Overview

overview

10

Static

static

3

f75717d817...18.exe

windows7-x64

10

f75717d817...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-09-2024 02:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe

  • Size

    3.1MB

  • MD5

    f75717d817eaf1dce81074e7daad9262

  • SHA1

    767162ef5358074624e7f9331c5df24cabd3f219

  • SHA256

    e11460d4bf65827d58d5790883be3993a28e56840f5133bbd91f2a75c42d6513

  • SHA512

    c1fe7cae0e1b53aa73a04850df2cecaf4fc8fb0535089b40eac7559b4757b27bf9b0c387b6bb18c97ab99f704e0f863d3f6f8f786ab026a7ee2e68b5d3027e52

  • SSDEEP

    49152:IBpgkDhX3jLu+T2nVnmnRMV/lTKcnTVLnKOvnnWNT:o

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f75717d817eaf1dce81074e7daad9262_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\white.exe
      "C:\Users\Admin\AppData\Local\Temp\white.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1068
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1628
        3⤵
        • Program crash
        PID:4504
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1156
        3⤵
        • Program crash
        PID:4228
    • C:\Users\Admin\AppData\Local\Temp\mrace.exe
      "C:\Users\Admin\AppData\Local\Temp\mrace.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Windows\SysWOW64\AV Protection 2011v121.exe
        C:\Windows\system32\AV Protection 2011v121.exe 5985C:\Users\Admin\AppData\Local\Temp\mrace.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2056
        • C:\Users\Admin\AppData\Roaming\d5QJ6dEK8R9YwUe\AV Protection 2011v121.exe
          C:\Users\Admin\AppData\Roaming\d5QJ6dEK8R9YwUe\AV Protection 2011v121.exe 5985C:\Windows\SysWOW64\AV Protection 2011v121.exe
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2036
    • C:\Users\Admin\AppData\Local\Temp\ready.exe
      "C:\Users\Admin\AppData\Local\Temp\ready.exe"
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4016
      • C:\Users\Admin\AppData\Local\Temp\ready.exe
        C:\Users\Admin\AppData\Local\Temp\ready.exe startC:\Users\Admin\AppData\Roaming\7E31E\516C8.exe%C:\Users\Admin\AppData\Roaming\7E31E
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4980
      • C:\Users\Admin\AppData\Local\Temp\ready.exe
        C:\Users\Admin\AppData\Local\Temp\ready.exe startC:\Program Files (x86)\1E51E\lvvm.exe%C:\Program Files (x86)\1E51E
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4880
      • C:\Program Files (x86)\LP\C8A7\30A0.tmp
        "C:\Program Files (x86)\LP\C8A7\30A0.tmp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3108
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4012
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2936
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2412
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4852
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3836
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4472
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:440
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3196
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5056
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3520
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1752
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4644
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1068 -ip 1068
    1⤵
      PID:2224
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1068 -ip 1068
      1⤵
        PID:2756

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Modify Registry

      5
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Peripheral Device Discovery

      2
      T1120

      Query Registry

      5
      T1012

      System Information Discovery

      4
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\LP\C8A7\30A0.tmp
        Filesize

        99KB

        MD5

        82d50af33ff156670a076dc834a99b4d

        SHA1

        d5e3662e28d51a8366fb214d77585b95984541d1

        SHA256

        7f57b37aa39698068271e64bbb42ff74b1a2b6157d233d8bdef1f683a7230a7d

        SHA512

        527986d4cca9998059e278de71989f3f46851eace0370cb2bfd69dc7292d5a1597a373ff2b350137eeea8dd7dd13a0e8de8b6306795e4b5a6428fab6c1b27563

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
        Filesize

        471B

        MD5

        d93da80897a73a5a2bc23ce78267d013

        SHA1

        c36cd4ac5837d6f4b3d60ee7172df7a727a09e89

        SHA256

        5e143c2f26f4cd23c890d7b00b9ebad0e3378c771d4c9294733d7338838f3c3f

        SHA512

        96db6e7891951fd02fb63445a9d03ac4fed8bac4482532712cda26f6e37fbc1df250af7426c25bd364f9c6f1f590a17a4d03e884cf7b2d07250e870fb974d13f

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
        Filesize

        420B

        MD5

        91674575f177d6217e7616b7405d0402

        SHA1

        e7ad3c6e417a62262347ef7a7722e9ad6ced91a3

        SHA256

        25b5441ef1701e029a265215bb1993f97e89708dafacf4613f09ed0e8b052d50

        SHA512

        5d50fd6c6b6df8ebcb9ed3ad952e25ba878f33427ac1fcfd1aeb10775f436898fb018b01cd263266dd16e6059ff2952a32feee9f3e4634febe3f94c3eebcb938

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KDOTUZKP\money-matters-tips-for-junior-developers-to-maximize-their-income[1].htm
        Filesize

        13KB

        MD5

        c68a80a023603e2200e27cb6fa739116

        SHA1

        d7af5d47650f38d75b731366712cf2c074d98d22

        SHA256

        8b648c54f618969318dd51dbdc454623062beaafeb47545220ba9816ab6eeb47

        SHA512

        81b84e5a1c597b65cb7f026c0bd3cfffd2670f6bc43480c25f4672e7daf289b0113d9cfe2d07ea3e05061a7a6adaf1a1737586726d7040293766a53c862c5581

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NMN7D09E\the-dangers-of-backdoors-in-erc20-smart-contracts-a-closer-look-at-the-sand-token-contract[1].htm
        Filesize

        11KB

        MD5

        fc075afdad583cc52c8d53ce4518c299

        SHA1

        0243f92324157ae4a94293c1a0ffe4e2ae927643

        SHA256

        90a7329985b5ca15ba6be8d65f9cd23efc9d7c248a4c3cb15e2123acfdff54fb

        SHA512

        7fe45ce01fdb4db6a40343fc7e121155a688e72149c00f2da4251b80c1f417fb709903d5b7999490ae93881b201ef1a55336ca6898ac53846ff27f7c5b667b98

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NMN7D09E\why-the-linux-kernel-doesnt-have-unit-tests[1].htm
        Filesize

        11KB

        MD5

        a94ca042677436ca213cb0acf5a4a0d4

        SHA1

        e10214a2b5373da51ba79b15a6f913d05d18e78d

        SHA256

        e8d356317e9080e252024e9a8e0266e6c1c112935d3ab8a0b09a7a6c432ef48e

        SHA512

        44901a90af94d6feabe710999b74657afe3aed3ef10a2decc59b9639f58ffd3c480e5d6f55c02ab590192c746fe163deffeff773e85a83f5e1110c0756b4eb2b

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
        Filesize

        2KB

        MD5

        ca29bc3016e7351724ab67ac3822ee46

        SHA1

        cd2af90020b9a1df2b7799263604821e095b0fd7

        SHA256

        7393c9374b386c349ecd87d346a61c92ec3cbabb9945ec84c17ed22e83d520cc

        SHA512

        fe146ce568415bbc75013b9365b670326fcc2a2534f751fb9fd048285f058131840ccc1a3199014fc91756a60eefbbc5be9e8f41af779a9770dae009ee98cff0

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133717907043220083.txt
        Filesize

        76KB

        MD5

        afb0498ab1cf5ee27d7945303709bfca

        SHA1

        2ad4ce76c96d901ad0bf293f6156f6ac0cf48135

        SHA256

        f5968390239418c400a921d03e5a15c89984b796e48a71c418269b39aae6e870

        SHA512

        6c4ae37a927970f828cd10c97b694b80e7a1a19cb30f79ed0cef4872c2ad04ed9aaffef79e0ae37f271e8f55f20bb42660c747978cdb6362e6b60e8e5368058d

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MP05IF81\microsoft.windows[1].xml
        Filesize

        96B

        MD5

        188f8f76ad695de69c313c1113722ec5

        SHA1

        acf66cf340e75c0997ab844f745ed139e05b5c1c

        SHA256

        d926dfadf64142c9d6e871f8e3d4709e78b5e82e237fcde0680740eed9c82b5b

        SHA512

        00eb7bda00afe8efe5b3f29460e2d92d173911f7deabb097d9995fb9af556371c4cecb473d328c8f9c7c85978fd560b1b9cec723805c44bd167ff59c3cf5bbf3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\mrace.exe
        Filesize

        1.9MB

        MD5

        a814cab54088bb64dd76909325d8255c

        SHA1

        87beb3172b2c5e1f80d945d2081963b89a71d405

        SHA256

        8777bc9b25e97841baa95f8c33a7f48386feec1ece6e642fa8c305c359737a29

        SHA512

        51854b2ee5f73ff4861cf4724ee9c23e882c4c21fd15c56987c8c4e4f88f8571c3488cecac13cb7c08013fe84b1aa1ed61e14e8ed19fa4ab92d718f48860df5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ready.exe
        Filesize

        283KB

        MD5

        9943ac3536f8595fa7d492f89d67a179

        SHA1

        730bcfa82e14745f88b99dbcc78e438899215963

        SHA256

        e6a961219d4c28fbc8301a3e84e5d72b984ad42245569881a80450af0984b703

        SHA512

        db825f1db2b9ce560110b148f3de131c77c5d6aab854fa3537db7609b090d1246ee25f82a00005de9dacdfcb09d8f0e9e473febce4872377f045fe000d5e2a78

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\white.exe
        Filesize

        17KB

        MD5

        e2f50ad18ee46952ea1910b826ef2ad1

        SHA1

        531b13b6beb89d4fb74ffd2b44d241f0c0b5ccb7

        SHA256

        882ad3e502cfa58fcb568fbd8ab0da8c0628475e497370e73b137e394e850cc6

        SHA512

        a540aeabc761c9338eee5625351515dd1830aed6cf5d86a5b5c68e62ff653f8ef9fab497679de739e9ba260b81bc4544d5f283b5b98c016060237b3225eed482

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\~!#80C.tmp
        Filesize

        11KB

        MD5

        3760346844d4edb6c7e0bc7c80f50575

        SHA1

        0fe52134b4f639480ffcbd3bdae8df690edd3a7f

        SHA256

        24b806215e579cd4d3ac4d3024d535855927a9f05f42edf62492315fc45e4ad0

        SHA512

        d0c6c3da0645e9978b75992de0b651561c9199e148d6d95f651b9e1c824f9be5b811b1cc9386865604af95cac977cbbb0a77890983b33da20c9b36347d1569ab

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\~!#D7CD.tmp
        Filesize

        13KB

        MD5

        3e394d5ec3f8f237c03c66844f1675e1

        SHA1

        4b0299aa9ef60a9de602581f8927f24d706abea7

        SHA256

        b3fbf1b75424a9f6fb5437dc3a356b876ca1d29c14d271340fb0026d49261c95

        SHA512

        2eec85e2605d3a5cd01bac90884c244c2437afbf7a75816dcea6dfd265a396b0532306d628c88bfc32b2a1ca9545a6e9ba6dd0291f359a3c2e9e807acd1341c5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\~!#EBDC.tmp
        Filesize

        11KB

        MD5

        24a7268beb56fc2e7cdb0c5256895417

        SHA1

        b93122d2412e0a424e52703b0f2137dd44d6a9eb

        SHA256

        72cc9a664593b47313c3bff9bf81754338dbb49003e7dc4bb3ca615d2d374702

        SHA512

        ee9dd52cc97ab5f58f1940cd1c6356f5384aef2033953bfb0c400eb0f2253ed5360072ecea9c41ee09e674e7c3b1ece9dd7392846bcad8c6973397706ac80a57

        Download Submit

      • C:\Users\Admin\AppData\Roaming\7E31E\E51E.E31
        Filesize

        300B

        MD5

        11ccdf010a976ae486a5fb225bbd15c2

        SHA1

        45aa48ae37fd434a5c947fc4641861911c1e1337

        SHA256

        84569c317e91f1573c3de5265a54b2bca01dfdb2f8ae788c8e5c7475f74c68f9

        SHA512

        483b7dd18f9ef5362a525d726b784ba443fdb055173f4d6a70ad546c07c1172394b2eb5d3dfd0564dea78e84278836bec8b18bd2d032a690445876a9dddd4da7

        Download Submit

      • C:\Users\Admin\AppData\Roaming\7E31E\E51E.E31
        Filesize

        600B

        MD5

        1f41e6820b9294cd574f254a2c2ee8b5

        SHA1

        4da0e51f3a0dfd4eb24f2a3aefc2d19d10b7321f

        SHA256

        6ec31a60a7eba5881dfd4b8f0aa814d476ec4c487c1f58f022426e53f40f48a9

        SHA512

        c7047bac013c58d6693565762e14fe0e857ea5a5618f4f3fbddab07918feb5ac55d0bfa2758482482fcacf3a35e99be3ea32a0c023455dc705cd8c950a86e03f

        Download Submit

      • C:\Users\Admin\AppData\Roaming\7E31E\E51E.E31
        Filesize

        996B

        MD5

        067d16ec18f355f985b8c4231db759eb

        SHA1

        ef068478b1253cc682bb758d13cc0e1abbf16870

        SHA256

        3701eb883c84d6735c8e3a18398295f4508c67e9c6429ba07105b933aec98a7b

        SHA512

        bef35076fd024d86b3f2daa02e48b9178e574177281a98abb39b2869a4b6a0cbf619fd3bb5451faa55730093f3a219f158941d0074b5cab6e1a25adb9103ab7d

        Download Submit

      • C:\Users\Admin\AppData\Roaming\7E31E\E51E.E31
        Filesize

        1KB

        MD5

        67f661eb6234c5a1a21a06d347dcec79

        SHA1

        fe92a38545afa5d36d3ff8163531285494ec9181

        SHA256

        1bbbd7ac9d39de19fa9bf2082e68c6b6a32068f983a970c82e92ec686096d00f

        SHA512

        24776c6c8a408bafff5c0b173ede5d86b506a1dcc1cc94326a5ff0d47df34ef0a1710674c45ba1162da135a35b2fd5101a30e048fc9fc1d9a2d6e6af8f07a4d2

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AV Protection 2011\AV Protection 2011.lnk
        Filesize

        1KB

        MD5

        709dfb4d6d99693b3d839a1f263405a0

        SHA1

        6eb2779239999360be8c944c3293c78383dfd38e

        SHA256

        8272cb892d06ac9831e264267ba804e34be8eb6b057915fdae782dddb61c495f

        SHA512

        0072082a2fdda3f01223f5e6a92d52212a85ce25026741095f146980d89da85addfbfdf606448e92c81b1226cec0ecd9e89e8ecef9b28c0183785f6ab64032da

        Download Submit

      • C:\Users\Admin\AppData\Roaming\ldr.ini
        Filesize

        608B

        MD5

        525f56d029bb0b4a9c78124839aaf2e0

        SHA1

        9adeb894fdda7140aa05eeaa651754f5fea06399

        SHA256

        d9102a0d862073414f61290a1d8c94d7978d04e1f482f60b75e80b3cce63d5ff

        SHA512

        69c731f3eae20f892b73c134b7b762fe7ad2446b34783eb14937232e75352b23e1cc89c330e8763c8adcfbd8056080454956b300e367301dc7d96f3dc8011192

        Download Submit

      • C:\Users\Admin\AppData\Roaming\ldr.ini
        Filesize

        1KB

        MD5

        7288c8fe0fc3438e7a5cc218b9ef6eed

        SHA1

        2e1444623067e4808059d6e79ae78fc5ebb3b323

        SHA256

        d040f985658bcac4c55b6b2e97047c450a63857356b0209e9591b0929becd747

        SHA512

        2860e5482b22ab67902fd6e80e9958d16aa4bf8a315feac15942d678f474346d78e5b04cc16be94266b64144b082132921745de1352bef4831d9523a6ff0e87d

        Download Submit

      • C:\Users\Admin\AppData\Roaming\sONtxA0uv2b3m5\AV Protection 2011.ico
        Filesize

        12KB

        MD5

        bb87f71a6e7f979fcb716926d452b6a8

        SHA1

        f41e3389760eaea099720e980e599a160f0413b9

        SHA256

        14c9c49d8ead9ab59a56c328008f59c20b32c3ad22c00e02d34e16ad7086fe84

        SHA512

        e1d14363274e367ea600afc357d012233fc68f0636e8d05b29992e762d31e9a55b4fa38b08613c2ca528d7fb0f547774a3a3dc79aada32c2c7359c3edcdb549d

        Download Submit

      • C:\Users\Admin\Desktop\AV Protection 2011.lnk
        Filesize

        1KB

        MD5

        8773529f74a65c668efc6bad4ca3bf52

        SHA1

        6880312a911738f1b1609d388a033f43089032d5

        SHA256

        889e5eecdf1087d1692fbc9c1cc3b3a975529a1a9bc155d0d3bdbf65f3323649

        SHA512

        6265ee9bd32ff71488f6976c4f3c326bd7cd615fc66492429f852b641b7fe406afa8ad1bbe7fa1dcf16041a0f8dfe61d355d0dfe0f1bef79422d8a5181a8f16d

        Download Submit

      • C:\Windows\System32\drivers\etc\hosts
        Filesize

        1KB

        MD5

        7eab0ddcbf3cec31ec7731b53fdb09d0

        SHA1

        bd75e8a2e47b1153d901874b4ecaff0c1222d149

        SHA256

        a0c9a8935e73279c9a1891afdfa494667cad34cf55063ad912c00ef3706cb280

        SHA512

        aff2f2bfd15f2840e0939b8fd73fea30797394d9fe5d14d02c86df6fe2ee5d28dccdfc3838777b8678c7c8278d3ee286dca219d4344b8782bca52a6dd1e9f4ca

        Download Submit

      • memory/440-897-0x00000000032B0000-0x00000000032B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/632-36-0x0000000000400000-0x00000000008E4000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/1068-19-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1612-30-0x0000000000400000-0x0000000000967000-memory.dmp

        Filesize

        5.4MB

        Download

      • memory/1612-0-0x0000000000420000-0x0000000000421000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1612-4-0x0000000000400000-0x0000000000967000-memory.dmp

        Filesize

        5.4MB

        Download

      • memory/1612-2-0x0000000000400000-0x0000000000967000-memory.dmp

        Filesize

        5.4MB

        Download

      • memory/1612-1-0x0000000000400000-0x0000000000967000-memory.dmp

        Filesize

        5.4MB

        Download

      • memory/2036-376-0x0000000000400000-0x00000000008E4000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/2036-615-0x0000000000400000-0x00000000008E4000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/2036-1296-0x0000000000400000-0x00000000008E4000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/2036-1254-0x0000000000400000-0x00000000008E4000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/2036-1061-0x0000000000400000-0x00000000008E4000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/2036-1310-0x0000000000400000-0x00000000008E4000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/2036-1323-0x0000000000400000-0x00000000008E4000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/2056-79-0x0000000000400000-0x00000000008E4000-memory.dmp

        Filesize

        4.9MB

        Download

      • memory/3108-1017-0x0000000000400000-0x000000000041C000-memory.dmp

        Filesize

        112KB

        Download

      • memory/3520-1097-0x0000000003F30000-0x0000000003F31000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4016-269-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/4016-822-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/4016-1316-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/4016-513-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/4016-1220-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/4472-710-0x0000015C41400000-0x0000015C41420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4472-740-0x0000015C417C0000-0x0000015C417E0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4472-723-0x0000015C411B0000-0x0000015C411D0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4472-704-0x0000015C40100000-0x0000015C40200000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4644-1137-0x000001D0ADC10000-0x000001D0ADC30000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4644-1105-0x000001D0AD840000-0x000001D0AD860000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4644-1115-0x000001D0AD800000-0x000001D0AD820000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4852-700-0x0000000003F00000-0x0000000003F01000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4880-537-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/4980-291-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/5056-936-0x00000215AC170000-0x00000215AC190000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5056-900-0x00000215AAC40000-0x00000215AAD40000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/5056-904-0x00000215ABDA0000-0x00000215ABDC0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5056-916-0x00000215ABD60000-0x00000215ABD80000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5056-899-0x00000215AAC40000-0x00000215AAD40000-memory.dmp

        Filesize

        1024KB

        Download