c9f3ed821a3effc17488a3eed8f4a7e2d1f5c99f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1846930ea65c7e3de19b1a9d5a7eb8d

SHA1
3c9076ed5cbad0fce7197e2b0fe7c8b1d85bdefa

SHA256
23c67d73f0b9d2ef2adb2da112b634abc1ef6b6906424b031dc42e7a3413d198

SHA512
464a3935b5d62179b98237b9e6370153e0a30154d70852f97d55025780a99f1aacfca89c32d6270eb213b509d8281d9686028d314d08d2d5b763b5834c58046c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c4be7ace1e0e57077c6d7d15e9558f4

SHA1
657281fe55457df10dd821d1e55c86e20734a105

SHA256
b7fb4d31a02f727704b06ed0fb81d272afb41027739c7d53faed04d941e00c46

SHA512
d48a555fb7caff6bc4358f9415b88ba170f2d9e65b91eb5bb2c7be44f682a71ecbd139ef54b396f0023bd9cad9bfdeb2b9fe2439ef96f2b5860e0808efbf1f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d522a4e7684684d8d7ba1ae405fea824

SHA1
08b347c05a0c1fe525cc71a6010e21a3b0dff130

SHA256
b35d7122e893d4a54716f998ebb333bc365b27275ebbd1bc11f27e2b32043914

SHA512
2acd42524feae4f0060dfd50262b43f6e27bf2dbd7163b2aea5ac8e350de962b8f12b1c221fe290840c5ae8d438e52a5010b8d7895e529e6554e01707be56261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a67b456980737199adc72453f3b15d8

SHA1
ea3e190268b3dc6107278eb6a51f8f258b903227

SHA256
8c055419bd43172542c851bdda934db1eb620d14b03441819e8e5a8bd85de408

SHA512
df2378f0b4fd8d6dde9a536c385056e5b8fa09d49b6fa55448a47643a14e016f5edcaf87f223aa5191379ca0e567fb08dadbb4318118ae692982abe9b6bc9bb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fa98f16a1b757516f0364bad44e0f9a

SHA1
086a4c55dc9fb63f47bf95b5eb77321d0dda7d37

SHA256
cdbfb9af7d5232080d50a496766a05ffdee96f82b3506987070e3eaeb8bb7b1b

SHA512
fdec6b7097aa0f2a531cba8de2a58c834fdd177392fdedbb6f054f2875cb775d4cc90219dad5e448d9ee3c351db1c1a1bb0bc3a9f045e2918a5a93210b83774a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b84965b6ae6acb502dc28138a0ab8f46

SHA1
cee1db141565816beda111f9b2b78ad7d978c9d4

SHA256
9c3b733648ab71d9e6d97c09abd7c832b9e77ff28ccbc7d1f6c38c14a55d9cea

SHA512
ee0503ab30e1c8fe94f55031cef9398f1b4448fa2673fe39be5b5e6e73d8ce39caecdd9ab584c71d4a3dd271ea9b938ab4cbff589c7dd304e7827d0ae722c436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8aaf3e7525272a6c027f2842d8719760

SHA1
335401b34965cfea498a5924d739de41eac22fff

SHA256
48588a0047dfb72a58dbc2d09478ed3e469f7c43c0681c2719b8a98d03d139fe

SHA512
e069288db0c6212e0236e804ca27fbb4791ada516f38424c5e3631af9e87bfb4511f2fa9dc6aa8838fb5d26b2563817291e3bf19f46b903df0446f31b9fbbb37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
703ddef3333720af48e04954cc504bcd

SHA1
449b4b781d4b1301822c5dbb24f91e17226aa558

SHA256
503a10b218f8fcf3d34ebb092594cb00e60cf4f55d3b3a16779c1dab7d32f397

SHA512
f2662f63061505cce05170544cd33b30b0dfd77d104a766cc98bfb2a9cc3ce931363f681217f4e709d6f8c7063fed80f3c4bfb24fb345490978b8364d72147fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c824288a7babd476d18828653e1c806

SHA1
b9d9084ae6a851ba34805f337b718eac129d12fb

SHA256
9910fb81b08dcdd26d0964affaf777c91082840bad11b0e5a426654460540ff7

SHA512
08ef4777f8c748861ecb2508f57c7d0001c19ef12f4d0745a4af29c0a09f8191cf154654e357d571e2422223ebb05705bef0aad226c886652868b23a4c959180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
462d5a8f459e7f604697b21eec582ffb

SHA1
da5c94dd59d4e69c55eff8f2eccf53ef2deceac4

SHA256
4de0e672b46cb17e2c3ccc2d11c649b41aea4ae10050a76f0ca35f52b6579bc5

SHA512
b1099b64ca512457e161705f63100dad21c202b473423ad55a9f01fbe788806743ff530908e33a444c1c2eb67ca2f3e8e278a0c6463eaaf831b4a1a2216a572d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31b2f69e3cbe6e6fbd882dc28ed710aa

SHA1
4147344b2692f47eecc25f4f06d6899f33155905

SHA256
1b1a2ed0e3bf3a536d611cb31041daef9cdfe7ea13fa556d6cb9be4c1ab28768

SHA512
502622f146dac5c535e1b9ebbd9bfc2930439825bdec8028298d12fabec6cb3faf45c20b26a7a5dd530d5a418eaf48cf51064567e8cea3f9434d35a3a1b6a1ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c585aa0f3f3d3e7ec5c4fb8d2ec92c7a

SHA1
7815d70d8d00c3e47f51af8dfdf504e3da30a1e7

SHA256
cd6b8a4f3d32cc86cb45f1758f7aea59f4cc5fd562d123cb3ca781cb11c60675

SHA512
c866cc4a257806159d00cfa166074f1b58d4c1c9f574026fbac531ebf410186da1b52da15e270b12a1ac057fb53ae3eb844082d70de7529494669016bfa8e4ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
888bd3de2d94031d907c4963f634f88d

SHA1
d63987016635ddee4adbd53e48fbbbff9741c089

SHA256
890ef56f0ed8e3bc287cf22b8e8aa27a861471795160472df0fc10de1de768ce

SHA512
984cda17a6779e164948c4e2fb632bcfab51d300cbd860ded48be0db21e22e82c5fb8e1f1c8be6d01295cc0dfc87cd26a7f6e0d865d11cb0242fdde9fe025720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b91baf27d46623f8fbcaf18a960c262

SHA1
7ec6b40686e5631aea7f1230149423fc52ee5477

SHA256
97ab526bf5b1e3703be5dcc53728793e94eef50685791f77eb3a1f5df24e0a2e

SHA512
e18aab265efdb35dbb096bc721deeb02adfdc7dae1daffe509ae9410ebeaa52d46700bfa20445721549db6e03558ee6a4bacb7fa2c457df97fe60d722bb12bb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18e2e7c94d0f7b24aea1512973a295ef

SHA1
3b0fbc35b6ee3f062e81f16a464540c8303ed70a

SHA256
11a96bd73f9d6307494b94b0c1d2c8bfbba13b34857c67950f4238aedeb848fd

SHA512
cd3ba6f274c1909bf34b6a3c9226f42bce27cc93b554159201fc4e81d1920ee7b2903dd36cf9a5d3d4c18e5b7015ceed74c85f91120430e2b1696d85222a66c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7500f03caea8d1038a8209238fbfcc83

SHA1
87d73cd77c0b0bfce9198dd2fb0ac9195bdf642b

SHA256
3d0676e1fbe2fad2c0d6ee9a28bb82ac159c55ce7c98bafdd945c4174ce30630

SHA512
37e2d1be423f135b6295d710f280f8022b1b3b2f9b33266ad2232c3b790cc89437302d5803f76cc7fb8e8b2682b8d593920aa91f2bab176b754cd5c59eb635ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a71128c209b029dc9d52c844392468b

SHA1
096e43e9d4f6b7b8ed7c8831e86d7f762cab5022

SHA256
8b23418f9781fec8b5f81ea9d7fd7521f89a41fe671ab372e2473ef7b55ca1c7

SHA512
4065ed290eb094b6ddd98e8bbdb0b7849e7c1f718d04e2e65546db6cd15e4be4560e26a5e7cf63e6866abf85a36d567bb843635c192dc5877c1c04a3b106085f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04a368d95ae48af4890ae48f3fb79b8d

SHA1
bd3579f19fa90ad3485d505255702bcbd6e51309

SHA256
a731673bf26e7b8b60665dbf4e96ce82814b1c876bb0e5b2feef5c238cd64e57

SHA512
57b72f8e40803c2c59d33e7056bb9eede0fc2e80af3f9c42559f35c5033d7c099627e579454ead703e89e40a7e942e55b497777e7f6556a3ba134e82ec822c88

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA1EC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA23D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ryptgc.dll

Filesize
56KB

MD5
3038c779df2ad97b71102a689cd866cf

SHA1
e56d6e0c0545f2c6d9187ce06c0c3fe17aa51db0

SHA256
bd0e43ed3cd340145b55fc1685c66a644426127041b1dad97a563b31e8733f09

SHA512
1a80f5276593541a94842d627a4f11b4bfa768ce0e00c15176d8de2e975a4084ee9fc78eb272aebf3a60cf2419d76814a0b408b631099a284cb86a82a28bc5f2

Download Submit
\Users\Admin\AppData\Local\Temp\gdhftrlzi.exe

Filesize
150KB

MD5
72c0c3469d6b4993bf1a815842d3e88d

SHA1
4171cd10258c457192d3bb2ea12a1fc51ce7830a

SHA256
50a75cd22ce467b06128479671a460b1bc19458e8634c2a87390171f15073f44

SHA512
4b8682e98b25371b5a42df918f8045bd0fde24fb531d704822bc699fa06b2452a0931e37de6073600c43653b93e90a9d0c5b1b6a42018ddc54f0afc3c16861c6

Download Submit
memory/1692-0-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1692-12-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1692-11-0x000000000042B000-0x0000000000433000-memory.dmp

Filesize
32KB

Download
memory/1692-342-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1692-344-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1692-2-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1692-1-0x000000000042B000-0x0000000000433000-memory.dmp

Filesize
32KB

Download
memory/2932-9-0x00000000001C0000-0x00000000001E4000-memory.dmp

Filesize
144KB

Download
memory/2932-10-0x00000000001C0000-0x00000000001E4000-memory.dmp

Filesize
144KB

Download